PHP2Shell payload fetch from 162.35.99.94 via wget/curl/php (aggregated)

ills3c Intel&Coffee@Ills3C

•updated yesterday•8•0•14

Detects web servers, PHP processes, or shell processes spawning fetch utilities such as wget or curl to communicate with a specific malicious payload IP address (162.35.99.94), often indicative of web shell exploitation or post-exploitation file download activity.