s2
--:--:--UTC

Searching APEX

Starting…

  1. Searching Threats, IOCs & Threat Intelligence locally
  2. Querying external providers
  3. Asking AI Forensic Validator
  4. Creating new entry from validated hit

0s elapsed

TF-1931076 medium

📛 Threat Title

php.shin_webshell: Domain that is used for botnet Command&control (C&C) qowolyti.workers.dev

Category: php.shin_webshell Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: php.shin_webshell. Confidence: 50. First seen: 2026-09-23 21:29:35 UTC. Reporter: xscon. Tags: Cloudflare, gif, PHP, webshell, WordPress, workers.dev, wp-admin.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain qowolyti.workers.dev UrlVoid 2 / 36

IOC database

Type
domain
Value
qowolyti.workers.dev
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Domain that is used for botnet Command&control (C&C) attributed to php.shin_webshell

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: php.shin_webshell. Confidence: 50. First seen: 2026-09-23 21:29:35 UTC. Reporter: xscon. Tags: Cloudflare, gif, PHP, webshell, WordPress, workers.dev, wp-admin.

Remediations (10)

  • web:blog.sucuri.net

    What is a web shell? Learn about the most common types, along with examples. We explain how shells work, what they do, and how to protect your site and clean up this malware from a hacked server.

  • web:cybelangel.com

    What web shells are, how attackers deploy them, and how defenders find them — including C99 shell analysis and a CISO detection checklist.

  • web:github.com

    Common PHP shells is a collection of PHP webshells that you may need for your penetration testing (PT) cases or in a CTF challenge. Do not host any of the files on a publicly-accessible webserver (unless you know what you are up-to).

  • web:safeguard.sh

    A PHP webshell gives attackers remote control of a server. Learn how they get planted, what the code looks like, and how to detect and remove one.

  • web:undercodetesting.com

    Mustafa Adam Qamar El-Din discovered a compromised server through a custom wordlist scan, revealing a `shell.php` webshell and unauthorized internal IP access. Below are critical steps to detect and mitigate such attacks. Steps to Investigate a Compromised Server 1. Isolate the Server Disconnect from the network to prevent lateral movement.

  • web:www.microsoft.com

    Cookie-gated PHP webshells use obfuscation, php-fpm execution, and cron-based persistence to evade detection in Linux hosting environments. This post examines how this tradecraft conceals execution behind specially crafted HTTP cookies.

  • web:www.spamhaus.org

    The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  • web:www.threatclaw.ai

    Cloudflare Workers, being serverless functions rather than traditional hosting, don't natively execute PHP. When attackers deploy php.shin_webshell to a worker domain , they exploit a different path than the QakBot-style native-C2 model.

  • web:www.threatclaw.ai

    The Cloudflare Workers Webshell Family ( php.shin_webshell ) Three domains — qhvdg6q2ob.workers.dev, 591jemmy.workers.dev, and the previously-flagged ck.erloro.com pattern — are hosting php.shin_webshell with conf:50-85 and tag Cloudflare,gif,PHP. This is not a coincidence of naming.

  • web:www.threatclaw.ai

    QakBot + Shin WebShell on Cloudflare Workers: The Malware-as-a-Service Infrastructure Shift The fresh ThreatFox telemetry surfaces a distinct convergence signal that deserves closer scrutiny than the raw IOC list suggests. Three php.shin_webshell domains — jyjuregu.workers.dev, gotiri.workers.dev, and bohapu.workers.dev (all conf:50, tagged Cloudflare/gif/PHP) — appearing concurrently with ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.