Investigation Workspace

Entity: 40.80.89.74 (Ip)

Entity Details
Type
Ip
ASN
AS8075 - Microsoft Corporation
Threat Intelligence
Accessed highly suspicious and non-standard PHP files (e.g., 'alfa-rex1.php', 'spip.php', 'root.php', 'wp-admin.php') indicative of reconnaissance or exploitation attempts. This pattern suggests malicious probing.
Linked Entities
TLS Fingerprints (1)
Hostnames Targeted
Hostname Request Count
www.darcherif.fr 140
Paths Targeted (with Request Counts)
Path Request Count
alfa-rex.php 3
alfa.php 3
.tmb/dropdown.php 2
admin/controller/extension/extension/ultra.php 2
admin.php 2
.well-known/ 2
admin/index.php 2
atomlib.php 2
alfanew.php 2
about.php 2
autoload_classmap.php 2
as/function/wp-admin/ 2
adminfuns.php 2
.well-known/admin.php 2
admin/uploads/ 2
.well-known/index.php 2
admin/function.php 2
aspera/faspex/wp-admin/ 2
anonse/lock360.php 2
accueil 2
admin/upload/ 2
as.php 2
aaa.php 2
404.php 2
auth.php 2
1.php 2
.well-known/about/function.php 2
.well-known/acme-challenge/autoload_classmap.php 2
.well-known/autoload_classmap.php 2
ab.php 2
admin/controller/extension/ 2
.well-known/acme-challenge/admin.php 2
aa.php 2
autoload_classmap/function.php 2
abcd.php 2
akc.php 2
.well-known/gecko-litespeed.php 2
.well-known/acme-challenge/index.php 2
about/function.php 2
2021/01/16/upload-and-download-file-using-multipart-form-over-http/ 2
al.php 2
.well-known/pki-validation/mariju.php 2
updates.php 1
xleet.php 1
goods.php 1
class_api.php 1
install.php 1
locale.php 1
configs.php 1
block-bindings.php 1
🚫

Block

Accessed highly suspicious and non-standard PHP files (e.g., 'alfa-rex1.php', 'spip.php', 'root.php', 'wp-admin.php') indicative of reconnaissance or exploitation attempts. This pattern suggests malicious probing.

2026-02-25 13:30:55