Threat LevelHIGH64/1001 rule type

17 incidents · active attack detected · 17 attacks/day · last seen 23d ago

PTR	N/A
Org / ASN	Microsoft Azure Cloud (southeastasia)
Country	🇸🇬 Singapore
City	Singapore, Central Singapore
Timezone	Asia/Singapore

Attack Analysis

🇸🇬 Singapore · Singapore · 8075 · Microsoft Corporation

Webshell Upload Scan

This IP rapidly probed multiple non-existent PHP paths in under 60 seconds — a hallmark of automated webshell scanning tools hunting for previously uploaded backdoors or vulnerable file-upload endpoints. If successful, a webshell grants the attacker full remote code execution on the server.

Reports (17)

Date	Severity	Description
9 Jul 2026 - 01:05	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
9 Jul 2026 - 00:53	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
9 Jul 2026 - 00:52	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
9 Jul 2026 - 00:51	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
9 Jul 2026 - 00:50	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 21:11	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 21:04	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 21:03	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 20:46	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 20:45	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 20:44	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 20:43	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 18:33	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 18:32	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 13:34	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 13:33	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
8 Jul 2026 - 13:32	high	Web: Webshell scan — 3+ unknown PHP probes in 60s

Report for IP: 4.194.13.22

Attack Analysis

Reports (17)