Known Webshell Filename Probe for 2026-09-21
Sep 21, 2026
Exploitation
Last Updated: 00:00 UTC
Direct requests for filenames used by common PHP webshells and file managers (ALFA, WSO, b374k, xleet, wp_filemanager and others). Scanners check whether a site was already backdoored by someone else, so they can take over the existing shell instead of exploiting the site themselves.
MITRE ATT&CK
Tactic: Persistence (TA0003)
Technique: T1505.003 — Server Software Component: Web Shell
Observed URIs
Attackers by Country
| Indonesia | 1 | 20.0% |
| Poland | 1 | 20.0% |
| United States | 1 | 20.0% |
| Iran | 1 | 20.0% |
| Moldova | 1 | 20.0% |
IP Address : ASN : City/Provider
-
157.20.32.171 : AS152390 PT Intercloud Digital Inovasi : Indonesia
-
193.34.212.54 : AS201814 MEVSPACE sp. z o.o. : Poland
-
34.150.180.238 : AS396982 Google LLC : Washington
-
62.60.130.232 : AS215930 Cipher Operations Doo Beograd - Novi Beograd : Tehran
-
91.208.197.163 : AS200019 Alexhost Srl : Chisinau