Known Webshell Filename Probe for 2026-07-07
Last Updated: 00:00 UTC
Direct requests for filenames used by common PHP webshells and file managers (ALFA, WSO, b374k, xleet, wp_filemanager and others). Scanners check whether a site was already backdoored by someone else, so they can take over the existing shell instead of exploiting the site themselves.
MITRE ATT&CK
Tactic: Persistence (TA0003)
Technique: T1505.003 — Server Software Component: Web Shell
Observed URIs
Attackers by Country
| Japan | 8 | 30.8% |
| South Korea | 5 | 19.2% |
| Canada | 4 | 15.4% |
| Brazil | 3 | 11.5% |
| United States | 2 | 7.7% |
| Hong Kong | 2 | 7.7% |
| India | 1 | 3.8% |
| The Netherlands | 1 | 3.8% |
IP Address : ASN : City/Provider
-
104.28.214.112 : AS13335 Cloudflare, Inc. : St Louis
-
104.41.162.106 : AS8075 Microsoft Corporation : Tokyo
-
172.173.65.1 : AS8075 Microsoft Corporation : Des Moines
-
191.237.255.150 : AS8075 Microsoft Corporation : Campinas
-
20.104.50.116 : AS8075 Microsoft Corporation : Toronto
-
20.151.109.130 : AS8075 Microsoft Corporation : Toronto
-
20.151.225.63 : AS8075 Microsoft Corporation : Toronto
-
20.194.39.64 : AS8075 Microsoft Corporation : Seoul
-
20.194.58.32 : AS8075 Microsoft Corporation : Seoul
-
20.196.198.65 : AS8075 Microsoft Corporation : Seoul
-
20.200.216.112 : AS8075 Microsoft Corporation : Seoul
-
20.204.42.226 : AS8075 Microsoft Corporation : Pune
-
20.210.160.218 : AS8075 Microsoft Corporation : Osaka
-
20.210.184.244 : AS8075 Microsoft Corporation : Osaka
-
20.226.121.208 : AS8075 Microsoft Corporation : Campinas
-
20.239.48.125 : AS8075 Microsoft Corporation : Hong Kong
-
20.48.255.163 : AS8075 Microsoft Corporation : Toronto
-
20.89.242.68 : AS8075 Microsoft Corporation : Osaka
-
4.228.96.99 : AS8075 Microsoft Corporation : Campinas
-
40.115.140.72 : AS8075 Microsoft Corporation : Tokyo
-
40.74.72.83 : AS8075 Microsoft Corporation : Osaka
-
45.128.199.250 : AS62240 Clouvider Limited : Amsterdam
-
52.184.100.96 : AS8075 Microsoft Corporation : Hong Kong
-
52.231.76.18 : AS8075 Microsoft Corporation : Seoul
-
52.243.62.144 : AS8075 Microsoft Corporation : Tokyo
-
52.253.101.220 : AS8075 Microsoft Corporation : Tokyo