PHP2Shell IOCs from Amazon and Hunt.io, checked against isMalicious

On 21 October 2026, Amazon published six IP addresses that had sent PHP2Shell exploit attempts (CVE-2026-109618 and CVE-2026-109619) to its MadPot honeypots. On 22 October, Hunt.io published the scanners, payload host, botnet servers and staging servers it had tied to the same activity. On 23 October we opened the isMalicious page of 18 of those indicators and wrote down what each one showed that day: the level, the number of threat sources, "In our dataset since" and "Record updated". The tables below are that snapshot. They do not move when the pages do.

The short version:

• 15 of the 18 were listed on 23 October: 8 High, 5 Medium, 2 Low. 3 were not listed.
• 5 were provably listed before the report that named them. Four belong to the botnet Hunt.io describes, and they were on malware, botnet and abuse lists. The fifth, 104.219.251[.]31, was on a VoIP blacklist and an abuse list, neither related to PHP2Shell. None of the five was listed for PHP2Shell.
• Amazon's six addresses were all listed, two High and four Medium, but none can be shown to have been listed before Amazon's report. Amazon says its list includes shared anonymisation infrastructure.
• We missed three indicators, and the mass-exploitation server Hunt.io found reached our data only the day after its report.

What the two reports published

Amazon's post of 21 October describes a PHP2Shell attempt logged in MadPot on 17 October, four days before public disclosure, from an address on a commercial anonymisation network, then more attempts on 21 October from other anonymised infrastructure. It lists the six addresses with the date each was seen, and says they include shared anonymisation infrastructure and are not exclusive to this activity. Its advice on them: "Organizations should investigate any observations involving these addresses as opposed to blocking."

Hunt.io's report of 22 October traces the php2shell scanning it saw to a Mirai-style IoT botnet, active since at least May 2026, that added php2shell to its spreading kit. Its indicator table names the scanner network, a second scanner, a payload host, three botnet binary hosts and three wildcard C2 domains. It also lists attacker staging servers found in open directories, among them a mass-exploitation server that ran a tool against up to 123 servers without logging a shell. At the time of writing, Hunt.io had seen attempts and staged tooling but no confirmed compromise.

From these we took Amazon's six addresses and twelve of Hunt.io's indicators: the network indicators of its table, with the scanner it names, 45.198.224[.]169, standing in for the scanner /24; two of its staging hosts, 206.188.197[.]105 and 104.219.251[.]31; and maste.mangsud[.]org, the host a webshell staged on 104.219.251[.]31 downloads from.

How to read the dates

Each isMalicious indicator page carries three dates, in UTC:

• "In our dataset since" is the day the record entered our dataset, not the day anyone first reported the indicator. The dataset was reloaded on 28 August 2026, so 2026-08-28 means "on that day or earlier".
• "Record updated" is the last time the record was rewritten. A new source rewrites it, and so do a rescore and a changed field.
• "Last seen on a list" is the last day a list we read named the indicator. A list naming it again moves only this date.

So a record whose "Record updated" date falls before a report already held, before that report, every source it shows. That is the only rule behind each "Yes" in the tables. When a record was rewritten after the report, the page cannot say whether its sources were there before it, and the row reads "Can't show". The page does not say which list created the record, or when each list added it.

The indicators, as shown on 23 October 2026

Levels and source counts are the ones the pages showed that day. "Threat sources" counts publishers, so two lists from the same publisher count once; VPN, datacenter and other context lists are shown apart on the pages and not counted. † marks 2026-08-28, the reload date: read it as "on that day or earlier". Each indicator links to its isMalicious page, which shows today's values, not these.

Amazon MadPot, published 21 October

Hunt.io, published 22 October

What "listed before" means here

Four of the five early listings are the botnet's own infrastructure: three binary hosts and one C2 domain. They sat on lists such as Spamhaus DROP, URLhaus, HaGeZi TIF and the Emerging Threats firewall block list weeks before Hunt.io's report. 89.32.41[.]16 held its 16 threat sources by 16 September, and 45.198.224[.]88 its 18 by 5 October, before PHP shipped the fix on 21 October. Hunt.io says the botnet has been running since at least May, so these are listings of a long-running botnet that later added php2shell to its kit. They are not a PHP2Shell detection, and nothing in our data ties them to either CVE.

Amazon's six addresses tell a different story. They were all listed on 23 October, on lists such as ThreatHive, Bitwire, FireHOL and FFraud, but every record had been rewritten that day, so none can be dated before Amazon's report. One list, the Rösti MISP OSINT Feed, carried all six. It was also the only list carrying 206.188.197[.]105 when that address reached our data, the day after Hunt.io named it. It appears to pick up indicators from published reports, so its listing of Amazon's addresses may simply repeat Amazon's own list. Five of the six pages also show VPN or datacenter lists. Those sit under "Infrastructure and context", apart from the threat listings, and are not counted as detections, which is consistent with Amazon's warning about shared anonymisation infrastructure.

What changed by 26 October

We opened the same 18 pages again on 26 October 2026.

• All six Amazon records were rewritten on 24 October. Five now show more threat sources, and two moved from Medium to High: 31.223.184[.]166 and 95.217.98[.]37. Lists that add an address after a vendor publishes it tell you little beyond the vendor's own report.
• The payload host 92.118.112[.]100 went from Medium on 2 threat sources to High on 6. The two scanners went from 32 to 33 sources (45.198.224[.]169) and from 26 to 29 (85.11.167[.]243).
• Two of the three botnet C2 domains entered our dataset on 25 October, at Low, on two lists each. maste.mangsud[.]org still has no record.
• The four early botnet records and 104.219.251[.]31 keep their "Record updated" dates. One count fell: 45.198.224[.]88 showed 18 threat sources on 23 October and 17 on 26 October, under the same 2026-10-05 date. A count can fall without a rewrite. A new listing always rewrites the record, which is what the rule above relies on.

What we missed

• Two of the three botnet C2 domains, and maste.mangsud[.]org, were not in our data on 23 October, the day after Hunt.io published them. The two domains arrived on 25 October, at Low; maste.mangsud[.]org has no record yet.
• The mass-exploitation server, 206.188.197[.]105, entered our data the day after the report, through one OSINT feed, at Low. On 26 October it was still Low on that one source.
• The payload host, 92.118.112[.]100, was Medium on two sources on 23 October and reached High only after the report.
• None of the 18 is tied to PHP2Shell in our data. On 26 October, the "Observed activity" panel of both CVE pages showed no indicator tagged with either CVE over the previous seven days. What we had was infrastructure on malware, botnet and abuse lists, not knowledge of the exploit.
• We checked 2 of the 13 staging and lab hosts Hunt.io lists. The other 11 are not in this post, nor is the research checker it lists under "Watch". Its user agents, scanner fingerprint and request pattern are detection signatures, not reputation indicators, and we did not check them.

Using these indicators

Patch first: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both CVEs, and the CVE-2026-109618 and CVE-2026-109619 pages list the fixed versions per branch and the distribution builds. Treat Amazon's six addresses the way Amazon does: as grounds to investigate a hit, not as a block list. Hunt.io marks its scanner network, second scanner, payload host, binary hosts and C2 domains for blocking, and notes that none of them is evidence that a php2shell attack succeeded.

Get the feed in your own tool

The indicators on these pages also ship over STIX/TAXII. You can start a 7-day trial of the STIX/TAXII feed: it is self-serve for the owner or an admin of a Free organization with a work address, with no card, though some requests wait for a manual check. The trial feed is licence-filtered: an indicator goes out only when a list with an explicit permissive licence carries it, so it may not include every indicator above.

Method

Lookups: the public pages ismalicious.com/ip/<address> and ismalicious.com/domain/<name>, opened in a browser without an account on 23 October 2026 and again on 26 October 2026. Indicators, roles and dates: Amazon's post of 21 October and Hunt.io's report of 22 October, both re-read on 26 October. Dates are UTC. Indicators are defanged in the text ([.] for a dot); each link opens the indicator's isMalicious page, which shows its current values rather than the 23 October snapshot.