Known Webshell Filename Probe for 2026-10-22

Oct 22, 2026 Exploitation

Last Updated: 00:00 UTC

Direct requests for filenames used by common PHP webshells and file managers (ALFA, WSO, b374k, xleet, wp_filemanager and others). Scanners check whether a site was already backdoored by someone else, so they can take over the existing shell instead of exploiting the site themselves.

MITRE ATT&CK

Tactic: Persistence (TA0003)
Technique: T1505.003 — Server Software Component: Web Shell

Observed URIs

Attackers by Country

Ireland: 266United States: 150Singapore: 41Japan: 37Germany: 13France: 12India: 12United Kingdom: 11Canada: 9Bulgaria: 9The Netherlands: 8Italy: 8Australia: 7Sweden: 7Mexico: 7Poland: 6Hong Kong: 5South Korea: 5Norway: 5Iraq: 5Tunisia: 4Indonesia: 4Brazil: 4Morocco: 4Spain: 4Portugal: 4Switzerland: 4Seychelles: 3Macao: 2United Arab Emirates: 2Taiwan: 2Egypt: 1Bangladesh: 1Vietnam: 1South Africa: 1Monaco: 1Romania: 1Türkiye: 1Austria: 1Ukraine: 1Algeria: 1Peru: 1Russia: 1Saudi Arabia: 1Andorra: 1
Ireland26639.5%
United States15022.3%
Singapore416.1%
Japan375.5%
Germany131.9%
France121.8%
India121.8%
United Kingdom111.6%
Canada91.3%
Bulgaria91.3%
The Netherlands81.2%
Italy81.2%
Australia71.0%
Sweden71.0%
Mexico71.0%
Poland60.9%
Hong Kong50.7%
South Korea50.7%
Norway50.7%
Iraq50.7%
Tunisia40.6%
Indonesia40.6%
Brazil40.6%
Morocco40.6%
Spain40.6%
Portugal40.6%
Switzerland40.6%
Seychelles30.4%
Macao20.3%
United Arab Emirates20.3%
Taiwan20.3%
Egypt10.1%
Bangladesh10.1%
Vietnam10.1%
South Africa10.1%
Monaco10.1%
Romania10.1%
Türkiye10.1%
Austria10.1%
Ukraine10.1%
Algeria10.1%
Peru10.1%
Russia10.1%
Saudi Arabia10.1%
Andorra10.1%

IP Address : ASN : City/Provider

Share on: