TF-2012145
medium
📛 Threat Title
php.shin_webshell: Domain name that delivers a malware payload 151.99.77.34.bc.googleusercontent.com
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: php.shin_webshell. Confidence: 50. First seen: 2026-11-03 00:06:47 UTC. Reporter: xscon. Tags: gif, PHP, webshell, WordPress, wp-admin.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
151.99.77.34.bc.googleusercontent.com
UrlVoid 0 / 36
IOC database
- Type
- domain
- Value
151.99.77.34.bc.googleusercontent.com- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to php.shin_webshell
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: php.shin_webshell. Confidence: 50. First seen: 2026-11-03 00:06:47 UTC. Reporter: xscon. Tags: gif, PHP, webshell, WordPress, wp-admin.
Remediations (10)
-
web:boteraser.com
The webshell obfuscates its code—often using base64 encoding, eval () calls, and string concatenation—to evade signature-based detection. It supports custom authentication via password-protected login pages and can create backdoor user accounts on compromised servers.
-
web:ismalicious.com
2,984 indicators of compromise attributed to the php.shin_webshell malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.
-
web:malpedia.caad.fkie.fraunhofer.de
A PHP webshell that allows file system management, data exfiltration and command execution.
-
web:maltiverse.com
A PHP webshell that allows file system management, data exfiltration and command execution.
-
web:threatfox.abuse.ch
php.shin_webshell IOC: 44.113.38.34.bc.googleusercontent.com ( domain )
-
web:threatfox.abuse.ch
php.shin_webshell IOC: 71.159.199.104.bc.googleusercontent.com ( domain )
-
web:threats.kaspersky.com
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
-
web:www.huntress.com
A PHP webshell is a malicious script that gives attackers a back door into your web server. Once uploaded, it acts as a command-and-control interface, letting threat actors browse your file system, upload more malware , steal data, or even take over the server completely.
-
web:www.sophos.com
Luke is a Senior Threat Researcher at Sophos X-Ops focused exclusively on Linux security. His work centers on reverse engineering malware and researching advanced threats; including eBPF-based malware , memory-resident rootkits, web shells, ransomware, and cloud-native attacks.
-
web:www.threatclaw.ai
The last 24h of malware infrastructure intelligence submissions show a small but analytically dense cluster that reads less like random commodity feeds and more like a single post-compromise staging pattern: two PHP shin_webshell implants hosted on *.bc.googleusercontent.com reverse-DNS hostnames, a high-confidence Vidar stealer delivery ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.