Known Webshell Filename Probe for 2026-07-22
Last Updated: 00:00 UTC
Direct requests for filenames used by common PHP webshells and file managers (ALFA, WSO, b374k, xleet, wp_filemanager and others). Scanners check whether a site was already backdoored by someone else, so they can take over the existing shell instead of exploiting the site themselves.
MITRE ATT&CK
Tactic: Persistence (TA0003)
Technique: T1505.003 — Server Software Component: Web Shell
Observed URIs
Attackers by Country
| United States | 12 | 52.2% |
| Brazil | 4 | 17.4% |
| Poland | 2 | 8.7% |
| Canada | 2 | 8.7% |
| Singapore | 2 | 8.7% |
| Sweden | 1 | 4.3% |
IP Address : ASN : City/Provider
-
130.131.233.88 : AS8075 Microsoft Corporation : Des Moines
-
168.62.180.116 : AS8075 Microsoft Corporation : Dulles
-
172.170.251.50 : AS8075 Microsoft Corporation : Des Moines
-
172.202.37.160 : AS8075 Microsoft Corporation : Des Moines
-
195.3.220.7 : AS201814 MEVSPACE sp. z o.o. : Poland
-
20.10.203.190 : AS8075 Microsoft Corporation : Boydton
-
20.104.96.117 : AS8075 Microsoft Corporation : Toronto
-
20.118.34.228 : AS8075 Microsoft Corporation : Des Moines
-
20.12.183.135 : AS8075 Microsoft Corporation : Des Moines
-
20.172.218.20 : AS8075 Microsoft Corporation : Dulles
-
20.197.192.193 : AS8075 Microsoft Corporation : Campinas
-
20.197.195.24 : AS8075 Microsoft Corporation : Campinas
-
20.206.105.145 : AS8075 Microsoft Corporation : Campinas
-
20.226.60.151 : AS8075 Microsoft Corporation : Campinas
-
20.63.100.92 : AS8075 Microsoft Corporation : Toronto
-
20.9.82.255 : AS8075 Microsoft Corporation : Des Moines
-
4.194.217.15 : AS8075 Microsoft Corporation : Singapore
-
4.194.24.143 : AS8075 Microsoft Corporation : Singapore
-
4.223.226.192 : AS8075 Microsoft Corporation : Sweden
-
52.165.63.205 : AS8075 Microsoft Corporation : Des Moines
-
52.182.173.140 : AS8075 Microsoft Corporation : Des Moines
-
74.248.139.103 : AS8075 Microsoft Corporation : Warsaw
-
74.249.219.123 : AS8075 Microsoft Corporation : Des Moines