Known Webshell Filename Probe for 2026-07-26

Jul 26, 2026 Exploitation

Last Updated: 00:00 UTC

Direct requests for filenames used by common PHP webshells and file managers (ALFA, WSO, b374k, xleet, wp_filemanager and others). Scanners check whether a site was already backdoored by someone else, so they can take over the existing shell instead of exploiting the site themselves.

MITRE ATT&CK

Tactic: Persistence (TA0003)
Technique: T1505.003 — Server Software Component: Web Shell

Observed URIs

Attackers by Country

United States	6	14.6%
Brazil	5	12.2%
Poland	5	12.2%
Germany	5	12.2%
Spain	4	9.8%
Switzerland	4	9.8%
Norway	3	7.3%
Sweden	3	7.3%
Canada	2	4.9%
Singapore	2	4.9%
New Zealand	1	2.4%
Italy	1	2.4%

IP Address : ASN : City/Provider

158.158.32.226 : AS8075 Microsoft Corporation : Madrid
158.158.32.229 : AS8075 Microsoft Corporation : Madrid
158.158.96.17 : AS8075 Microsoft Corporation : Madrid
172.173.84.17 : AS8075 Microsoft Corporation : Des Moines
172.202.44.182 : AS8075 Microsoft Corporation : Des Moines
172.204.17.66 : AS8075 Microsoft Corporation : Auckland
172.213.144.209 : AS8075 Microsoft Corporation : Milan
191.235.98.185 : AS8075 Microsoft Corporation : Campinas
195.3.220.7 : AS201814 MEVSPACE sp. z o.o. : Poland
20.100.173.28 : AS8075 Microsoft Corporation : Oslo
20.100.178.92 : AS8075 Microsoft Corporation : Oslo
20.113.56.22 : AS8075 Microsoft Corporation : Frankfurt am Main
20.125.96.254 : AS8075 Microsoft Corporation : Phoenix
20.151.221.234 : AS8075 Microsoft Corporation : Toronto
20.171.55.167 : AS8075 Microsoft Corporation : Phoenix
20.195.181.10 : AS8075 Microsoft Corporation : Campinas
20.197.178.120 : AS8075 Microsoft Corporation : Campinas
20.197.195.24 : AS8075 Microsoft Corporation : Campinas
20.199.183.73 : AS8075 Microsoft Corporation : Zurich
20.203.133.142 : AS8075 Microsoft Corporation : Zurich
20.203.200.218 : AS8075 Microsoft Corporation : Zurich
20.203.219.190 : AS8075 Microsoft Corporation : Zurich
20.206.67.15 : AS8075 Microsoft Corporation : Campinas
20.215.216.94 : AS8075 Microsoft Corporation : Warsaw
20.48.234.177 : AS8075 Microsoft Corporation : Toronto
20.52.54.143 : AS8075 Microsoft Corporation : Frankfurt am Main
4.184.121.217 : AS8075 Microsoft Corporation : Frankfurt am Main
4.185.41.66 : AS8075 Microsoft Corporation : Frankfurt am Main
4.194.217.15 : AS8075 Microsoft Corporation : Singapore
4.194.24.143 : AS8075 Microsoft Corporation : Singapore
4.223.226.192 : AS8075 Microsoft Corporation : Sweden
4.223.77.241 : AS8075 Microsoft Corporation : Sweden
4.225.203.146 : AS8075 Microsoft Corporation : Sweden
51.116.233.22 : AS8075 Microsoft Corporation : Frankfurt am Main
51.120.79.193 : AS8075 Microsoft Corporation : Oslo
52.165.196.84 : AS8075 Microsoft Corporation : Des Moines
52.173.161.248 : AS8075 Microsoft Corporation : Des Moines
68.221.69.72 : AS8075 Microsoft Corporation : Madrid
74.248.139.103 : AS8075 Microsoft Corporation : Warsaw
74.248.33.172 : AS8075 Microsoft Corporation : Warsaw
74.248.33.8 : AS8075 Microsoft Corporation : Warsaw

Share on: