Known Webshell Filename Probe for 2026-09-27

Sep 27, 2026 Exploitation

Last Updated: 00:00 UTC

Direct requests for filenames used by common PHP webshells and file managers (ALFA, WSO, b374k, xleet, wp_filemanager and others). Scanners check whether a site was already backdoored by someone else, so they can take over the existing shell instead of exploiting the site themselves.

MITRE ATT&CK

Tactic: Persistence (TA0003)
Technique: T1505.003 — Server Software Component: Web Shell

Observed URIs

Attackers by Country

India	9	36.0%
South Korea	6	24.0%
United States	3	12.0%
Australia	3	12.0%
Hong Kong	2	8.0%
Germany	1	4.0%
Italy	1	4.0%

IP Address : ASN : City/Provider

104.211.74.130 : AS8075 Microsoft Corporation : Pune
13.70.4.78 : AS8075 Microsoft Corporation : Hong Kong
192.253.209.78 : AS137409 GSL Networks Pty LTD : Jersey City
192.253.209.95 : AS137409 GSL Networks Pty LTD : Jersey City
20.194.5.96 : AS8075 Microsoft Corporation : Seoul
20.194.97.74 : AS8075 Microsoft Corporation : Seoul
20.204.110.107 : AS8075 Microsoft Corporation : Pune
20.204.42.136 : AS8075 Microsoft Corporation : Pune
20.205.12.169 : AS8075 Microsoft Corporation : Hong Kong
20.213.164.196 : AS8075 Microsoft Corporation : Sydney
20.214.145.90 : AS8075 Microsoft Corporation : Seoul
20.214.151.17 : AS8075 Microsoft Corporation : Seoul
20.214.191.94 : AS8075 Microsoft Corporation : Seoul
20.219.11.16 : AS8075 Microsoft Corporation : Pune
20.219.19.141 : AS8075 Microsoft Corporation : Pune
20.219.2.60 : AS8075 Microsoft Corporation : Pune
20.58.177.98 : AS8075 Microsoft Corporation : Sydney
34.48.216.95 : AS396982 Google LLC : Washington
4.185.40.215 : AS8075 Microsoft Corporation : Frankfurt am Main
4.196.65.241 : AS8075 Microsoft Corporation : Sydney
4.232.144.219 : AS8075 Microsoft Corporation : Milan
52.141.4.134 : AS8075 Microsoft Corporation : Seoul
52.172.226.14 : AS8075 Microsoft Corporation : Pune
52.172.235.175 : AS8075 Microsoft Corporation : Pune
74.225.148.80 : AS8075 Microsoft Corporation : Pune

Share on: