TF-1931076
medium
📛 Threat Title
php.shin_webshell: Domain that is used for botnet Command&control (C&C) qowolyti.workers.dev
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: php.shin_webshell. Confidence: 50. First seen: 2026-09-23 21:29:35 UTC. Reporter: xscon. Tags: Cloudflare, gif, PHP, webshell, WordPress, workers.dev, wp-admin.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
qowolyti.workers.dev
UrlVoid 2 / 36
IOC database
- Type
- domain
- Value
qowolyti.workers.dev- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain that is used for botnet Command&control (C&C) attributed to php.shin_webshell
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: php.shin_webshell. Confidence: 50. First seen: 2026-09-23 21:29:35 UTC. Reporter: xscon. Tags: Cloudflare, gif, PHP, webshell, WordPress, workers.dev, wp-admin.
Remediations (10)
-
web:blog.sucuri.net
What is a web shell? Learn about the most common types, along with examples. We explain how shells work, what they do, and how to protect your site and clean up this malware from a hacked server.
-
web:cybelangel.com
What web shells are, how attackers deploy them, and how defenders find them — including C99 shell analysis and a CISO detection checklist.
-
web:github.com
Common PHP shells is a collection of PHP webshells that you may need for your penetration testing (PT) cases or in a CTF challenge. Do not host any of the files on a publicly-accessible webserver (unless you know what you are up-to).
-
web:safeguard.sh
A PHP webshell gives attackers remote control of a server. Learn how they get planted, what the code looks like, and how to detect and remove one.
-
web:undercodetesting.com
Mustafa Adam Qamar El-Din discovered a compromised server through a custom wordlist scan, revealing a `shell.php` webshell and unauthorized internal IP access. Below are critical steps to detect and mitigate such attacks. Steps to Investigate a Compromised Server 1. Isolate the Server Disconnect from the network to prevent lateral movement.
-
web:www.microsoft.com
Cookie-gated PHP webshells use obfuscation, php-fpm execution, and cron-based persistence to evade detection in Linux hosting environments. This post examines how this tradecraft conceals execution behind specially crafted HTTP cookies.
-
web:www.spamhaus.org
The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.
-
web:www.threatclaw.ai
Cloudflare Workers, being serverless functions rather than traditional hosting, don't natively execute PHP. When attackers deploy php.shin_webshell to a worker domain , they exploit a different path than the QakBot-style native-C2 model.
-
web:www.threatclaw.ai
The Cloudflare Workers Webshell Family ( php.shin_webshell ) Three domains — qhvdg6q2ob.workers.dev, 591jemmy.workers.dev, and the previously-flagged ck.erloro.com pattern — are hosting php.shin_webshell with conf:50-85 and tag Cloudflare,gif,PHP. This is not a coincidence of naming.
-
web:www.threatclaw.ai
QakBot + Shin WebShell on Cloudflare Workers: The Malware-as-a-Service Infrastructure Shift The fresh ThreatFox telemetry surfaces a distinct convergence signal that deserves closer scrutiny than the raw IOC list suggests. Three php.shin_webshell domains — jyjuregu.workers.dev, gotiri.workers.dev, and bohapu.workers.dev (all conf:50, tagged Cloudflare/gif/PHP) — appearing concurrently with ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.