Investigation Workspace

Entity: 20.63.96.50 (Ip)

Entity Details
Type
Ip
ASN
AS8075 - Microsoft Corporation
Threat Intelligence
100% of requests are detected threats, accessing known webshell/backdoor paths ('wp-admin/maint/bal.php', 'info.php', 'wp-content/cc13.php', etc.), and already hit an IPBLOCK security rule. This indicates highly malicious activity.
Linked Entities
Hostnames Targeted
Hostname Request Count
akamai.darcherif.fr 128
Paths Targeted (with Request Counts)
Path Request Count
an7.php 2
vogme.php 1
makeasmtp.php 1
cwclass.php 1
wp-file.php 1
pass4.php 1
inege.php 1
public/vx.php 1
btx25.php 1
zwq13.php 1
grsiuk.php 1
ticket.php 1
x123x.php 1
Jcrop.php 1
wp-admin/js/wp-conflg.php 1
fetch.php 1
simple.php 1
bgymj.php 1
yoawv.php 1
txets.php 1
wp_wlx.php 1
uxijj.php 1
global.php 1
1index.php 1
wp-the.php 1
ahgag.php 1
gettest.php 1
advanc.php 1
backup.php 1
moshou.php 1
yclby.php 1
ppxhp.php 1
100.kb.php 1
wp-setting.php 1
wp-content/plugins/hellopress/wp_filemanager.php 1
wp-admin/network/user-new.php 1
wp-content/bnm.php 1
wp-admin/maint/admin.php 1
wp-admin/ms-edit.php 1
wp-admin/index.php 1
wp-admin/maint/bal.php 1
wp-content/cc13.php 1
wp-admin/themes.php 1
wp-includes/admin.php 1
wp-content/fot.php 1
autoload_classmap.php 1
torsa1.php 1
tkllu.php 1
xogve.php 1
ftyude.php 1
🚫

Block

100% of requests are detected threats, accessing known webshell/backdoor paths ('wp-admin/maint/bal.php', 'info.php', 'wp-content/cc13.php', etc.), and already hit an IPBLOCK security rule. This indicates highly malicious activity.

2026-03-03 11:33:37