Known Webshell Filename Probe for 2026-07-28

Jul 28, 2026 Exploitation

Last Updated: 00:00 UTC

Direct requests for filenames used by common PHP webshells and file managers (ALFA, WSO, b374k, xleet, wp_filemanager and others). Scanners check whether a site was already backdoored by someone else, so they can take over the existing shell instead of exploiting the site themselves.

MITRE ATT&CK

Tactic: Persistence (TA0003)
Technique: T1505.003 — Server Software Component: Web Shell

Observed URIs

Attackers by Country

Canada	6	16.7%
United States	5	13.9%
Brazil	5	13.9%
Italy	4	11.1%
Norway	4	11.1%
Germany	3	8.3%
Spain	2	5.6%
Switzerland	2	5.6%
Sweden	2	5.6%
Singapore	1	2.8%
United Kingdom	1	2.8%
Poland	1	2.8%

IP Address : ASN : City/Provider

135.119.63.61 : AS8075 Microsoft Corporation : Des Moines
135.119.74.228 : AS8075 Microsoft Corporation : Des Moines
148.72.244.235 : AS26496 GoDaddy.com, LLC : Singapore
158.158.96.17 : AS8075 Microsoft Corporation : Madrid
172.213.208.20 : AS8075 Microsoft Corporation : Milan
172.213.216.126 : AS8075 Microsoft Corporation : Milan
172.213.244.85 : AS8075 Microsoft Corporation : Milan
172.213.8.106 : AS8075 Microsoft Corporation : Milan
185.192.71.151 : AS206092 F.n.s. Holdings Limited : London
191.232.199.39 : AS8075 Microsoft Corporation : Campinas
191.235.102.133 : AS8075 Microsoft Corporation : Campinas
195.3.220.7 : AS201814 MEVSPACE sp. z o.o. : Poland
20.100.176.141 : AS8075 Microsoft Corporation : Oslo
20.100.203.84 : AS8075 Microsoft Corporation : Oslo
20.104.18.253 : AS8075 Microsoft Corporation : Toronto
20.151.107.236 : AS8075 Microsoft Corporation : Toronto
20.151.221.150 : AS8075 Microsoft Corporation : Toronto
20.151.221.234 : AS8075 Microsoft Corporation : Toronto
20.171.55.167 : AS8075 Microsoft Corporation : Phoenix
20.195.181.10 : AS8075 Microsoft Corporation : Campinas
20.197.178.120 : AS8075 Microsoft Corporation : Campinas
20.203.142.71 : AS8075 Microsoft Corporation : Zurich
20.203.219.190 : AS8075 Microsoft Corporation : Zurich
20.226.5.174 : AS8075 Microsoft Corporation : Campinas
20.63.10.215 : AS8075 Microsoft Corporation : Toronto
20.79.29.209 : AS8075 Microsoft Corporation : Frankfurt am Main
20.9.63.139 : AS8075 Microsoft Corporation : Des Moines
20.91.139.111 : AS8075 Microsoft Corporation : Sweden
4.184.121.217 : AS8075 Microsoft Corporation : Frankfurt am Main
4.184.60.71 : AS8075 Microsoft Corporation : Frankfurt am Main
4.225.203.146 : AS8075 Microsoft Corporation : Sweden
51.120.70.186 : AS8075 Microsoft Corporation : Oslo
51.120.83.160 : AS8075 Microsoft Corporation : Oslo
52.139.36.144 : AS8075 Microsoft Corporation : Toronto
52.165.196.84 : AS8075 Microsoft Corporation : Des Moines
68.221.69.72 : AS8075 Microsoft Corporation : Madrid

Share on: