r00t-shell[.]comDomain
Reported by 1 independent source · first reported by SOCRadar · last reported
Last reported 18 days ago
What the reports say
1 report, newest first · the exact sentence from each-
CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure“WSO webshell variant: the deployed shell is a WSO-family variant obfuscated with the R00t-Shell[.]com 2.0.15 obfuscator and was undetected on VirusTotal at analysis time; its header carries a characteristic obfuscator string suitable for a YARA signature”
Indicators reported together
named in the same reports- exploit[.]inin 1 report
- 46.21.250[.]135in 1 report
- 45.88.106[.]2in 1 report
- 212.193.31[.]189in 1 report
- 91.208.184[.]148in 1 report
- 45.88.106[.]78in 1 report
- 49.234.12[.]182in 1 report
- 42.193.100[.]94in 1 report
- 92a789444708fa1c…5a18197d0090in 1 report
- a5ae0aab352871bc…592cd34eb86cin 1 report
- 71e21094c1ac1cf0…682681fc1192in 1 report
- 59c535f47ab4d35f…5d2d32cfa483in 1 report
- hxxp://42.193.227[.]214:8033/in 1 report
- 42.193.227[.]214in 1 report
Copy these 14 indicators · defanged
Also named with it: CVE-2026-60137, CVE-2026-63030, CVE-2026-4815, CVE-2015-1397
Thanks — we review every report.