From brokenpoet.org wiki

find /home/*/public_html -type f -print0 | xargs -0 egrep '(\/tmp\/cmdtemp|SnIpEr_SA|Bhlynx|x2300|c99shell|r57shell|milw0rm|g00nshell)' | cut -d ':' -f1 | sort | uniq >> shellcheck.txt