# PHP2Shell (CVE-2026-109618 / 109619 / 115560) - indicateurs de compromission
# FactualRisk - https://factualrisk.com/guides/php2shell/ - mis a jour le 27/10/2026
# Contact SORTANT vers une adresse 'fort' = compromission probable ; requete ENTRANTE d'un scanner = tentative.
# Signal 'faible' (CYFIRMA) : noeuds soupconnes, possiblement victimes eux-memes ; chercher, ne pas bloquer.
# Amazon : ses adresses relevent en partie d'infrastructures partagees, enqueter avant de bloquer.
# Ne pas bloquer 134.154.64.199 (leurre universitaire).

## Adresses IPv4 - signal fort
15.204.59.70
162.35.99.94
92.118.112.100
134.199.154.64
117.55.202.115
89.32.41.16
89.32.41.50
45.198.224.88
206.188.197.105
45.115.26.26
150.251.112.208
41.223.30.7
102.210.149.166
122.10.17.49
122.10.110.72
124.221.46.164
58.221.60.160
157.230.117.70
104.219.251.31
107.150.31.151
122.10.130.72

## Adresses IPv4 - signal moyen
5.175.189.76
204.76.203.7
45.198.224.0/24
45.198.224.169
85.11.167.243
217.60.242.76
144.48.4.242
221.14.159.134
87.121.84.174
181.215.186.252
185.196.220.132
185.161.210.29
152.233.51.69
45.134.225.16
107.189.14.87
193.47.62.24
103.147.220.17
103.216.220.92
31.223.184.166
37.19.200.5
134.209.159.64
103.114.163.188
95.217.98.37
31.182.51.55
98.80.11.91
200.119.44.50
146.70.202.189
185.5.70.233
176.65.132.128
152.233.51.47
146.70.184.216
34.136.122.211
38.207.136.217
122.97.242.167
192.140.154.1
47.238.232.123
45.136.71.89
77.237.246.73

## Adresses IPv4 - signal faible
146.70.114.180
146.70.114.182
147.175.149.67
147.78.168.57
147.78.168.67
109.56.219.150
158.173.75.178
185.203.18.54
185.235.212.105
103.77.210.80
128.90.176.13
138.199.34.201
145.255.150.25
149.102.232.44
149.102.232.93
158.173.242.133
102.207.250.188
94.154.43.185
75.119.143.189
117.203.73.63
146.190.107.103
95.217.164.124
124.122.142.142
188.80.228.122
134.209.181.133
134.209.252.157
119.63.72.54
138.68.161.170
95.216.5.90
103.21.161.105
115.96.27.126
185.207.232.121
78.47.85.99
142.93.155.162
134.122.38.73
5.255.114.109
165.22.232.198
159.223.59.200
192.177.131.13
94.154.42.149
173.249.16.178
170.64.224.137
170.64.226.40
45.148.10.80
152.237.230.29
146.70.194.93
185.157.109.60
143.246.213.138
144.91.70.51
217.60.196.124
151.253.243.219
23.106.131.214
173.249.16.192
45.148.10.201
109.71.252.97

## Domaines - signal fort
godofthunder.st
botlesscucks.st
gettingheadfromduckysmom.st
maste.mangsud.org

## Empreintes SHA-256 - signal fort
0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486
e2529d4afa39ae4db2eb05d5176317c906289abf09660c75bdeec43e54c55aa3
7133612558a5d0f257ca6bdb4f765453af9465bc5298acdcf33b5761b8c59aac
dd98bf48899aa385035352688357742c73ddc5e47ec4ecc7d7b74c53c2e3ca3d

## Empreintes MD5 - signal fort
b61a098fc62a2c2696e196dca78da71a

## Ports - signal fort
50217-52645

## User-agents - signal moyen
php2shell-scan/109618
php2shell-109618
php-session-startup-rce-poc

## Marqueurs (journaux, sessions, requetes) - signal moyen
B7kQpoc618
CCCCCCCCCC
PHP2SHELL_CONFIRMED
RCE_noyzzg0YVLBU
NUCLEIve97RH0fzh
JACKALPOC
P2SMARK
P2SFNAME
P2SVALUE
P2SOP-
sess_p2sopchain

## Fichiers - signal fort
/tmp/x1
/tmp/nfs
/out/p1

## Fichiers - signal moyen
/var/www/p1
/var/www/html/p1