Web shell
A small script left on a compromised web server that turns an ordinary HTTP request into command execution. Often a single file, often named to blend into the application around it, and reachable by anyone who knows the path and the password.
Why it matters to you
It is a door, not a payload, and it usually outlives the vulnerability that installed it. Patching the entry point closes the way in and leaves the way back, so an intrusion that involved one is not over until the filesystem has been compared against a known-good state.
Where we meet it
Access is often resold rather than used, which is why a server can carry one quietly for months before anything happens on it. The gap between installation and use is where the defender's opportunity sits.
Connected terms
Initial Access Broker (IAB)
A specialist who breaks into organizations and sells the access (VPN, RDP, domain admin) instead of using it. The wholesale layer between opportunistic infection and targeted ransomware.
Access listing
The IAB's ad format: industry, country, revenue, access level and price. Everything except the victim's name, which is disclosed to serious buyers in private.
Dedik
A compromised dedicated server or RDP host, rented out as anonymous infrastructure. The underground's cloud computing, billed to someone else.
Where this term stops being vocabulary
Malveine is where you watch it happen to you
Knowing the word is the cheap half. The platform is the half where the term arrives attached to your domain, with a timestamp and the source it came from.
More from the infrastructure
Antidetect browser
A browser built to present a consistent, disposable fingerprint per profile: its own canvas, fonts, timezone and proxy. Sold so a stolen session can be replayed from a machine that looks like the victim's.
Bulletproof hosting
Hosting sold on the promise that abuse complaints go unanswered and legal requests go unread. Priced well above ordinary hosting, because that indifference is the entire product.
C2 panel
The web console an operator uses to run infected machines: victims listed, tasks queued, output collected. Sold with the malware, screenshotted in the advertisement, and often the most revealing artifact a crew produces.
Crypto mixer
A service that pools cryptocurrency from many senders and pays out from the pool, so that the link between an incoming and an outgoing transaction is broken. Charged as a percentage, sometimes with a delay bought separately.