I started receiving these emails recently so I’m not exactly sure what’s considered bad or false positives.
This is one of the emails I’ve received:
wp-admin/css/colors/midnight/wp-category.php.
wp-admin/includes/wp-block.php.
wp-admin/uploader.php
wp-includes/certificates/wp-register.php
wp-includes/images/media/error.php
wp-includes/js/imgareaselect/code.php
wp-includes/js/mediaelement/xml.php
wp-includes/js/swfupload/plugins/wp-find.php
wp-includes/js/swfupload/plugins/wp-ping.php
wp-includes/js/tinymce/plugins/wpeditimage/wp-register.php
wp-includes/js/tinymce/include.php
wp-includes/random_compat/session.php
wp-includes/SimplePie/Cache/wp-theme.php
wp-includes/SimplePie/Parse/wp-page-update.php
wp-includes/SimplePie/XML/search.php
wp-includes/SimplePie/wp-query.php
wp-includes/Text/code.php
wp-includes/widgets/start.php
wp-includes/widgets/include.php
wp-includes/class-wp-config.php
wp-includes/include.php
Another site we have is saying these ones:
wp-includes/ID3/index.php
wp-includes/customize/start.php
wp-includes/widgets/mssqli.php
wp-includes/widgets/init.php
