s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1932670 medium

📛 Threat Title

php.shin_webshell: Domain that is used for botnet Command&control (C&C) lizususo.workers.dev

Category: php.shin_webshell Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: php.shin_webshell. Confidence: 50. First seen: 2026-09-25 04:33:03 UTC. Reporter: xscon. Tags: Cloudflare, gif, PHP, webshell, WordPress, workers.dev, wp-admin.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain lizususo.workers.dev UrlVoid 2 / 36

IOC database

Type
domain
Value
lizususo.workers.dev
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Domain that is used for botnet Command&control (C&C) attributed to php.shin_webshell

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: php.shin_webshell. Confidence: 50. First seen: 2026-09-25 04:33:03 UTC. Reporter: xscon. Tags: Cloudflare, gif, PHP, webshell, WordPress, workers.dev, wp-admin.

Remediations (10)

  • ThreatFox | btwcf42020.workers.dev
    web:threatfox.abuse.ch

    This IOC is reference the injection webshell using Worker Clouflare, infected using polyglot file php over gif in WordPress.

  • ThreatFox | round60.workers.dev
    web:threatfox.abuse.ch

    This IOC is reference the injection webshell using Worker Clouflare, infected using polyglot file php over gif in WordPress.

  • ThreatFox | ghgnc90719.workers.dev
    web:threatfox.abuse.ch

    This IOC is reference the injection webshell using Worker Clouflare, infected using polyglot file php over gif in WordPress.

  • ThreatFox | fjsy2up0gt.workers.dev
    web:threatfox.abuse.ch

    This IOC is reference the injection webshell using Worker Clouflare, infected using polyglot file php over gif in WordPress.

  • ThreatFox | syloziwu.workers.dev
    web:threatfox.abuse.ch

    This IOC is reference the injection webshell using Worker Clouflare, infected using polyglot file php over gif in WordPress.

  • ThreatFox | 7webun0dcu.workers.dev
    web:threatfox.abuse.ch

    This IOC is reference the injection webshell using Worker Clouflare, infected using polyglot file php over gif in WordPress.

  • ThreatFox | wimanamo.workers.dev
    web:threatfox.abuse.ch

    This IOC is reference the injection webshell using Worker Clouflare, infected using polyglot file php over gif in WordPress.

  • ThreatFox | 542b1els96.workers.dev
    web:threatfox.abuse.ch

    This IOC is reference the injection webshell using Worker Clouflare, infected using polyglot file php over gif in WordPress.

  • Cloudflare Workers as Covert C2: The php.shin_webshell "worker.botnet ...
    web:www.threatclaw.ai

    The php.shin_webshell payload itself is a classic post-exploitation webshell that , once dropped on a target edge server, would blend into routine PHP traffic. This is not a replacement for the proven C2 cohort above — it's an escalation path.

  • Remus Stealer's Weaponized Cloudflare Workers: php.shin_webshell Gif ...
    web:www.threatclaw.ai

    The Cloudflare Workers Webshell Family ( php.shin_webshell ) Three domains — qhvdg6q2ob.workers.dev, 591jemmy.workers.dev, and the previously-flagged ck.erloro.com pattern — are hosting php.shin_webshell with conf:50-85 and tag Cloudflare,gif,PHP. This is not a coincidence of naming.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.