⚠️ Overview

AkismetBot is a malicious scanning and exploitation tool that masquerades as the legitimate Akismet anti‑spam service user‑agent, originally developed by Automattic for WordPress comment filtering. Security researchers at Sucuri and Wordfence have documented this bot as being used in credential‑stuffing, content scraping, and vulnerability probing campaigns since 2018, with no affiliation to the official Akismet service.

🔧 Technical Capabilities

AkismetBot operates by sending HTTP requests that mimic the legitimate Akismet User‑Agent string (e.g., AkismetBot/1.0) to bypass simple user‑agent‑based allowlists. Once inside, it aggressively scans for common web application vulnerabilities such as SQL injection, cross‑site scripting (XSS), and local file inclusion (LFI) by appending malicious payloads to URL parameters and form inputs. It also performs directory brute‑forcing to discover hidden administrative panels, backup files, and exposed configuration files like wp-config.php or .env. The bot is capable of iterative parameter tampering and timing‑based blind SQL injection detection, often referencing known exploit databases such as Exploit‑DB. Additionally, it harvests publicly exposed credentials and session tokens, enabling lateral movement within compromised environments.

📜 History & Notable Incidents

The earliest documented sightings of malicious AkismetBot activity were reported in Sucuri’s 2019 Q3 threat report, where it was observed targeting over 10,000 WordPress installations with payloads targeting the unpatched WP‑Fastest‑Cache plugin (CVE‑2019‑11419). In 2021, Wordfence recorded a widespread campaign using this bot to probe for multiple vulnerabilities in the Elementor and WP‑Forms plugins, resulting in thousands of sites being compromised. The bot has also been linked to automated brute‑force attacks against WooCommerce stores, using lists of common usernames and passwords.

🔍 Detection Indicators

The primary detection indicator is the User‑Agent string AkismetBot/1.0 or variants such as AkismetBot/2.0 and Mozilla/5.0 (compatible; AkismetBot/1.0; +http://akismet.com/bot). Behavioral fingerprints include rapid‑fire requests with no referrer, high volumes of requests to rarely‑accessed paths (e.g., /wp‑content/uploads/), and repeated attempts to access /wp‑admin/admin‑ajax.php with non‑standard actions. It often sends requests from IP ranges associated with known cloud providers (AWS, DigitalOcean) that lack reverse‑DNS records.

☠️ Risk & Impact

AkismetBot can lead to complete site takeover if it successfully exploits outdated plugins or themes. It is known to exfiltrate database contents (user credentials, payment details), inject malicious JavaScript for SEO spam or phishing redirections, and deploy backdoors for persistent access. In multi‑tenant environments, a single compromised site can be used as a pivot point to attack other sites on the same server, escalating the damage.

🛡️ Mitigation

This bot is blocked immediately on detection because its legitimate‑looking User‑Agent is a deliberate deception designed to evade basic defenses. Blocks are enforced via web application firewall (WAF) rules that inspect request patterns, rate‑limiting, and strict allowlisting of known legitimate Akismet IP ranges published by Automattic.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.