Known Webshell Filename Probe for 2026-09-20
Sep 20, 2026
Exploitation
Last Updated: 00:00 UTC
Direct requests for filenames used by common PHP webshells and file managers (ALFA, WSO, b374k, xleet, wp_filemanager and others). Scanners check whether a site was already backdoored by someone else, so they can take over the existing shell instead of exploiting the site themselves.
MITRE ATT&CK
Tactic: Persistence (TA0003)
Technique: T1505.003 — Server Software Component: Web Shell
Observed URIs
Attackers by Country
| United States | 2 | 33.3% |
| Poland | 1 | 16.7% |
| The Netherlands | 1 | 16.7% |
| Pakistan | 1 | 16.7% |
| Iran | 1 | 16.7% |
IP Address : ASN : City/Provider
-
178.211.139.240 : AS201814 MEVSPACE sp. z o.o. : Poland
-
216.24.219.150 : AS206092 F.n.s. Holdings Limited : Miami
-
217.60.76.173 : AS213636 Iryna Ivanenko : The Netherlands
-
35.194.52.180 : AS396982 Google LLC : Council Bluffs
-
36.255.97.23 : AS205759 Ghosty Networks LLC : Pakistan
-
62.60.130.232 : AS215930 Cipher Operations Doo Beograd - Novi Beograd : Tehran