WP Beacon

GTM4WP – A Google Tag Manager (GTM) plugin for WordPress

duracelltomi-google-tag-manager · by duracelltomi · wordpress.org ↗ · SVN ↗
Active installs
700k+
Current version
1.22.3
Added
2013-09-23
Last updated
2025-12-15 (4mo ago)
First seen by beacon
10d ago
Total downloads
14,020,385

Alerts (0)

No open alerts.

Show 7 resolved alerts
High domain_younger_than_plugin Resolved · no_longer_matches 2026-05-01 14:25:31 (23h ago)
Slugduracelltomi-google-tag-manager
Domainbluhelp.com
Domain sourcec2_http_call
Domain registered at2025-08-10
Plugin earliest commit2013-09-22 17:52:53
Plugin latest release2025-12-15 14:45:45
Gap days4,339
Domain age at release127
Active installs700,000
View raw JSON
{
    "slug": "duracelltomi-google-tag-manager",
    "domain": "bluhelp.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2025-08-10",
    "plugin_earliest_commit": "2013-09-22 17:52:53",
    "plugin_latest_release": "2025-12-15 14:45:45",
    "gap_days": 4339,
    "domain_age_at_release": 127,
    "active_installs": 700000
}
Critical code_pattern Resolved · false_positive_legit_ip_use 2026-04-30 15:25:27 (1d ago)
Slugduracelltomi-google-tag-manager
Patternhardcoded_ip_url
Kindbuiltin
Version1.22.3
Hit count38
First hit
File
integration/whichbrowser/data/profiles.php
Line
647
Snippet
'http://112.74.195.169/upload/xmlfiles/STUDIO_X8_HD.XML' => [ 'BLU', 'Studio X8 HD', 'Android', DeviceType::MOBILE ],
Explanationplugin source hardcodes a raw IPv4 URL (e.g. `https://94.156.79.8/...`) — legitimate plugins use DNS hostnames because IPs change. Hardcoded IPs in plugin code are almost always either dev leftovers or attacker C2 infrastructure. The June 2024 social-warfare keylogger (audit #14) used `https://94.156.79.8/sc-top.js` for the JS payload host, `/AddSites` for victim registration, `/CMSUsers` for filesystem-recon exfil. Operator infrastructure on raw IPs avoids domain registration / RDAP detection paths. Post-filtered to skip RFC1918/loopback/link-local ranges and `vendor/`/`tests/` paths.
View raw JSON
{
    "slug": "duracelltomi-google-tag-manager",
    "pattern": "hardcoded_ip_url",
    "kind": "builtin",
    "version": "1.22.3",
    "hit_count": 38,
    "first_hit": {
        "file": "integration/whichbrowser/data/profiles.php",
        "line": 647,
        "snippet": "'http://112.74.195.169/upload/xmlfiles/STUDIO_X8_HD.XML'                                              => [ 'BLU', 'Studio X8 HD', 'Android', DeviceType::MOBILE ],"
    },
    "explanation": "plugin source hardcodes a raw IPv4 URL (e.g. `https://94.156.79.8/...`) \u2014 legitimate plugins use DNS hostnames because IPs change. Hardcoded IPs in plugin code are almost always either dev leftovers or attacker C2 infrastructure. The June 2024 social-warfare keylogger (audit #14) used `https://94.156.79.8/sc-top.js` for the JS payload host, `/AddSites` for victim registration, `/CMSUsers` for filesystem-recon exfil. Operator infrastructure on raw IPs avoids domain registration / RDAP detection paths. Post-filtered to skip RFC1918/loopback/link-local ranges and `vendor/`/`tests/` paths."
}
Critical code_scan_delta Resolved · false_positive_cdn_known_good 2026-04-30 05:58:14 (2d ago)
Slugduracelltomi-google-tag-manager
Previous version1.22.3
Current version1.22.3
New findings
PatternKindFileLineSnippetConfidence
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php647'http://112.74.195.169/upload/xmlfiles/STUDIO_X8_HD.XML' => [ 'BLU', 'Studio X8 HD', 'Android', DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php699'http://221.176.65.117/uaprof/CMDC_M601.xml' => [ 'China Mobile', 'M601', 'Android', DeviceType::TABLET ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php701'http://221.176.65.117/uaprof/CMCC-M812.xml' => [ 'China Mobile Device', 'and M812', 'Android', DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php702'http://221.176.65.117/uaprof/M821.xml' => [ 'China Mobile Device', 'and M821', 'Android', DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php703'http://221.176.65.117/uaprof/M823.xml' => [ 'China Mobile Device', 'and M823', 'Android', DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php722'http://122.200.68.229/docs/mini3ix.xml' => [ 'Dell', 'Mini 3ix', 'Android', DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php754'http://211.42.201.70/ua_profile/FLY-2040i.xml' => [ 'Fly', '2040', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php755'http://211.42.201.70/ua_profile/FLY-2040L.xml' => [ 'Fly', '2040', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php758'http://211.42.201.70/ua_profile/Fly-E300.xml' => [ 'Fly', 'E300', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php814'http://211.42.201.70/ua_profile/Fly-LX610.xml' => [ 'Fly', 'LX610', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php817'http://211.42.201.70/ua_profile/FLY-MX200i.xml' => [ 'Fly', 'MX200', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php818'http://211.42.201.70/ua_profile/FLY-MX230.xml' => [ 'Fly', 'MX230', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php819'http://211.42.201.70/ua_profile/FLY-MX300.xml' => [ 'Fly', 'MX300', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php820'http://211.42.201.70/ua_profile/FLY-MX330.xml' => [ 'Fly', 'MX330', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php821'http://211.42.201.70/ua_profile/FLY-SL300m.xml' => [ 'Fly', 'SL300', null, DeviceType::MOBILE ],high
New finding count38
View raw JSON
{
    "slug": "duracelltomi-google-tag-manager",
    "previous_version": "1.22.3",
    "current_version": "1.22.3",
    "new_findings": [
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 647,
            "snippet": "'http://112.74.195.169/upload/xmlfiles/STUDIO_X8_HD.XML'                                              => [ 'BLU', 'Studio X8 HD', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 699,
            "snippet": "'http://221.176.65.117/uaprof/CMDC_M601.xml'                                                          => [ 'China Mobile', 'M601', 'Android', DeviceType::TABLET ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 701,
            "snippet": "'http://221.176.65.117/uaprof/CMCC-M812.xml'                                                          => [ 'China Mobile Device', 'and M812', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 702,
            "snippet": "'http://221.176.65.117/uaprof/M821.xml'                                                               => [ 'China Mobile Device', 'and M821', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 703,
            "snippet": "'http://221.176.65.117/uaprof/M823.xml'                                                               => [ 'China Mobile Device', 'and M823', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 722,
            "snippet": "'http://122.200.68.229/docs/mini3ix.xml'                                                              => [ 'Dell', 'Mini 3ix', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 754,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-2040i.xml'                                                       => [ 'Fly', '2040', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 755,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-2040L.xml'                                                       => [ 'Fly', '2040', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 758,
            "snippet": "'http://211.42.201.70/ua_profile/Fly-E300.xml'                                                        => [ 'Fly', 'E300', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 814,
            "snippet": "'http://211.42.201.70/ua_profile/Fly-LX610.xml'                                                       => [ 'Fly', 'LX610', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 817,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX200i.xml'                                                      => [ 'Fly', 'MX200', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 818,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX230.xml'                                                       => [ 'Fly', 'MX230', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 819,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX300.xml'                                                       => [ 'Fly', 'MX300', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 820,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX330.xml'                                                       => [ 'Fly', 'MX330', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 821,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-SL300m.xml'                                                      => [ 'Fly', 'SL300', null, DeviceType::MOBILE ],",
            "confidence": "high"
        }
    ],
    "new_finding_count": 38
}
Critical domain_younger_than_plugin Resolved · no_longer_matches 2026-04-24 06:14:49 (8d ago)
Slugduracelltomi-google-tag-manager
Domain51coolpad.com
Domain sourcec2_http_call
Domain registered at2025-04-08
Plugin earliest commit2013-09-22 17:52:53
Plugin latest release2025-12-15 14:45:45
Gap days4,215
Domain age at release251
Active installs700,000
View raw JSON
{
    "slug": "duracelltomi-google-tag-manager",
    "domain": "51coolpad.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2025-04-08",
    "plugin_earliest_commit": "2013-09-22 17:52:53",
    "plugin_latest_release": "2025-12-15 14:45:45",
    "gap_days": 4215,
    "domain_age_at_release": 251,
    "active_installs": 700000
}
Critical domain_younger_than_plugin Resolved · no_longer_matches 2026-04-24 06:14:49 (8d ago)
Slugduracelltomi-google-tag-manager
Domainmuseui.com
Domain sourcec2_http_call
Domain registered at2024-06-13
Plugin earliest commit2013-09-22 17:52:53
Plugin latest release2025-12-15 14:45:45
Gap days3,916
Domain age at release550
Active installs700,000
View raw JSON
{
    "slug": "duracelltomi-google-tag-manager",
    "domain": "museui.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2024-06-13",
    "plugin_earliest_commit": "2013-09-22 17:52:53",
    "plugin_latest_release": "2025-12-15 14:45:45",
    "gap_days": 3916,
    "domain_age_at_release": 550,
    "active_installs": 700000
}
Critical domain_younger_than_plugin Resolved · no_longer_matches 2026-04-24 06:14:49 (8d ago)
Slugduracelltomi-google-tag-manager
Domainn-keitai.com
Domain sourcec2_http_call
Domain registered at2024-02-04
Plugin earliest commit2013-09-22 17:52:53
Plugin latest release2025-12-15 14:45:45
Gap days3,786
Domain age at release680
Active installs700,000
View raw JSON
{
    "slug": "duracelltomi-google-tag-manager",
    "domain": "n-keitai.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2024-02-04",
    "plugin_earliest_commit": "2013-09-22 17:52:53",
    "plugin_latest_release": "2025-12-15 14:45:45",
    "gap_days": 3786,
    "domain_age_at_release": 680,
    "active_installs": 700000
}
Critical domain_younger_than_plugin Resolved · no_longer_matches 2026-04-24 06:14:49 (8d ago)
Slugduracelltomi-google-tag-manager
Domainpanasonicbox.com
Domain sourcec2_http_call
Domain registered at2025-09-29
Plugin earliest commit2013-09-22 17:52:53
Plugin latest release2025-12-15 14:45:45
Gap days4,389
Domain age at release77
Active installs700,000
View raw JSON
{
    "slug": "duracelltomi-google-tag-manager",
    "domain": "panasonicbox.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2025-09-29",
    "plugin_earliest_commit": "2013-09-22 17:52:53",
    "plugin_latest_release": "2025-12-15 14:45:45",
    "gap_days": 4389,
    "domain_age_at_release": 77,
    "active_installs": 700000
}

SVN committers (2)

Accounts with actual commit access to duracelltomi-google-tag-manager on plugins.svn.wordpress.org, reconstructed from svn log. This is the list that matters for ownership changes — not the readme contributors.

Committer Member since Commits First commit Latest commit
Thomas Geiger 2010-06-25 200 2013-09-23 · r777092 2025-12-15 · r3420244
plugin-master 2007-03-09 1 2013-09-22 · r776842 2013-09-22 · r776842

Readme contributors (1)

Names the plugin's readme declares as contributors. A soft signal — anyone can be listed. The SVN access column is the ground-truth cross-reference: does this contributor actually commit code?

Contributor Member since SVN access Status
Thomas Geiger 2010-06-25 200 commits Active

Versions (72 most recent)

Version Released Download
1.22.3 2025-12-15 · 4mo ago zip
1.22.2 2025-11-25 · 5mo ago zip
1.22.1 2025-09-08 · 7mo ago zip
1.22 2025-08-26 · 8mo ago zip
1.21.1 2025-05-17 · 11mo ago zip
1.21 2025-05-08 · 11mo ago zip
1.20.3 2024-12-09 · 1y ago zip
1.20.2 2024-04-04 · 2y ago zip
1.20.1 2024-03-21 · 2y ago zip
1.20 2024-02-05 · 2y ago zip
1.19.1 2023-12-14 · 2y ago zip
1.19 2023-12-11 · 2y ago zip
1.18.1 2023-08-23 · 2y ago zip
1.18 2023-08-15 · 2y ago zip
1.16.2 2022-11-17 · 3y ago zip
1.16.1 2022-08-01 · 3y ago zip
1.16 2022-06-23 · 3y ago zip
1.15.2 2022-05-28 · 3y ago zip
1.15.1 2022-05-23 · 3y ago zip
1.15 2022-04-12 · 4y ago zip
1.14.2 2022-01-03 · 4y ago zip
1.14.1 2021-12-13 · 4y ago zip
1.14 2021-12-13 · 4y ago zip
1.13.1 2021-05-20 · 4y ago zip
1.13 2021-05-19 · 4y ago zip
1.12.3 2021-04-19 · 5y ago zip
1.12.2 2021-04-10 · 5y ago zip
1.12.1 2021-04-09 · 5y ago zip
1.12 2021-04-09 · 5y ago zip
1.11.6 2020-11-30 · 5y ago zip
1.11.5 2020-09-04 · 5y ago zip
1.11.4 2020-08-19 · 5y ago zip
1.11.3 2020-03-10 · 6y ago zip
1.11.2 2019-11-13 · 6y ago zip
1.11.1 2019-11-13 · 6y ago zip
1.11 2019-11-11 · 6y ago zip
1.10.1 2019-08-12 · 6y ago zip
1.10 2019-08-01 · 6y ago zip
1.9.2 2019-05-14 · 6y ago zip
1.9.1 2019-01-30 · 7y ago zip
1.9 2018-09-25 · 7y ago zip
1.8.1 2018-06-05 · 7y ago zip
1.8 2018-05-14 · 7y ago zip
1.7.2 2017-11-21 · 8y ago zip
1.7.1 2017-08-14 · 8y ago zip
1.7 2017-08-03 · 8y ago zip
1.6.1 2017-04-20 · 9y ago zip
1.6 2017-04-18 · 9y ago zip
1.5.1 2016-12-03 · 9y ago zip
1.5 2016-12-01 · 9y ago zip
1.4 2016-08-17 · 9y ago zip
1.3.2 2016-06-27 · 9y ago zip
1.3.1 2016-06-21 · 9y ago zip
1.3 2016-06-20 · 9y ago zip
1.2 2015-12-30 · 10y ago zip
1.1.1 2015-07-14 · 10y ago zip
1.1 2015-07-12 · 10y ago zip
1.0 2015-05-04 · 11y ago zip
0.9.1 2015-02-23 · 11y ago zip
0.9 2015-02-13 · 11y ago zip
0.8.2 2014-12-17 · 11y ago zip
0.8.1 2014-09-17 · 11y ago zip
0.8 2014-09-03 · 11y ago zip
0.7.1 2014-05-10 · 11y ago zip
0.7 2014-02-12 · 12y ago zip
0.6 2014-01-17 · 12y ago zip
0.5.1 2014-01-08 · 12y ago zip
0.5 2013-12-30 · 12y ago zip
0.4 2013-11-24 · 12y ago zip
0.3 2013-11-03 · 12y ago zip
0.2 2013-10-14 · 12y ago zip
0.1 2013-09-23 · 12y ago zip