rank1cdn[.]comDomain
Reported by 2 independent sources · first reported by SecurityWeek · last reported
Last reported 3 days ago
What the reports say
3 reports, newest first · the exact sentence from each-
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites“"The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server," Wordefence said.”
-
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor“Block outgoing connections to rank1cdn[.]com if the hosting provider or firewall allows it.”
-
Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack“… the site from a backup should delete the Rank Math PRO plugin folder, remove a malicious database entry, block the attacker’s domain rank1cdn[.]com, and find and remove suspicious PHP files and unknown administrator accounts.”
Indicators reported together
named in the same reports- 43.250.53[.]42in 1 report
- rankmath[.]comin 1 report
- wp-mail[.]netin 1 report
- group[.]onein 1 report
- teamupdraft[.]comin 1 report
Copy these 5 indicators · defanged
Also named with it: CVE-2026-111862, CVE-2026-109618, CVE-2026-109619, CVE-2026-10795
Thanks — we review every report.