php2shell × Common Crawl by SwordSec

Data access for defenders

We do not publish the list of potentially affected sites: a public list would be a target list. Teams that can act on it, such as CERTs, hosting providers and security companies, can ask for the data.

Who can ask

  • National CERTs and CSIRTs: hosts in your country's address space or under your country-code domain, to notify owners.
  • Sector and government CERTs: hosts belonging to your constituency.
  • Hosting providers and ISPs: hosts on the networks you operate.
  • Security companies and researchers: for remediation or research with a clear purpose.

We verify every requester before sharing anything. Once we have verified a CERT or another trusted organization, we can share the full dataset, not only a subset.

What the data contains

  • Hostname and registered domain
  • Reported PHP version, its source header and our classification
  • CMS and CDN evidence, number of pages crawled, crawl dates
  • Server IP address, its country and network (ASN)

We never collected URL paths, query strings or cookie values, so we cannot share them. The data covers 41,495,022 hosts from Common Crawl CC-MAIN-2026-43.

Request the data

Please use your organization's address; it helps us verify you.

We use these details only to evaluate and answer your request, and delete them when they are no longer needed for that. We do not store your IP address.

Other questions

For corrections, press or anything else, write to info [at] swordsec [dot] com.