php.shin_webshell
Malware Family3 338 indicators of compromise attributed to php.shin_webshell across abuse.ch threat intelligence feeds.
Domains
3 337
IPs
1
URLs
0
Hashes
0
Download indicators
Indicator lists for this family. Free and anonymous downloads are a 10% sample.
For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.
Threat types
Botnet C&CPayload Delivery
Sample indicators
| Indicator | Type |
|---|---|
| liceny.workers.dev | domain |
| vozelifu.workers.dev | domain |
| tpkhl11541.workers.dev | domain |
| jedaro.workers.dev | domain |
| zejaziri.workers.dev | domain |
| rn6l1ksf4r.workers.dev | domain |
| puemr96226.workers.dev | domain |
| dopyculo.workers.dev | domain |
| lxexx80613.workers.dev | domain |
| socupuzy.workers.dev | domain |
| oj6t7bx1tw.workers.dev | domain |
| qqgq29g9pl.workers.dev | domain |
| fulezoso.workers.dev | domain |
| msnbot-40-77-167-58.search.msn.com | domain |
| nknzr01387.workers.dev | domain |
| naqydy.workers.dev | domain |
| xalexo.workers.dev | domain |
| xupasyda.workers.dev | domain |
| gertrudachocolate.workers.dev | domain |
| vjqcn67992.workers.dev | domain |
| 122.10.110.72 | ip |