For what it's worth, and I rarely see activity like this, a Micro$oft IP hit my server yesterday, asking for this laundry list of script files:

/shell.php
/shell4.php
/ups.php
/ru.php
/if.php
/vuln.php
/fw.php
/skipper.php
/skippershell.php
/tttt.php
/tshop.php
/alfa.php
/inje3ctor.php
/saudi.php
/wso.php
/alfashell.php
/my_alfa.php
/uploader.php
/up.php
/hacked.php
/c99.php
/priv8.php
/Navir.php
/cmd13.php
/inc20k1.php
/1index.php
/404.php
/swm.php
/wp.php
/doc.php
/shx.php
/ws.php
/m.php
/edit-form.php
/LEAF.php
/leafmailer.php
/mailer.php
/leafmailer2.8.php
/Leaf.php
/leaf.php
/x.php
/srx.php
/1337.php
/xx.php
/XxX.php
/lf.php
/alex.php
/new.php
/marijuana.php
/gaza.php
/wp-admin.php
/3index.php
/wikindex.php
/wso1.php
/bb.php
/Lux.php
/haxor.php

The IP in question was 172.173.182.230. User Agent was

Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0

Referrer for all requests was [google.com....] All requests were http (port 80).

Because M$, Goog and Amazon are unnecessarily mis-allocated millions of IP's that are used for garbage like this, I've been adding their /16 CIDR's to my router's block-and-don't-log list over time as they make their filthy existence known to my web server. This was the first time for this /16, and I see its part of a /11 which is a new range to my blocking list.