TF-2012741
medium
📛 Threat Title
php.shin_webshell: Domain name that delivers a malware payload lcyhw43786.workers.dev
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: php.shin_webshell. Confidence: 50. First seen: 2026-11-03 09:33:06 UTC. Reporter: xscon. Tags: Cloudflare, gif, PHP, webshell, WordPress, workers.dev, wp-admin.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
lcyhw43786.workers.dev
UrlVoid 0 / 36
IOC database
- Type
- domain
- Value
lcyhw43786.workers.dev- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to php.shin_webshell
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: php.shin_webshell. Confidence: 50. First seen: 2026-11-03 09:33:06 UTC. Reporter: xscon. Tags: Cloudflare, gif, PHP, webshell, WordPress, workers.dev, wp-admin.
Remediations (10)
-
web:davidgodwinpratt.com
The php.shin_webshell malware is a remote code execution tool used to maintain persistent access and exfiltrate data from compromised web servers. It typically arrives via phishing emails, exploit kits, or compromised third-party
-
web:ismalicious.com
2,984 indicators of compromise attributed to the php.shin_webshell malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.
-
web:malpedia.caad.fkie.fraunhofer.de
A PHP webshell that allows file system management, data exfiltration and command execution.
-
web:maltiverse.com
A PHP webshell that allows file system management, data exfiltration and command execution.
-
web:threatfox.abuse.ch
php.shin_webshell IOC: lywomani.workers.dev ( domain )
-
web:threatfox.abuse.ch
php.shin_webshell IOC: mucxm97044.workers.dev ( domain )
-
web:urlhaus.abuse.ch
URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...
-
web:www.huntress.com
A PHP webshell is a malicious script that gives attackers a back door into your web server. Once uploaded, it acts as a command-and-control interface, letting threat actors browse your file system, upload more malware , steal data, or even take over the server completely.
-
web:www.microsoft.com
Cookie-gated PHP webshells use obfuscation, php-fpm execution, and cron-based persistence to evade detection in Linux hosting environments. This post examines how this tradecraft conceals execution behind specially crafted HTTP cookies.
-
web:www.sophos.com
SophosLabs recently acquired a Linux implant associated with compromised BIG-IP Access Policy Management (APM) environments that use Apache and PHP components. The malware demonstrates advanced techniques including custom ELF loading, function hooking, and runtime code patching to evade detection while maintaining persistent access through hidden web shells. The implant delivers a familiar ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.