Threat feed
InterServer Webshell MD5 Signatures
Last fetched
Malware Distribution · refreshed every 6 hours · last verified
InterServer Webshell MD5 Signatures is a Malware Distribution threat-intelligence feed, refreshed every 6 hours, indexed by WhisperGraph.
What is InterServer Webshell MD5 Signatures
InterServer Webshell MD5 Signatures is an MD5 hash export narrowed specifically to webshells — the PHP, ASP, and similar server-side scripts attackers plant on compromised web hosting to maintain persistent access — again sourced from InterServer's own hosting-abuse investigations. Webshell detection is a distinct enough problem from general malware detection (small file size, legitimate-looking file extensions, frequent obfuscation) that hosting providers often maintain dedicated signature sets for it, as InterServer does here. It is indexed here as a hosting-provider-derived webshell-specific reference, narrower in scope than the provider's general malware-hash feed.
- Refresh cadence
- every 6 hours
Category drift. The curated category for this feed is Malware Distribution, while WhisperGraph currently files it under malware-distribution.
Indicators currently listed
No indicator in WhisperGraph currently links to InterServer Webshell MD5 Signatures. That is not the same as the feed being empty — the graph indexes a subset of every feed’s published entries.
Related pages
Pivot from InterServer Webshell MD5 Signatures into the indicators it lists.
Queries
Resolves the feed's categories.
MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categoriesThe indicator-kind rollup and sample listed above.
MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESCOr query Whisper from your own LLM workflow via the Whisper MCP server.