Known Webshell Filename Probe for 2026-07-13
Last Updated: 00:00 UTC
Direct requests for filenames used by common PHP webshells and file managers (ALFA, WSO, b374k, xleet, wp_filemanager and others). Scanners check whether a site was already backdoored by someone else, so they can take over the existing shell instead of exploiting the site themselves.
MITRE ATT&CK
Tactic: Persistence (TA0003)
Technique: T1505.003 — Server Software Component: Web Shell
Observed URIs
Attackers by Country
| Brazil | 4 | 36.4% |
| Sri Lanka | 2 | 18.2% |
| Canada | 2 | 18.2% |
| Israel | 2 | 18.2% |
| Poland | 1 | 9.1% |
IP Address : ASN : City/Provider
-
173.239.196.180 : AS206092 F.n.s. Holdings Limited : Colombo
-
173.239.196.181 : AS206092 F.n.s. Holdings Limited : Colombo
-
195.3.220.7 : AS201814 MEVSPACE sp. z o.o. : Poland
-
20.151.5.71 : AS8075 Microsoft Corporation : Toronto
-
20.195.178.189 : AS8075 Microsoft Corporation : Campinas
-
20.195.184.45 : AS8075 Microsoft Corporation : Campinas
-
20.206.89.130 : AS8075 Microsoft Corporation : Campinas
-
20.226.66.230 : AS8075 Microsoft Corporation : Campinas
-
20.63.63.128 : AS8075 Microsoft Corporation : Toronto
-
203.159.81.45 : AS206092 F.n.s. Holdings Limited : Tel Aviv
-
203.159.81.5 : AS206092 F.n.s. Holdings Limited : Tel Aviv