Known Webshell Filename Probe for 2026-10-21

Oct 21, 2026 Exploitation

Last Updated: 00:00 UTC

Direct requests for filenames used by common PHP webshells and file managers (ALFA, WSO, b374k, xleet, wp_filemanager and others). Scanners check whether a site was already backdoored by someone else, so they can take over the existing shell instead of exploiting the site themselves.

MITRE ATT&CK

Tactic: Persistence (TA0003)
Technique: T1505.003 — Server Software Component: Web Shell

Observed URIs

Attackers by Country

Ireland: 294United States: 84Singapore: 72Germany: 31Sweden: 30Australia: 21South Korea: 19France: 16Japan: 12Poland: 11Canada: 9Norway: 8Switzerland: 7United Kingdom: 7Brazil: 7India: 6The Netherlands: 4Spain: 4South Africa: 3Indonesia: 3Italy: 3Thailand: 2Qatar: 2Jordan: 2Seychelles: 2Hong Kong: 2Tunisia: 2Israel: 2Taiwan: 2Bulgaria: 2Cambodia: 1Belarus: 1Finland: 1Luxembourg: 1Benin: 1Philippines: 1Czechia: 1Panama: 1
Ireland29443.4%
United States8412.4%
Singapore7210.6%
Germany314.6%
Sweden304.4%
Australia213.1%
South Korea192.8%
France162.4%
Japan121.8%
Poland111.6%
Canada91.3%
Norway81.2%
Switzerland71.0%
United Kingdom71.0%
Brazil71.0%
India60.9%
The Netherlands40.6%
Spain40.6%
South Africa30.4%
Indonesia30.4%
Italy30.4%
Thailand20.3%
Qatar20.3%
Jordan20.3%
Seychelles20.3%
Hong Kong20.3%
Tunisia20.3%
Israel20.3%
Taiwan20.3%
Bulgaria20.3%
Cambodia10.1%
Belarus10.1%
Finland10.1%
Luxembourg10.1%
Benin10.1%
Philippines10.1%
Czechia10.1%
Panama10.1%

IP Address : ASN : City/Provider

Share on: