Skip to content
Contact us
  Threat research

Tracing Poisoned Source Delivery Infrastructure

A 199-byte loader pointed to a domain. Historical DNS traced it back to April 2026.

Attaxion researchers compared two archived copies of a WordPress plugin script and found an external script loader appended to the newer copy. The loader matched the published Poisoned Source pattern. Historical DNS and archived browser captures linked its destination to the same IP address, supporting a lead for further investigation.

What the investigation uncovered

→ A hash-verified archived file with a 199-byte loader appended to the original plugin script
→ Seven historical DNS observations linking the loader’s destination to the same IP address between April and October 2026
→ Two November browser captures that recorded requests to the destination, both with empty responses
Evidence reviewed
November 4–6, 2026
Data sources
Historical DNS, archived code & browser captures
Research team
Attaxion Research

Download the full report

Get the evidence, DNS timeline and indicators to check against your own logs.

 
Key findings

What archived code and historical DNS revealed

Archived code showed what changed in the plugin script and where the added loader pointed. Historical DNS connected that destination to the IP address seen in November browser captures and dated the earliest observed match to April 2026.

199

Bytes added to the plugin script

The archived file contained an appended loader that matched the published Poisoned Source pattern.

7

Historical DNS observations

The loader’s destination resolved to the same IP address on seven dates between April and October 2026.

2

Browser captures from one site

Both captures recorded requests to the loader’s destination on November 4. Both responses had empty bodies.

5

Additional IP mappings

The wider investigation found five more historical IP mappings for previously published delivery domains, giving researchers leads to check.

Why it matters

Historical DNS puts delivery infrastructure on a timeline

Archived code showed where the added loader pointed. Historical DNS showed that its destination resolved to the IP address seen in November browser captures as early as April 2026. The full report explains how to use dated DNS records and archived evidence together to investigate delivery infrastructure and put matches in your own logs into context.