PHP Version Reconnaissance (phpinfo Page Hunt) for 2026-10-04

Oct 04, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for leftover phpinfo() pages (info.php, pi.php, php-info.php, phpversion.php and similar). A phpinfo page reveals the exact PHP version, loaded extensions and settings, which tells an attacker whether exploits such as PHP2Shell or PHP-CGI argument injection will work.

MITRE ATT&CK

Tactic: Reconnaissance (TA0043)
Technique: T1592.002 — Gather Victim Host Information: Software

Observed URIs

Attackers by Country

United States	4	17.4%
Hong Kong	3	13.0%
France	3	13.0%
South Korea	2	8.7%
Taiwan	2	8.7%
The Netherlands	2	8.7%
Japan	1	4.3%
India	1	4.3%
Australia	1	4.3%
Germany	1	4.3%
South Africa	1	4.3%
Belgium	1	4.3%
Singapore	1	4.3%

IP Address : ASN : City/Provider

13.70.26.121 : AS8075 Microsoft Corporation : Hong Kong
159.223.132.86 : AS14061 DigitalOcean, LLC : North Bergen
185.177.72.31 : AS211590 Bucklog SARL : France
185.177.72.56 : AS211590 Bucklog SARL : France
188.165.63.131 : AS16276 OVH SAS : France
20.194.96.114 : AS8075 Microsoft Corporation : Seoul
20.210.128.125 : AS8075 Microsoft Corporation : Osaka
20.214.109.68 : AS8075 Microsoft Corporation : Seoul
20.219.185.206 : AS8075 Microsoft Corporation : Pune
20.24.197.108 : AS8075 Microsoft Corporation : Hong Kong
20.92.77.159 : AS8075 Microsoft Corporation : Sydney
206.81.12.187 : AS14061 DigitalOcean, LLC : North Bergen
213.209.159.133 : AS208137 Feo Prest SRL : Taiwan
23.98.40.27 : AS8075 Microsoft Corporation : Hong Kong
34.179.164.52 : AS396982 Google LLC : Frankfurt am Main
34.23.147.147 : AS396982 Google LLC : North Charleston
34.35.125.187 : AS396982 Google LLC : Johannesburg
34.6.78.29 : AS396982 Google LLC : Groningen
34.79.12.228 : AS396982 Google LLC : Brussels
34.80.182.236 : AS396982 Google LLC : Taipei
45.153.34.43 : AS197170 TechTies Inc. : Amsterdam
8.234.230.122 : AS396982 Google LLC : Washington
85.203.23.102 : AS137409 GSL Networks Pty LTD : Bukit Merah Estate

Share on: