wp2shell-rce/1.0

[[TODO: MAP ONE SENTENCE SUMMARY]]

Category: [[TODO: MAP CATEGORY]] Avg 2.1 req/min Seen on 75 systems 489 observed requests 4 exact variants First seen August 3, 2026 Last seen October 18, 2026

[[TODO: MAP INTRODUCTION PARAGRAPH 1]]

[[TODO: MAP INTRODUCTION PARAGRAPH 2]]

What is wp2shell-rce/1.0?

[[TODO: MAP DEFINITION SUMMARY]]

[[TODO: MAP SHORT REFERENCE SUMMARY]]

Analyst summary: [[TODO: MAP ANALYST REPORT SUMMARY]]
User-agent
wp2shell-rce/1.0
Observed source IPs
0
Observed requests
489
Source networks
136
Exact variants
4
Latest hit count
586
Latest miss count
526
Latest 404 count
0
Unique paths
33
Related campaigns
[[TODO: MAP RELATED CAMPAIGN COUNT]]

Observed exact user-agent strings

wp2shell-rce/1.0 First seen August 3, 2026 · Last seen October 18, 2026
wp2shell/4.0 First seen August 3, 2026 · Last seen September 28, 2026
wp shell First seen August 9, 2026 · Last seen September 11, 2026
wp2shell/1.0 First seen August 15, 2026 · Last seen August 15, 2026

Behavior profile

[[TODO: MAP BEHAVIOR PROFILE INTRO]]

Category
[[TODO: MAP CATEGORY]]
Average request rate
2.1 requests per minute
HTTP and HTTPS support
[[TODO: MAP HTTP HTTPS SUPPORT]]
HTTP version support
[[TODO: MAP PROTOCOL SUPPORT SUMMARY]]
Redirect behavior
[[TODO: MAP REDIRECT BEHAVIOR]]
Robots.txt behavior
[[TODO: MAP ROBOTS TXT BEHAVIOR]]
Crawl-rate behavior
[[TODO: MAP CRAWL RATE BEHAVIOR]]
JavaScript execution
[[TODO: MAP JAVASCRIPT SUPPORT]]
Form submission activity
[[TODO: MAP FORM SUBMISSION ACTIVITY]]
Malformed URL requests
[[TODO: MAP MALFORMED URL BEHAVIOR]]
HTTP/1.0: [[TODO: MAP HTTP 1.0 SUPPORT]] HTTP/1.1: [[TODO: MAP HTTP 1.1 SUPPORT]] HTTP/2: [[TODO: MAP HTTP 2 SUPPORT]] HTTP/3: [[TODO: MAP HTTP 3 SUPPORT]] [[TODO: MAP HEADER ORDER FINGERPRINTED]]

Source distribution

[[TODO: MAP SOURCE DISTRIBUTION INTRO]]

Top countries

Country Networks Site sightings Share
United States 48 136 53.8%
Indonesia 44 71 29.0%
India 3 6 2.7%
Bulgaria 2 5 1.8%
Cameroon 3 4 1.4%
Sweden 2 4 1.4%
United Kingdom 6 6 1.4%
Czechia 2 4 1.4%
Finland 4 4 1.2%
Netherlands 3 3 0.8%

Top ASNs

ASN Organization Networks Share
AS53667 [[TODO: MAP ASN ORGANIZATION]] 15 36.8%
AS14061 [[TODO: MAP ASN ORGANIZATION]] 12 5.9%
AS31898 [[TODO: MAP ASN ORGANIZATION]] 6 5.5%
AS24203 [[TODO: MAP ASN ORGANIZATION]] 7 5.5%
AS140389 [[TODO: MAP ASN ORGANIZATION]] 4 4.3%
AS138115 [[TODO: MAP ASN ORGANIZATION]] 4 3.9%
AS63859 [[TODO: MAP ASN ORGANIZATION]] 7 3.3%
AS17451 [[TODO: MAP ASN ORGANIZATION]] 4 3.3%
AS151592 [[TODO: MAP ASN ORGANIZATION]] 3 3.1%
AS209946 [[TODO: MAP ASN ORGANIZATION]] 2 2.9%

Top datacenters

Provider Type Snapshots Share

Representative source IPs

[[TODO: MAP REPRESENTATIVE IPS INTRO]]

HTTP fingerprint and request characteristics

[[TODO: MAP HTTP FINGERPRINT INTRO]]

Observed header order
[[TODO: MAP HTTP HEADER ORDER SUMMARY]]
Common headers sent
[[TODO: MAP COMMON HEADERS SUMMARY]]
TLS and HTTPS behavior
[[TODO: MAP TLS HTTPS SUMMARY]]
URL normalization behavior
[[TODO: MAP URL NORMALIZATION SUMMARY]]
Malformed request patterns
[[TODO: MAP MALFORMED REQUEST SUMMARY]]
[[TODO: MAP OBSERVED HTTP HEADERS]]

Observed sample requests

[[TODO: MAP SAMPLE REQUESTS INTRO]]

POST
/?rest_route=%2Fbatch%2Fv1&%7B%7D=
Status pattern: HTTP 403
Seen 27 times, Last seen August 26, 2026
GET
/
Status pattern: HTTP 200
Seen 44 times, Last seen August 26, 2026
GET
/
Status pattern: HTTP 301
Seen 6 times, Last seen August 26, 2026
GET
/?rest_route=%2Fbatch%2Fv1
Status pattern: HTTP 403
Seen 6 times, Last seen August 10, 2026
POST
/?rest_route=%2Fbatch%2Fv1&requests%5B0%5D%5Bmethod%5D=POST&requests%5B0%5D%5Bpath%5D=%2F%2F%2F&requests%5B1%5D%5Bmethod%5D=POST&requests%5B1%5D%5Bpath%5D=%2Fwp%2Fv2%2Fposts&requests%5B1%5D%5B
Status pattern: HTTP 403
Seen 8 times, Last seen August 8, 2026
HEAD
/
Status pattern: HTTP 200
Seen 18 times, Last seen August 8, 2026
HEAD
/
Status pattern: HTTP 301
Seen 4 times, Last seen August 8, 2026
GET
/wp-login.php
Status pattern: HTTP 403
Seen 7 times, Last seen August 7, 2026

Related campaigns and associations

[[TODO: MAP RELATED CAMPAIGNS INTRO]]

[[TODO: MAP RELATED CAMPAIGN NAME]]

[[TODO: MAP RELATED CAMPAIGN SUMMARY]]
Related IPs: [[TODO: MAP RELATED CAMPAIGN IP COUNT]], Systems seen: [[TODO: MAP RELATED CAMPAIGN SYSTEMS SEEN]]
Confidence: [[TODO: MAP RELATED CAMPAIGN CONFIDENCE]]

Detailed analyst report

[[TODO: MAP ANALYST REPORT PARAGRAPH 1]]

[[TODO: MAP ANALYST REPORT PARAGRAPH 2]]

[[TODO: MAP ANALYST REPORT PARAGRAPH 3]]

Frequently asked questions about wp2shell-rce/1.0

What is wp2shell-rce/1.0?

[[TODO: MAP FAQ WHAT IS ANSWER]]

Is wp2shell-rce/1.0 considered malicious?

[[TODO: MAP FAQ MALICIOUS ANSWER]]

Does wp2shell-rce/1.0 respect robots.txt and crawl-rate controls?

[[TODO: MAP FAQ ROBOTS ANSWER]]

What infrastructure is commonly associated with wp2shell-rce/1.0?

[[TODO: MAP FAQ INFRASTRUCTURE ANSWER]]