PHP Version Reconnaissance (phpinfo Page Hunt) for 2026-07-18

Jul 18, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for leftover phpinfo() pages (info.php, pi.php, php-info.php, phpversion.php and similar). A phpinfo page reveals the exact PHP version, loaded extensions and settings, which tells an attacker whether exploits such as PHP2Shell or PHP-CGI argument injection will work.

MITRE ATT&CK

Tactic: Reconnaissance (TA0043)
Technique: T1592.002 — Gather Victim Host Information: Software

Observed URIs

Attackers by Country

Canada	6	26.1%
United States	3	13.0%
Brazil	3	13.0%
France	2	8.7%
Australia	2	8.7%
The Netherlands	2	8.7%
India	1	4.3%
Singapore	1	4.3%
New Zealand	1	4.3%
United Kingdom	1	4.3%
Russia	1	4.3%

IP Address : ASN : City/Provider

104.28.211.186 : AS13335 Cloudflare, Inc. : Paris
143.110.217.244 : AS14061 DigitalOcean, LLC : Toronto
143.244.168.161 : AS14061 DigitalOcean, LLC : North Bergen
147.182.149.75 : AS14061 DigitalOcean, LLC : Toronto
159.65.144.72 : AS14061 DigitalOcean, LLC : Bengaluru
167.71.81.114 : AS14061 DigitalOcean, LLC : Clifton
185.177.72.81 : AS211590 Bucklog SARL : France
20.104.96.117 : AS8075 Microsoft Corporation : Toronto
20.151.225.23 : AS8075 Microsoft Corporation : Toronto
20.197.192.193 : AS8075 Microsoft Corporation : Campinas
20.206.107.78 : AS8075 Microsoft Corporation : Campinas
20.220.225.223 : AS8075 Microsoft Corporation : Toronto
20.226.26.5 : AS8075 Microsoft Corporation : Campinas
20.63.63.128 : AS8075 Microsoft Corporation : Toronto
34.129.109.212 : AS396982 Google LLC : Melbourne
34.13.145.151 : AS396982 Google LLC : Groningen
4.194.24.143 : AS8075 Microsoft Corporation : Singapore
45.133.7.43 : AS137409 GSL Networks Pty LTD : Auckland
45.134.20.159 : AS396356 Latitude.sh : Sydney
45.148.10.244 : AS48090 Techoff Srv Limited : Amsterdam
64.227.32.66 : AS14061 DigitalOcean, LLC : Slough
74.249.245.134 : AS8075 Microsoft Corporation : Des Moines
80.87.206.6 : AS16276 OVH SAS : Russia

Share on: