Known Webshell Filename Probe for 2026-07-10
Last Updated: 00:00 UTC
Direct requests for filenames used by common PHP webshells and file managers (ALFA, WSO, b374k, xleet, wp_filemanager and others). Scanners check whether a site was already backdoored by someone else, so they can take over the existing shell instead of exploiting the site themselves.
MITRE ATT&CK
Tactic: Persistence (TA0003)
Technique: T1505.003 — Server Software Component: Web Shell
Observed URIs
Attackers by Country
| Qatar | 2 | 22.2% |
| Brazil | 2 | 22.2% |
| Canada | 2 | 22.2% |
| New Zealand | 2 | 22.2% |
| United States | 1 | 11.1% |
IP Address : ASN : City/Provider
-
134.122.113.99 : AS14061 DigitalOcean, LLC : North Bergen
-
135.136.47.113 : AS9009 M247 Europe SRL : Doha
-
135.136.47.211 : AS9009 M247 Europe SRL : Doha
-
191.237.255.150 : AS8075 Microsoft Corporation : Campinas
-
20.195.184.45 : AS8075 Microsoft Corporation : Campinas
-
20.220.212.5 : AS8075 Microsoft Corporation : Toronto
-
20.48.255.163 : AS8075 Microsoft Corporation : Toronto
-
45.133.7.13 : AS137409 GSL Networks Pty LTD : Auckland
-
45.133.7.5 : AS137409 GSL Networks Pty LTD : Auckland