⚠️ Overview

BackDoorBot is a malicious web crawler that hunts for backdoor scripts, web shells, and exposed administrative interfaces on Internet-facing servers. Its maintainers are not publicly named, but the bot is listed in public hostile User-Agent blocklists, including Mitchell Krog's GitHub repository at `github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker`, and in threat feeds used by hosting and security companies.

🔧 Technical Capabilities

BackDoorBot operates by recursively requesting well-known webshell paths such as `/c99.php`, `/r57.php`, `/b374k.php`, `/shell.php`, `/up.php`, and `/wp-content/uploads/`. It also checks for sensitive files and configuration leaks like `/.env`, `/.git/HEAD`, `/phpinfo.php`, `/adminer.php`, and `/phpmyadmin/`. The bot analyzes HTTP status codes and response body markers, including PHP syntax fragments and `eval(`, to decide whether a target is vulnerable. It can generate hundreds of requests per minute, frequently using randomized query strings and lower-case paths to evade basic signature filters. Unlike legitimate search crawlers, BackDoorBot does not parse `robots.txt` and ignores directives intended to restrict access. It also attempts POST requests on suspected upload handlers to determine whether file upload functionality is exposed.

📜 History & Notable Incidents

No CVE number has been assigned to BackDoorBot itself because it is a scanning tool, not a software vulnerability. However, it has been repeatedly observed in access logs following large-scale website defacement and web-shell injection incidents. Its appearance in public Git-based bad-bot blocklists and malware research forums dates back at least a decade, and it remains active in current attack telemetry, often appearing alongside other confirmed malicious agents such as `MauiBot` and `sqlmap`.

🔍 Detection Indicators

The primary indicator is the exact User-Agent string `BackDoorBot/1.0`, sometimes followed by an advertised URL such as `http://www.backdoorbot.com/`. Behavioral fingerprints include dense clusters of 404 responses for common shell filenames, missing `Accept-Language` headers, and repeated GET/POST pairs to the same URI within a short interval.

☠️ Risk & Impact

BackDoorBot can reveal pre-existing backdoors, credential files, database dumps, and misconfigured admin panels. If a backdoor is confirmed, an attacker gains a stable remote foothold, which can be leveraged for data theft, cryptocurrency mining, spam relay, or further lateral movement. Even unsuccessful scans consume bandwidth and can degrade performance.

🛡️ Mitigation

Because BackDoorBot serves no legitimate function and is used exclusively for hostile reconnaissance, it is blocked immediately on detection by rejecting its User-Agent at the reverse proxy and by feeding the source IP into accessible IP reputation lists.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.