More revealing even are these two scans on this alleged CyrusOne abuse.
First we see where two malicious sites are being contacted as reported by Google’s: https://urlscan.io/result/d28120bb-8d43-416c-94a6-c7f7e0fe78c6#summary
And DOM_XSS sources and sinks: -http://www.domxssscanner.com/scan?url=http%3A%2F%2Fwww.petinsurancereviews.net
where we detected the above uri to be scanned: -http://www.petinsurancereviews.net/xmlrpc.php
Some of the php we may come accross : comment-template.php; comment.php; compat.php; cron.php (Unrestricted Cron Script webapp exploit, as was used on Magento); default-constants.php ; default-filters.php ; default-widgets.php ;deprecated.php ;
embed-template.php ; embed.php etc. etc. → functions.wp-scripts.php ; functions.wp-styles.php ;
general-template.php … where code can be injected into images and other php exploits could be performed.
polonus (volunteer website security analyst and website error-hunter)
