Forty-one days of passive edge telemetry against the Dispensight and SecureLeaf perimeter. This advisory publishes only the sources whose own requests convict them — and documents, in detail, everything that was thrown away.
The last rung is the point of this edition. 1,070 IP addresses carried
the collector's own recon_path / bot threat tags and were still not
published — because that heuristic also fires on /robots.txt fetches from
genuine OpenAI, Apple and academic research crawlers. A tag is a hypothesis. It is not evidence.
Across all 14,133 requests from the 166 confirmed sources: zero successful responses on any
credential, configuration or PHP path. Zero successful authentications. One POST, thirty-three
HEADs, no writes. The three 200s returned to the exploit payload were the index page
rendering normally in 5 ms with the parameter ignored — no code executed.
Three behavioural clusters, separated by what the sources actually requested rather than by who they might be. No cluster is attributed to a named actor.
Hunting for pre-planted PHP backdoors — the WSO family (wso112233a.php,
.wp/wso.php), w3lls.php, xenon1337.php, and hundreds of
randomised variants. The tell is the partitioning: across 105 Azure sources, the union spans
1,379 distinct paths and not one path is shared by even half the set. That is divided
work from a common list, not independent scanners colliding. The conviction is arithmetic —
this perimeter serves no PHP at all: 8,814 PHP requests, zero non-404 responses, ever.
Systematic probing for exposed secrets: .env and its two dozen variants,
.git/config, .aws/credentials, GCP service-account keys, Spring Boot
/actuator/env, appsettings.json, database dumps. Thirteen sources
declared themselves Googlebot, Google-CloudVertexBot, Applebot, Amazonbot, OAI-SearchBot,
bingbot, CCBot or cohere-ai — from ASNs those operators do not own. Real crawlers do not ask
for /.aws/credentials.
Base64url payloads on Next.js data routes (/_next/data/<buildId>/page.json,
/api/[[...slug]]) decoding to
require('child_process').execSync(cmd) with the result btoa()-wrapped
for exfiltration. Worth stating plainly: the command is echo VULN_TEST — a benign
canary. This is automated vulnerability discovery, not hands-on intrusion. It is still
unsolicited and it still failed.
Operator's own prefix (209.121.229.0/24), TELUS and Shaw, and all Cloudflare,
Akamai and Fastly egress matched by CIDR rather than ISP name, plus iCloud Private Relay.
CDN edges terminate real users; blocklisting them punishes the visitor, not the attacker.
Sources the collector flagged that no evidence convicts. Named examples now permanently excluded:
138.246.253.24 (Leibniz-Rechenzentrum — 33 requests, all /robots.txt,
all 200, an academic measurement crawler) and the 104.210.140.0/24 and
74.7.228.0/24 Microsoft ranges, which are the genuine OpenAI SearchBot fetching
/robots.txt exactly as it should.
Cloud and VPS-sourced indicators are tagged ephemeral-cloud and expire
30 days after last sighting; dedicated hosting gets 90. Azure recycles addresses, and a
stale indicator becomes someone else's false positive. Consumers should honour
valid_until.
All 166. Every row is reproducible from the source telemetry — the evidence column states what the source asked for, which is the whole case against it.
| Source | Reqs | Days | 404s | Country | ISP | Evidence |
|---|---|---|---|---|---|---|
| 20.226.26.5 | 458 | 3 | 363 | Brazil | Microsoft Corporation | webshell paths ×129ephemeral |
| 20.104.203.253 | 344 | 2 | 50 | Canada | Microsoft Corporation | webshell paths ×45ephemeral |
| 20.219.164.250 | 310 | 2 | 310 | India | Microsoft Corporation | webshell paths ×106ephemeral |
| 20.206.105.139 | 300 | 4 | 250 | Brazil | Microsoft Corporation | webshell paths ×130ephemeral |
| 20.151.112.244 | 299 | 2 | 299 | Canada | Microsoft Corporation | webshell paths ×97ephemeral |
| 20.206.64.115 | 267 | 2 | 52 | Brazil | Microsoft Corporation | webshell paths ×51ephemeral |
| 20.151.225.63 | 263 | 3 | 132 | Canada | Microsoft Corporation | webshell paths ×94ephemeral |
| 20.104.244.165 | 259 | 2 | 258 | Canada | Microsoft Corporation | webshell paths ×151ephemeral |
| 20.226.85.77 | 255 | 2 | 205 | Brazil | Microsoft Corporation | webshell paths ×98ephemeral |
| 20.215.210.222 | 243 | 3 | 243 | Poland | Microsoft Corporation | webshell paths ×108ephemeral |
| 52.175.121.47 | 243 | 2 | 100 | Hong Kong | Microsoft Corporation | webshell paths ×97ephemeral |
| 52.138.1.81 | 242 | 5 | 97 | Canada | Microsoft Corporation | webshell paths ×93ephemeral |
| 20.12.202.181 | 224 | 1 | 100 | United States | Microsoft Corporation | webshell paths ×50ephemeral |
| 172.161.73.175 | 222 | 2 | 222 | Switzerland | Microsoft | webshell paths ×141ephemeral |
| 93.123.109.102 | 221 | 3 | 204 | Andorra | Techoff SRV Limited | webshell paths ×15 secret paths ×68 RCE payload |
| 20.48.255.163 | 204 | 4 | 18 | Canada | Microsoft Corporation | webshell paths ×18ephemeral |
| 20.226.2.115 | 204 | 2 | 56 | Brazil | Microsoft Corporation | webshell paths ×53ephemeral |
| 4.232.80.255 | 182 | 3 | 50 | Italy | Microsoft Corporation | webshell paths ×50ephemeral |
| 20.220.9.199 | 176 | 1 | 176 | Canada | Microsoft Corporation | webshell paths ×62ephemeral |
| 20.251.117.149 | 169 | 3 | 169 | Norway | Microsoft Corporation | webshell paths ×84ephemeral |
| 20.104.50.116 | 156 | 4 | 18 | Canada | Microsoft Corporation | webshell paths ×18ephemeral |
| 20.200.218.6 | 149 | 1 | 149 | South Korea | Microsoft Corporation | webshell paths ×100ephemeral |
| 74.248.17.67 | 144 | 2 | 144 | Poland | Microsoft Corporation | webshell paths ×48ephemeral |
| 4.201.96.144 | 140 | 2 | 140 | Brazil | Microsoft Corporation | webshell paths ×90ephemeral |
| 135.119.27.130 | 137 | 2 | 137 | United States | Microsoft Corporation | webshell paths ×84ephemeral |
| 20.24.211.57 | 134 | 1 | 134 | Hong Kong | Microsoft Corporation | webshell paths ×75ephemeral |
| 191.237.255.150 | 130 | 2 | 49 | Brazil | Microsoft Corporation | webshell paths ×49ephemeral |
| 91.239.78.39 | 128 | 5 | 92 | Ukraine | Virtual Systems LLC | secret paths ×30 |
| 195.178.110.31 | 127 | 2 | 125 | Andorra | Techoff SRV Limited | secret paths ×45 |
| 93.123.109.101 | 118 | 3 | 106 | Andorra | Techoff SRV Limited | secret paths ×45 RCE payload |
| 20.48.236.161 | 116 | 2 | 50 | Canada | Microsoft Corporation | webshell paths ×42ephemeral |
| 20.203.151.222 | 111 | 1 | 110 | Switzerland | Microsoft Corporation | webshell paths ×60ephemeral |
| 191.233.234.186 | 111 | 1 | 111 | Brazil | Microsoft Corporation | webshell paths ×37ephemeral |
| 104.43.131.157 | 109 | 2 | 38 | United States | Microsoft Corporation | webshell paths ×38ephemeral |
| 34.181.231.109 | 100 | 1 | 0 | United States | Google LLC | webshell paths ×11 secret paths ×35ephemeral |
| 13.201.68.87 | 100 | 1 | 100 | India | Amazon.com, Inc. | webshell paths ×39 secret paths ×83ephemeral |
| 20.220.225.45 | 100 | 1 | 100 | Canada | Microsoft Corporation | webshell paths ×92ephemeral |
| 20.220.166.196 | 100 | 1 | 100 | Canada | Microsoft Corporation | webshell paths ×96ephemeral |
| 20.240.51.74 | 100 | 2 | 100 | Sweden | Microsoft Corporation | webshell paths ×53ephemeral |
| 20.210.131.207 | 100 | 1 | 100 | Japan | Microsoft Corporation | webshell paths ×87ephemeral |
| 20.214.184.176 | 100 | 1 | 100 | South Korea | Microsoft Corporation | webshell paths ×84ephemeral |
| 20.226.45.125 | 100 | 1 | 100 | Brazil | Microsoft Corporation | webshell paths ×84ephemeral |
| 34.159.25.14 | 100 | 1 | 0 | Germany | Google LLC | secret paths ×34ephemeral |
| 13.70.33.224 | 98 | 1 | 98 | Hong Kong | Microsoft Corporation | webshell paths ×86ephemeral |
| 35.196.191.10 | 98 | 1 | 6 | United States | Google LLC | webshell paths ×10 secret paths ×33ephemeral |
| 159.13.55.39 | 97 | 1 | 97 | Australia | Oracle Corporation | secret paths ×44ephemeral |
| 158.158.76.105 | 96 | 1 | 96 | Spain | Microsoft Corporation | webshell paths ×84ephemeral |
| 20.226.60.146 | 95 | 1 | 95 | Brazil | Microsoft Corporation | webshell paths ×95ephemeral |
| 20.89.224.248 | 95 | 1 | 95 | Japan | Microsoft Corporation | webshell paths ×78ephemeral |
| 20.226.8.231 | 91 | 1 | 91 | Brazil | Microsoft Corporation | webshell paths ×90ephemeral |
| 20.195.177.9 | 88 | 2 | 36 | Brazil | Microsoft Corporation | webshell paths ×18ephemeral |
| 20.205.46.33 | 85 | 1 | 85 | Hong Kong | Microsoft Corporation | webshell paths ×84ephemeral |
| 20.100.171.63 | 81 | 1 | 79 | Norway | Microsoft Corporation | webshell paths ×78ephemeral |
| 158.158.43.25 | 81 | 3 | 53 | Spain | Microsoft Corporation | webshell paths ×51ephemeral |
| 20.212.33.130 | 77 | 1 | 76 | Singapore | Microsoft Corporation | webshell paths ×63ephemeral |
| 20.151.205.204 | 77 | 1 | 77 | Canada | Microsoft Corporation | webshell paths ×64ephemeral |
| 20.48.176.78 | 76 | 1 | 76 | Canada | Microsoft Corporation | webshell paths ×74ephemeral |
| 20.151.5.99 | 75 | 1 | 37 | Canada | Microsoft Corporation | webshell paths ×37ephemeral |
| 20.89.107.188 | 75 | 1 | 75 | Japan | Microsoft Corporation | webshell paths ×68ephemeral |
| 45.88.138.44 | 74 | 2 | 67 | The Netherlands | Ayosoft LTD | secret paths ×32 |
| 20.104.72.147 | 73 | 1 | 73 | Canada | Microsoft Corporation | webshell paths ×73ephemeral |
| 74.249.207.185 | 73 | 1 | 36 | United States | Microsoft Corporation | webshell paths ×36ephemeral |
| 91.92.42.86 | 72 | 2 | 72 | Sweden | IPv | webshell paths ×16 secret paths ×20 |
| 74.234.76.171 | 72 | 1 | 72 | Ireland | Microsoft Corporation | webshell paths ×70ephemeral |
| 4.193.191.49 | 72 | 1 | 72 | Singapore | Microsoft Corporation | webshell paths ×71ephemeral |
| 20.89.60.120 | 72 | 1 | 72 | Japan | Microsoft Corporation | webshell paths ×72ephemeral |
| 20.24.193.69 | 70 | 1 | 70 | Hong Kong | Microsoft Corporation | webshell paths ×68ephemeral |
| 20.197.232.12 | 70 | 2 | 70 | Brazil | Microsoft Corporation | webshell paths ×69ephemeral |
| 20.9.14.5 | 68 | 1 | 68 | United States | Microsoft Corporation | webshell paths ×58ephemeral |
| 172.212.179.199 | 67 | 1 | 67 | United States | Microsoft Corporation | webshell paths ×66ephemeral |
| 104.215.180.121 | 67 | 1 | 67 | Singapore | Microsoft Corporation | webshell paths ×60ephemeral |
| 20.89.237.101 | 64 | 1 | 64 | Japan | Microsoft Corporation | webshell paths ×56ephemeral |
| 208.84.101.224 | 63 | 1 | 61 | United States | Fro LLC | secret paths ×33 UA spoof |
| 45.45.237.206 | 62 | 2 | 52 | United States | Infraly, LLC | secret paths ×18 UA spoof |
| 63.176.149.38 | 61 | 1 | 61 | Germany | Amazon.com | webshell paths ×40 secret paths ×44ephemeral |
| 191.239.249.183 | 60 | 1 | 60 | Brazil | Microsoft Corporation | webshell paths ×58ephemeral |
| 4.232.93.183 | 60 | 1 | 60 | Italy | Microsoft Corporation | webshell paths ×59ephemeral |
| 45.45.237.8 | 59 | 1 | 26 | United States | Infraly, LLC | secret paths ×18 UA spoof |
| 185.213.175.92 | 57 | 2 | 50 | The Netherlands | NextGenWebs | secret paths ×17 UA spoof |
| 20.226.32.175 | 57 | 1 | 57 | Brazil | Microsoft Corporation | webshell paths ×56ephemeral |
| 20.220.62.152 | 55 | 1 | 55 | Canada | Microsoft Corporation | webshell paths ×51ephemeral |
| 40.83.92.182 | 55 | 1 | 55 | Hong Kong | Microsoft Corporation | webshell paths ×53ephemeral |
| 158.158.49.166 | 54 | 1 | 54 | Spain | Microsoft Corporation | webshell paths ×54ephemeral |
| 20.226.62.44 | 53 | 1 | 53 | Brazil | Microsoft Corporation | webshell paths ×52ephemeral |
| 20.43.20.191 | 52 | 1 | 50 | Canada | Microsoft Corporation | webshell paths ×50ephemeral |
| 185.213.175.37 | 51 | 7 | 24 | The Netherlands | NextGenWebs | secret paths ×12 UA spoof |
| 52.139.36.83 | 51 | 2 | 50 | Canada | Microsoft Corporation | webshell paths ×48ephemeral |
| 20.104.198.19 | 51 | 1 | 51 | Canada | Microsoft Corporation | webshell paths ×50ephemeral |
| 40.85.247.124 | 50 | 1 | 50 | Canada | Microsoft Corporation | webshell paths ×48ephemeral |
| 20.215.65.170 | 50 | 1 | 50 | Poland | Microsoft Corporation | webshell paths ×42ephemeral |
| 20.195.178.90 | 50 | 1 | 50 | Brazil | Microsoft Corporation | webshell paths ×50ephemeral |
| 45.148.10.244 | 50 | 1 | 50 | The Netherlands | Techoff SRV Limited | secret paths ×23 |
| 52.139.41.31 | 50 | 1 | 50 | Canada | Microsoft Corporation | webshell paths ×45ephemeral |
| 20.151.110.96 | 50 | 1 | 50 | Canada | Microsoft Corporation | webshell paths ×50ephemeral |
| 165.227.39.234 | 50 | 1 | 50 | Canada | DigitalOcean, LLC | webshell paths ×44ephemeral |
| 195.178.110.199 | 50 | 1 | 31 | Andorra | Techoff SRV Limited | secret paths ×21 |
| 18.183.202.246 | 50 | 1 | 50 | Japan | Amazon Technologies Inc. | webshell paths ×40 secret paths ×33ephemeral |
| 162.35.163.99 | 50 | 1 | 50 | United States | Interserver, Inc | webshell paths ×50 |
| 20.12.231.72 | 50 | 1 | 50 | United States | Microsoft Corporation | webshell paths ×48ephemeral |
| 20.100.175.1 | 50 | 1 | 50 | Norway | Microsoft Corporation | webshell paths ×42ephemeral |
| 20.104.72.216 | 50 | 1 | 50 | Canada | Microsoft Corporation | webshell paths ×49ephemeral |
| 20.197.178.213 | 50 | 1 | 50 | Brazil | Microsoft Corporation | webshell paths ×43ephemeral |
| 20.220.62.118 | 50 | 1 | 50 | Canada | Microsoft Corporation | webshell paths ×45ephemeral |
| 20.194.46.8 | 50 | 1 | 50 | South Korea | Microsoft Corporation | webshell paths ×42ephemeral |
| 20.203.219.109 | 50 | 1 | 50 | Switzerland | Microsoft Corporation | webshell paths ×50ephemeral |
| 2602:fb54:99a:: | 50 | 1 | 48 | United States | Advin Services LLC | secret paths ×34 |
| 34.125.150.199 | 50 | 1 | 14 | United States | Google LLC | secret paths ×50ephemeral |
| 20.205.96.99 | 50 | 1 | 50 | Hong Kong | Microsoft Corporation | webshell paths ×48ephemeral |
| 20.249.10.17 | 50 | 1 | 50 | South Korea | Microsoft Corporation | webshell paths ×49ephemeral |
| 20.63.216.87 | 50 | 1 | 50 | Japan | Microsoft Corporation | webshell paths ×50ephemeral |
| 20.226.82.126 | 50 | 1 | 50 | Brazil | Microsoft Corporation | webshell paths ×50ephemeral |
| 20.220.193.126 | 50 | 1 | 50 | Canada | Microsoft Corporation | webshell paths ×48ephemeral |
| 20.220.210.52 | 50 | 1 | 50 | Canada | Microsoft Corporation | webshell paths ×48ephemeral |
| 20.220.148.251 | 50 | 1 | 50 | Canada | Microsoft Corporation | webshell paths ×44ephemeral |
| 20.250.14.139 | 50 | 1 | 50 | Switzerland | Microsoft Corporation | webshell paths ×50ephemeral |
| 20.226.80.53 | 50 | 1 | 50 | Brazil | Microsoft Corporation | webshell paths ×42ephemeral |
| 20.239.184.68 | 50 | 1 | 50 | Hong Kong | Microsoft Corporation | webshell paths ×42ephemeral |
| 20.43.5.233 | 50 | 1 | 50 | Canada | Microsoft Corporation | webshell paths ×49ephemeral |
| 35.242.176.253 | 50 | 1 | 11 | United Kingdom | Google LLC | secret paths ×50ephemeral |
| 35.94.254.69 | 50 | 1 | 50 | United States | Amazon.com, Inc. | webshell paths ×36 secret paths ×37ephemeral |
| 35.227.116.76 | 50 | 1 | 13 | United States | Google LLC | secret paths ×39ephemeral |
| 4.210.68.162 | 50 | 1 | 50 | Ireland | Microsoft Corporation | webshell paths ×50ephemeral |
| 4.204.204.10 | 50 | 1 | 50 | Canada | Microsoft Corporation | webshell paths ×50ephemeral |
| 2602:fb54:1400::49 | 50 | 1 | 48 | United States | Advin Services LLC | secret paths ×39 |
| 4.193.210.218 | 50 | 1 | 50 | Singapore | Microsoft Corporation | webshell paths ×49ephemeral |
| 52.237.126.164 | 50 | 1 | 50 | Singapore | Microsoft Corporation | webshell paths ×46ephemeral |
| 15.168.138.122 | 49 | 1 | 49 | Japan | Amazon Technologies Inc. | webshell paths ×39 secret paths ×32ephemeral |
| 45.45.237.7 | 49 | 3 | 25 | United States | Infraly, LLC | secret paths ×18 UA spoof |
| 34.131.242.177 | 49 | 1 | 0 | India | Google LLC | secret paths ×25ephemeral |
| 4.225.202.230 | 48 | 1 | 48 | Sweden | Microsoft Corporation | webshell paths ×48ephemeral |
| 74.248.36.50 | 48 | 1 | 48 | Poland | Microsoft Corporation | webshell paths ×48ephemeral |
| 117.33.225.239 | 43 | 1 | 43 | China | CHINANET SHAANXI province Cloud Base network | secret paths ×20 |
| 195.170.172.102 | 39 | 3 | 27 | The Netherlands | NextGenWebs, S.L. | secret paths ×17 UA spoof |
| 93.152.221.13 | 39 | 2 | 18 | Germany | TechTies Inc. | webshell paths ×10 secret paths ×9 |
| 92.118.39.32 | 38 | 2 | 38 | United States | Unmanaged LTD | secret paths ×22 |
| 20.206.73.62 | 38 | 2 | 37 | Brazil | Microsoft Corporation | webshell paths ×37ephemeral |
| 20.151.217.54 | 37 | 1 | 37 | Canada | Microsoft Corporation | webshell paths ×37ephemeral |
| 91.92.42.182 | 36 | 1 | 36 | The Netherlands | LLC VASH KREDIT BANK | webshell paths ×16 secret paths ×20 |
| 20.197.59.67 | 36 | 1 | 36 | India | Microsoft Corporation | webshell paths ×32ephemeral |
| 91.148.244.131 | 34 | 1 | 31 | Belgium | Eweka Internet Services B.V. | secret paths ×11 |
| 38.43.93.233 | 33 | 2 | 27 | United States | Hostodo | secret paths ×17 UA spoof |
| 35.243.243.53 | 33 | 2 | 30 | United States | Google LLC | secret paths ×23ephemeral |
| 20.219.49.21 | 33 | 1 | 33 | India | Microsoft Corporation | webshell paths ×33ephemeral |
| 2605:a140:2338:7143::1 | 32 | 1 | 32 | United States | Contabo Inc. | webshell paths ×32ephemeral |
| 34.47.138.199 | 30 | 1 | 30 | India | Google LLC | secret paths ×30ephemeral |
| 151.243.143.47 | 30 | 2 | 23 | Singapore | BreezeHost | secret paths ×16 UA spoof |
| 8.231.97.236 | 30 | 1 | 30 | India | Google LLC | secret paths ×30ephemeral |
| 8.231.76.124 | 30 | 1 | 30 | India | Google LLC | secret paths ×30ephemeral |
| 34.174.238.61 | 30 | 1 | 30 | United States | Google LLC | secret paths ×30ephemeral |
| 34.174.166.210 | 30 | 1 | 30 | United States | Google LLC | secret paths ×30ephemeral |
| 34.181.149.33 | 30 | 1 | 30 | United States | Google LLC | secret paths ×30ephemeral |
| 35.233.185.108 | 30 | 1 | 30 | United States | Google LLC | secret paths ×30ephemeral |
| 34.162.93.123 | 30 | 1 | 30 | United States | Google LLC | secret paths ×30ephemeral |
| 38.248.95.248 | 29 | 1 | 24 | United States | Limestone Networks, Inc. | secret paths ×16 UA spoof |
| 23.161.169.113 | 27 | 1 | 23 | United Kingdom | Infraly, LLC | secret paths ×16 UA spoof |
| 66.187.4.146 | 25 | 1 | 23 | United States | Hostodo | secret paths ×16 UA spoof |
| 96.44.160.195 | 22 | 1 | 17 | United States | HostPapa | secret paths ×17 UA spoof |
| 20.226.36.195 | 20 | 2 | 18 | Brazil | Microsoft Corporation | webshell paths ×18ephemeral |
| 85.11.167.49 | 20 | 1 | 18 | Bulgaria | LLC VASH KREDIT BANK | webshell paths ×10 secret paths ×9 |
| 2602:fb54:1400::1e6 | 19 | 1 | 18 | United States | Advin Services LLC | secret paths ×18 |
| 80.91.86.169 | 19 | 1 | 12 | Spain | Registered Cogent Communications Customer - LifeinCloud LTD | secret paths ×11 |
| 2a04:c300:400::1b1 | 18 | 1 | 15 | Germany | Advin Services LLC | secret paths ×11 |
| 2602:fb54:1400::14f | 17 | 1 | 16 | United States | Advin Services LLC | secret paths ×12 |
| 47.81.15.95 | 14 | 1 | 14 | Thailand | Alibaba.com LLC | secret paths ×13ephemeral |
| 144.172.116.30 | 12 | 1 | 11 | United States | RouterHosting LLC | secret paths ×9 |
| 64.89.161.85 | 12 | 1 | 11 | Luxembourg | Ghosty Networks LLC | secret paths ×9 |