PHP Version Reconnaissance (phpinfo Page Hunt) for 2026-10-22

Oct 22, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for leftover phpinfo() pages (info.php, pi.php, php-info.php, phpversion.php and similar). A phpinfo page reveals the exact PHP version, loaded extensions and settings, which tells an attacker whether exploits such as PHP2Shell or PHP-CGI argument injection will work.

MITRE ATT&CK

Tactic: Reconnaissance (TA0043)
Technique: T1592.002 — Gather Victim Host Information: Software

Observed URIs

Attackers by Country

Ireland: 178United States: 110Singapore: 42Germany: 35Japan: 32The Netherlands: 29France: 24Canada: 22Seychelles: 18United Kingdom: 14India: 14United Arab Emirates: 8Russia: 6Mexico: 5Türkiye: 5Australia: 4Lithuania: 4Bulgaria: 4Hong Kong: 3Italy: 3Norway: 3Switzerland: 3Belgium: 3Sweden: 2Poland: 2Ukraine: 2South Korea: 2Taiwan: 2Bangladesh: 1Morocco: 1Thailand: 1Macao: 1Iran: 1Portugal: 1Spain: 1Algeria: 1Brazil: 1South Africa: 1Indonesia: 1Peru: 1Romania: 1Georgia: 1
Ireland17830.0%
United States11018.5%
Singapore427.1%
Germany355.9%
Japan325.4%
The Netherlands294.9%
France244.0%
Canada223.7%
Seychelles183.0%
United Kingdom142.4%
India142.4%
United Arab Emirates81.3%
Russia61.0%
Mexico50.8%
Türkiye50.8%
Australia40.7%
Lithuania40.7%
Bulgaria40.7%
Hong Kong30.5%
Italy30.5%
Norway30.5%
Switzerland30.5%
Belgium30.5%
Sweden20.3%
Poland20.3%
Ukraine20.3%
South Korea20.3%
Taiwan20.3%
Bangladesh10.2%
Morocco10.2%
Thailand10.2%
Macao10.2%
Iran10.2%
Portugal10.2%
Spain10.2%
Algeria10.2%
Brazil10.2%
South Africa10.2%
Indonesia10.2%
Peru10.2%
Romania10.2%
Georgia10.2%

IP Address : ASN : City/Provider

Share on: