BEWARE!
Attackers abuse Certificate Transparency (CT) to compromise new WordPress sites in a short period of time before the content management system (CMS) is configured and therefore protected.
Domain owners report the appearance of a malicious file (/wp-includes/.query.php) and that sites are forced to join DDoS attacks.