Regex Tester & Validator

Detects a specific PHP webshell or backdoor that may be disguised as a GIF image (GIF89 header). The pattern matches malicious code containing multiple suspicious PHP includes (visitor_log.php, netcraft_check.php, blacklist_lookup.php, ip_range_check.php) and a shortened URL (tiny.cc/2ueqrz) likely used for command-and-control communication. Commonly used in security scanning and intrusion detection systems to identify this particular malware family.