PHP Version Reconnaissance (phpinfo Page Hunt) for 2026-08-26

Aug 26, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for leftover phpinfo() pages (info.php, pi.php, php-info.php, phpversion.php and similar). A phpinfo page reveals the exact PHP version, loaded extensions and settings, which tells an attacker whether exploits such as PHP2Shell or PHP-CGI argument injection will work.

MITRE ATT&CK

Tactic: Reconnaissance (TA0043)
Technique: T1592.002 — Gather Victim Host Information: Software

Observed URIs

Attackers by Country

Canada	9	39.1%
United States	4	17.4%
Mexico	2	8.7%
Brazil	2	8.7%
Mongolia	1	4.3%
Italy	1	4.3%
The Netherlands	1	4.3%
Norway	1	4.3%
Romania	1	4.3%
Singapore	1	4.3%

IP Address : ASN : City/Provider

147.90.172.243 : AS137409 GSL Networks Pty LTD : Ulan Bator
158.23.147.79 : AS8075 Microsoft Corporation : Querétaro
168.62.48.100 : AS8075 Microsoft Corporation : Dulles
172.191.149.99 : AS8075 Microsoft Corporation : Dulles
172.213.25.50 : AS8075 Microsoft Corporation : Milan
176.65.132.57 : AS197170 TechTies Inc. : Amsterdam
20.100.175.163 : AS8075 Microsoft Corporation : Oslo
20.122.142.214 : AS8075 Microsoft Corporation : Boydton
20.151.9.151 : AS8075 Microsoft Corporation : Toronto
20.220.206.182 : AS8075 Microsoft Corporation : Toronto
20.220.227.7 : AS8075 Microsoft Corporation : Toronto
20.226.36.136 : AS8075 Microsoft Corporation : Campinas
20.226.91.14 : AS8075 Microsoft Corporation : Campinas
20.48.147.90 : AS8075 Microsoft Corporation : Toronto
20.48.251.3 : AS8075 Microsoft Corporation : Toronto
20.63.64.130 : AS8075 Microsoft Corporation : Toronto
34.186.83.156 : AS396982 Google LLC : Washington
4.205.62.107 : AS8075 Microsoft Corporation : Toronto
52.139.37.240 : AS8075 Microsoft Corporation : Toronto
52.139.44.162 : AS8075 Microsoft Corporation : Toronto
68.155.159.216 : AS8075 Microsoft Corporation : Querétaro
80.94.95.211 : AS204428 SS-Net : Romania
85.203.21.143 : AS206092 F.n.s. Holdings Limited : Singapore

Share on: