Paul

{
    "slug": "cloudflare-flexible-ssl",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "PluginAUTH",
            "kind": "ioc:code_pattern",
            "file": "plugin.php",
            "line": 4,
            "snippet": "* Plugin URI: https://icwp.io/cloudflaresslpluginauthor",
            "confidence": "high"
        },
        {
            "pattern": "PluginAUTH",
            "kind": "ioc:code_pattern",
            "file": "plugin.php",
            "line": 9,
            "snippet": "* Author URI: https://icwp.io/cloudflaresslpluginauthor",
            "confidence": "high"
        }
    ],
    "resolved_sha": "b6d92bc1f800748579e12e926ee460c0df4670de"
}

{
    "slug": "worpit-admin-dashboard-plugin",
    "pattern": "PluginAUTH",
    "kind": "ioc:code_pattern",
    "version": "5.5.4",
    "hit_count": 8,
    "first_hit": {
        "file": "src/features/plugin.php",
        "line": 46,
        "snippet": "'sAuthKey'                  => $this->getPluginAuthKey(),"
    },
    "explanation": null
}

{
    "slug": "cloudflare-flexible-ssl",
    "pattern": "PluginAUTH",
    "kind": "ioc:code_pattern",
    "version": "1.3.1",
    "hit_count": 2,
    "first_hit": {
        "file": "plugin.php",
        "line": 4,
        "snippet": "* Plugin URI: https://icwp.io/cloudflaresslpluginauthor"
    },
    "explanation": null
}

{
    "slug": "cloudflare-flexible-ssl",
    "previous_version": "1.3.1",
    "current_version": "1.3.1",
    "new_findings": [
        {
            "pattern": "PluginAUTH",
            "kind": "ioc:code_pattern",
            "file": "plugin.php",
            "line": 4,
            "snippet": "* Plugin URI: https://icwp.io/cloudflaresslpluginauthor",
            "confidence": "high"
        },
        {
            "pattern": "PluginAUTH",
            "kind": "ioc:code_pattern",
            "file": "plugin.php",
            "line": 9,
            "snippet": "* Author URI: https://icwp.io/cloudflaresslpluginauthor",
            "confidence": "high"
        }
    ],
    "new_finding_count": 2
}

{
    "slug": "wp-simple-firewall",
    "finding_count": 30,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Utilities/Forms/FormParams.php",
            "line": 32,
            "snippet": "$raw = \\base64_decode( $raw );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Utilities/Tool/ConvertHtmlToPDF.php",
            "line": 23,
            "snippet": "return empty( $res[ 'is_base64' ] ) ? $res[ 'converted_content' ] : \\base64_decode( $res[ 'converted_content' ] );",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "src/Modules/Plugin/Lib/Reporting/ReportingController.php",
            "line": 58,
            "snippet": "return ( new ConvertHtmlToPDF() )->run( \\gzinflate( $report->content ) );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Modules/LoginGuard/Lib/TwoFactor/Provider/Passkey.php",
            "line": 196,
            "snippet": "return $this->verifyAuthResponse( \\base64_decode( $otp ) )->success;",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Modules/HackGuard/Lib/FileLocker/Ops/Diff.php",
            "line": 44,
            "snippet": "base64_decode( $res[ 'html' ][ 'css_default' ] ),",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Modules/HackGuard/Lib/FileLocker/Ops/Diff.php",
            "line": 45,
            "snippet": "base64_decode( $res[ 'html' ][ 'content' ] )",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Modules/HackGuard/Scan/Queue/QueueItemVO.php",
            "line": 65,
            "snippet": "$decoded = \\base64_decode( $value, true );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Scans/Afs/Scan.php",
            "line": 21,
            "snippet": "$path = \\base64_decode( (string)$item, true );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Scans/Afs/ResultItem.php",
            "line": 106,
            "snippet": "$value = \\base64_decode( $value );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Scans/Afs/ScanFromFileMap.php",
            "line": 27,
            "snippet": "$fullPath = \\base64_decode( $fullPath );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/DBs/Mfa/Ops/Record.php",
            "line": 20,
            "snippet": "$value = @\\json_decode( @\\base64_decode( $value ), true );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/DBs/Malware/Ops/Record.php",
            "line": 30,
            "snippet": "$value = \\base64_decode( $value );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/DBs/FileLocker/Ops/Record.php",
            "line": 25,
            "snippet": "$value = (string)\\base64_decode( $value );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/DBs/Snapshots/Ops/Record.php",
            "line": 16,
            "snippet": "$value = @\\json_decode( @\\base64_decode( $value ), true );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/DBs/Rules/Ops/Record.php",
            "line": 30,
            "snippet": "$value = @\\json_decode( @\\base64_decode( (string)$value ), true );",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "dd3934f54a053ae11586c9fc6f18fc4b0e2e5599"
}

{
    "slug": "wp-simple-firewall",
    "domain": "shldscrty.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2024-11-27",
    "plugin_earliest_commit": "2023-07-26 08:24:37",
    "plugin_latest_release": "2026-04-21 19:53:47",
    "gap_days": 489,
    "domain_age_at_release": 510,
    "active_installs": 40000
}