PHP Version Reconnaissance (phpinfo Page Hunt) for 2026-10-21

Oct 21, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for leftover phpinfo() pages (info.php, pi.php, php-info.php, phpversion.php and similar). A phpinfo page reveals the exact PHP version, loaded extensions and settings, which tells an attacker whether exploits such as PHP2Shell or PHP-CGI argument injection will work.

MITRE ATT&CK

Tactic: Reconnaissance (TA0043)
Technique: T1592.002 — Gather Victim Host Information: Software

Observed URIs

Attackers by Country

Ireland: 207United States: 40Singapore: 38Germany: 20Sweden: 16France: 15Canada: 11The Netherlands: 10Australia: 8South Korea: 7United Kingdom: 6Switzerland: 6Bulgaria: 5India: 4Iran: 4Russia: 3South Africa: 3Norway: 3Brazil: 3Morocco: 2Spain: 2Italy: 2Hong Kong: 2Czechia: 2Philippines: 1Bangladesh: 1Thailand: 1Qatar: 1Finland: 1Belize: 1Seychelles: 1Luxembourg: 1Israel: 1Indonesia: 1Tunisia: 1Taiwan: 1Lithuania: 1Romania: 1Slovakia: 1
Ireland20747.7%
United States409.2%
Singapore388.8%
Germany204.6%
Sweden163.7%
France153.5%
Canada112.5%
The Netherlands102.3%
Australia81.8%
South Korea71.6%
United Kingdom61.4%
Switzerland61.4%
Bulgaria51.2%
India40.9%
Iran40.9%
Russia30.7%
South Africa30.7%
Norway30.7%
Brazil30.7%
Morocco20.5%
Spain20.5%
Italy20.5%
Hong Kong20.5%
Czechia20.5%
Philippines10.2%
Bangladesh10.2%
Thailand10.2%
Qatar10.2%
Finland10.2%
Belize10.2%
Seychelles10.2%
Luxembourg10.2%
Israel10.2%
Indonesia10.2%
Tunisia10.2%
Taiwan10.2%
Lithuania10.2%
Romania10.2%
Slovakia10.2%

IP Address : ASN : City/Provider

Share on: