Threat LevelHIGH65/1001 rule type

17 incidents · active attack detected · active over 6 days · last seen 24d ago

PTR	N/A
Org / ASN	Microsoft Azure Cloud (brazilsouth)
Country	🇧🇷 Brazil
City	São Paulo, Sao Paulo
Timezone	America/Sao_Paulo

Attack Analysis

🇧🇷 Brazil · Rio de Janeiro · 8075 · Microsoft Corporation

Webshell Upload Scan

This IP rapidly probed multiple non-existent PHP paths in under 60 seconds — a hallmark of automated webshell scanning tools hunting for previously uploaded backdoors or vulnerable file-upload endpoints. If successful, a webshell grants the attacker full remote code execution on the server.

Reports (17)

Date	Severity	Description
8 Jul 2026 - 11:29	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 11:28	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 11:06	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 11:03	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 10:36	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 10:35	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 08:54	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 07:39	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 07:38	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 03:37	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
7 Jul 2026 - 18:44	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
7 Jul 2026 - 18:42	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
7 Jul 2026 - 15:08	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
7 Jul 2026 - 15:07	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
7 Jul 2026 - 15:06	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
2 Jul 2026 - 13:50	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
2 Jul 2026 - 13:49	high	Web: Webshell scan — 3+ unknown PHP probes in 60s

Report for IP: 20.195.177.9

Attack Analysis

Reports (17)