{"success":true,"data":{"threats":[{"id":"6755e7a1-3483-4ece-8b39-e28b30f448c3","slug":"threatfox-1957968","externalId":"threatfox-1957968","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"AMOS sha256_hash: 0fa673a1cffbbabcd03249e98cd879bdfd4175ad720a2761fe89ee8dfd87c43c","description":"SHA256 hash of a malware sample (payload) indicator associated with AMOS. Indicator that identifies a malware sample (payload) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:sha256-hash","threat:payload","malware:osx-amos","confidence:100","amos","clickfix","foxveil","macos","quill"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957968/","type":"report","title":"ThreatFox IOC 1957968"},{"url":"https://www.virustotal.com/gui/file/0fa673a1cffbbabcd03249e98cd879bdfd4175ad720a2761fe89ee8dfd87c43c","type":"report","title":"Reporter reference"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:35:14.000Z","addedAt":"2026-10-08T20:48:01.976Z","updatedAt":"2026-10-08T20:48:01.976Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"50323eff-dcc1-4531-b482-865ae034b71d","slug":"threatfox-1957967","externalId":"threatfox-1957967","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: msnbot-40-77-167-67[.]search[.]msn[.]com","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957967/","type":"report","title":"ThreatFox IOC 1957967"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:34:37.000Z","addedAt":"2026-10-08T20:48:01.988Z","updatedAt":"2026-10-08T20:48:01.988Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"683b4384-fec6-4029-bbbb-8eb51bc0ce2d","slug":"threatfox-1957966","externalId":"threatfox-1957966","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: google-proxy-66-249-88-197[.]google[.]com","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957966/","type":"report","title":"ThreatFox IOC 1957966"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:34:30.000Z","addedAt":"2026-10-08T20:48:01.995Z","updatedAt":"2026-10-08T20:48:01.995Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"b08f80dc-aab5-44c7-b613-50c2905c1c9f","slug":"threatfox-1957965","externalId":"threatfox-1957965","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: google-proxy-66-249-84-224[.]google[.]com","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957965/","type":"report","title":"ThreatFox IOC 1957965"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:34:09.000Z","addedAt":"2026-10-08T20:48:02.003Z","updatedAt":"2026-10-08T20:48:02.003Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"53d81b08-56e2-421b-bb21-a089ca90c1c7","slug":"threatfox-1957964","externalId":"threatfox-1957964","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: google-proxy-66-249-84-229[.]google[.]com","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957964/","type":"report","title":"ThreatFox IOC 1957964"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:34:04.000Z","addedAt":"2026-10-08T20:48:02.011Z","updatedAt":"2026-10-08T20:48:02.011Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"4ec3e883-3982-4e8f-9c76-e8c864685a6d","slug":"threatfox-1957963","externalId":"threatfox-1957963","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: google-proxy-66-249-88-196[.]google[.]com","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957963/","type":"report","title":"ThreatFox IOC 1957963"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:33:59.000Z","addedAt":"2026-10-08T20:48:02.018Z","updatedAt":"2026-10-08T20:48:02.018Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"b60c99cc-285a-4999-8b7c-eaec85fd501c","slug":"threatfox-1957962","externalId":"threatfox-1957962","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: 193[.]255[.]232[.]35[.]bc[.]googleusercontent[.]com","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957962/","type":"report","title":"ThreatFox IOC 1957962"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:33:52.000Z","addedAt":"2026-10-08T20:48:02.026Z","updatedAt":"2026-10-08T20:48:02.026Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"7ae41440-0d89-443e-a9fb-563b9e2e5a47","slug":"threatfox-1957961","externalId":"threatfox-1957961","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: google-proxy-66-249-88-195[.]google[.]com","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957961/","type":"report","title":"ThreatFox IOC 1957961"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:27:23.000Z","addedAt":"2026-10-08T20:48:02.034Z","updatedAt":"2026-10-08T20:48:02.034Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"cf4d3640-73e3-41d1-8bfc-76c1eb3d0cb5","slug":"threatfox-1957960","externalId":"threatfox-1957960","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: 85[.]233[.]229[.]8[.]bc[.]googleusercontent[.]com","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957960/","type":"report","title":"ThreatFox IOC 1957960"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:26:41.000Z","addedAt":"2026-10-08T20:48:02.042Z","updatedAt":"2026-10-08T20:48:02.042Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"d393d6e4-9f79-4d91-84ab-0b802f55278d","slug":"threatfox-1957959","externalId":"threatfox-1957959","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: rate-limited-proxy-72-14-199-163[.]google[.]com","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957959/","type":"report","title":"ThreatFox IOC 1957959"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:26:30.000Z","addedAt":"2026-10-08T20:48:02.050Z","updatedAt":"2026-10-08T20:48:02.050Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"0c319dba-9b0e-476f-a7da-45f59a18ea17","slug":"threatfox-1957958","externalId":"threatfox-1957958","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: google-proxy-192-178-15-8[.]google[.]com","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957958/","type":"report","title":"ThreatFox IOC 1957958"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:24:30.000Z","addedAt":"2026-10-08T20:48:02.058Z","updatedAt":"2026-10-08T20:48:02.058Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"d792b28b-5523-4e2d-8743-c717fa711d80","slug":"threatfox-1957957","externalId":"threatfox-1957957","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: google-proxy-74-125-212-69[.]google[.]com","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957957/","type":"report","title":"ThreatFox IOC 1957957"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:23:36.000Z","addedAt":"2026-10-08T20:48:02.067Z","updatedAt":"2026-10-08T20:48:02.067Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"5bd19ca7-327a-4fa6-b5af-4fe1bbceb077","slug":"threatfox-1957956","externalId":"threatfox-1957956","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: msnbot-40-77-167-123[.]search[.]msn[.]com","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957956/","type":"report","title":"ThreatFox IOC 1957956"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:21:42.000Z","addedAt":"2026-10-08T20:48:02.075Z","updatedAt":"2026-10-08T20:48:02.075Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"e51334ed-3543-498c-83cb-b5a250ee8f6d","slug":"threatfox-1957955","externalId":"threatfox-1957955","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: ukouu42212[.]workers[.]dev","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957955/","type":"report","title":"ThreatFox IOC 1957955"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:21:29.000Z","addedAt":"2026-10-08T20:48:02.083Z","updatedAt":"2026-10-08T20:48:02.083Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"94a79a2e-78b6-4ace-9db8-0d2d2e9177a5","slug":"threatfox-1957954","externalId":"threatfox-1957954","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: ec2-18-220-246-163[.]us-east-2[.]compute[.]amazonaws[.]com","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957954/","type":"report","title":"ThreatFox IOC 1957954"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:21:12.000Z","addedAt":"2026-10-08T20:48:02.091Z","updatedAt":"2026-10-08T20:48:02.091Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"ebcc8dae-5136-44c6-bb4b-59e45656b093","slug":"threatfox-1957953","externalId":"threatfox-1957953","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: gkuwo76378[.]workers[.]dev","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957953/","type":"report","title":"ThreatFox IOC 1957953"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:20:38.000Z","addedAt":"2026-10-08T20:48:02.099Z","updatedAt":"2026-10-08T20:48:02.099Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"a731250c-097b-49c3-8f20-ec5be79f186f","slug":"threatfox-1957952","externalId":"threatfox-1957952","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: kvjmm72764[.]workers[.]dev","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957952/","type":"report","title":"ThreatFox IOC 1957952"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:20:31.000Z","addedAt":"2026-10-08T20:48:02.106Z","updatedAt":"2026-10-08T20:48:02.106Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"10db830e-2982-484f-984c-2e59dda8f0e0","slug":"threatfox-1957951","externalId":"threatfox-1957951","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: google-proxy-192-178-15-6[.]google[.]com","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957951/","type":"report","title":"ThreatFox IOC 1957951"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:19:52.000Z","addedAt":"2026-10-08T20:48:02.114Z","updatedAt":"2026-10-08T20:48:02.114Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"527d6154-5632-42b6-aa47-37ae8fbe3099","slug":"threatfox-1957950","externalId":"threatfox-1957950","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: google-proxy-192-178-15-7[.]google[.]com","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957950/","type":"report","title":"ThreatFox IOC 1957950"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:19:48.000Z","addedAt":"2026-10-08T20:48:02.121Z","updatedAt":"2026-10-08T20:48:02.121Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"2d452525-8021-488a-a8f9-7cbd84f2eafd","slug":"threatfox-1957949","externalId":"threatfox-1957949","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"php.shin_webshell domain: delaka[.]workers[.]dev","description":"Domain name that delivers a malware payload indicator associated with php.shin_webshell. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 50%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:php-shin-webshell","confidence:50","cloudflare","gif","php","webshell","wordpress","workers-dev","wp-admin"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957949/","type":"report","title":"ThreatFox IOC 1957949"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:19:35.000Z","addedAt":"2026-10-08T20:48:02.129Z","updatedAt":"2026-10-08T20:48:02.129Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]}],"pagination":{"page":1,"limit":20,"total":94348,"totalPages":4718,"hasNext":true,"hasPrev":false}},"meta":{"apiVersion":"v1","requestedAt":"2026-10-08T23:43:13.489Z","durationMs":222,"filters":{"search":null,"severity":[],"type":[],"country":[],"tag":[],"cwe":[],"vendor":null,"product":null,"cve":null,"source":["abuse.ch ThreatFox"],"days":null,"publishedAfter":null,"publishedBefore":null,"minCvss":null,"maxCvss":null,"minEpss":null,"knownExploited":null,"hasPatch":null,"hasNucleiTemplate":null},"sort":"newest","unknownParams":[],"warnings":[]}}