diff --git a/var/www/hosting/archlinexp.eu/www/administrator/cox.json b/var/www/hosting/archlinexp.eu/www/administrator/cox.json
new file mode 100644
index 0000000..35e140e
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/administrator/cox.json
@@ -0,0 +1 @@
+hacked by trenggalek6etar
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/administrator/cox.json.evidence.json b/var/www/hosting/archlinexp.eu/www/administrator/cox.json.evidence.json
new file mode 100644
index 0000000..21ceb10
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/administrator/cox.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5098",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:administrator/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/administrator/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783648994,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "administrator/cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/cache/cox.json b/var/www/hosting/archlinexp.eu/www/cache/cox.json
new file mode 100644
index 0000000..35e140e
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/cox.json
@@ -0,0 +1 @@
+hacked by trenggalek6etar
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/cache/cox.json.evidence.json b/var/www/hosting/archlinexp.eu/www/cache/cox.json.evidence.json
new file mode 100644
index 0000000..1305e36
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/cox.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5021",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:cache/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783265637,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "cache/cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/captain.json b/var/www/hosting/archlinexp.eu/www/captain.json
new file mode 100644
index 0000000..8cdbacb
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/captain.json
@@ -0,0 +1 @@
+Hacked By CaptainSmok3r - t.me/CaptainSmok3r_official
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/captain.json.evidence.json b/var/www/hosting/archlinexp.eu/www/captain.json.evidence.json
new file mode 100644
index 0000000..8ab0e5e
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/captain.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4880",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:captain.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/captain.json)",
+  "original_sha256": "1f43ac8f363075c7926d2ac1a30b8f94df9d913c1e5b68b5da30b5109f4bfc25",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783259268,
+    "size": 53,
+    "uid": 20043
+  },
+  "rel_path": "captain.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/cox.json b/var/www/hosting/archlinexp.eu/www/cox.json
new file mode 100644
index 0000000..35e140e
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cox.json
@@ -0,0 +1 @@
+hacked by trenggalek6etar
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/cox.json.evidence.json b/var/www/hosting/archlinexp.eu/www/cox.json.evidence.json
new file mode 100644
index 0000000..6be0672
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cox.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4863",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783648985,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/cox.json b/var/www/hosting/archlinexp.eu/www/images/cox.json
new file mode 100644
index 0000000..35e140e
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/cox.json
@@ -0,0 +1 @@
+hacked by trenggalek6etar
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/cox.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/cox.json.evidence.json
new file mode 100644
index 0000000..0426c5f
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/cox.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5162",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783648989,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "images/cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/maintht.json b/var/www/hosting/archlinexp.eu/www/maintht.json
new file mode 100644
index 0000000..c1461a6
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/maintht.json
@@ -0,0 +1,92 @@
+<!DOCTYPE html>
+<html lang="tr">
+<head>
+    <meta charset="UTF-8">
+    <title>Hacked By TurkHackTeam</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <style>
+        body {
+            margin: 0; padding: 0;
+            background: black;
+            color: white;
+            font-family: 'Courier New', monospace;
+            overflow: hidden;
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            height: 100vh;
+        }
+
+        .bg {
+            position: fixed;
+            top: 0; left: 0;
+            width: 100%; height: 100%;
+            background: url('https://i.imgur.com/bxgbsAv.jpeg') no-repeat center center/cover;
+            filter: brightness(30%);
+            z-index: -1;
+        }
+
+        .container { text-align: center; z-index: 1; }
+
+        .icon img {
+            width: 200px;
+            margin-bottom: 20px;
+            transition: 0.3s;
+        }
+
+        .icon img:hover { transform: scale(1.1); }
+
+        /* Başlıklar için normal stil */
+        .main-title { font-size: 2.5rem; margin: 10px 0; }
+        .desc { font-size: 1.2rem; color: #cccccc; margin-bottom: 10px; }
+
+        /* Anka Red Team için Kırmızı Glitch Efekti */
+        .anka-red {
+            font-size: 2rem;
+            font-weight: bold;
+            color: #ff0000;
+            text-transform: uppercase;
+            letter-spacing: 3px;
+            position: relative;
+            animation: glitch 1.5s infinite;
+            text-shadow: 2px 2px #000;
+        }
+
+        @keyframes glitch {
+            0% { transform: translate(0); }
+            20% { transform: translate(-2px, 2px); }
+            40% { transform: translate(-2px, -2px); }
+            60% { transform: translate(2px, 2px); }
+            80% { transform: translate(2px, -2px); }
+            100% { transform: translate(0); }
+        }
+    </style>
+</head>
+<body>
+
+    <div class="bg"></div>
+
+    <div class="container">
+        <div class="icon">
+            <a href="https://www.turkhackteam.org/" target="_blank">
+                <img src="https://i.hizliresim.com/nj7exqr.png" alt="TurkHackTeam">
+            </a>
+        </div>
+        <div class="main-title">The site has been hacked by TURKHACKTEAM.</div>
+        <div class="desc">We whenever we want, wherever we want.</div>
+        <div class="anka-red">☪ Anka Red Team ☪</div>
+    </div>
+
+    <audio id="audio" loop>
+        <source src="https://www.meb.gov.tr/istiklalmarsi/assets/audio/istiklalMarsi3.mp3" type="audio/mpeg">
+    </audio>
+
+    <script>
+        window.addEventListener('click', () => {
+            const audio = document.getElementById('audio');
+            audio.play();
+        }, { once: true });
+    </script>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/maintht.json.evidence.json b/var/www/hosting/archlinexp.eu/www/maintht.json.evidence.json
new file mode 100644
index 0000000..8b36e77
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/maintht.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4881",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:maintht.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/maintht.json)",
+  "original_sha256": "e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783519684,
+    "size": 2786,
+    "uid": 20043
+  },
+  "rel_path": "maintht.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/media/cox.json b/var/www/hosting/archlinexp.eu/www/media/cox.json
new file mode 100644
index 0000000..35e140e
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/cox.json
@@ -0,0 +1 @@
+hacked by trenggalek6etar
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/media/cox.json.evidence.json b/var/www/hosting/archlinexp.eu/www/media/cox.json.evidence.json
new file mode 100644
index 0000000..5769d45
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/cox.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4990",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:media/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783648990,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "media/cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/night.html.json b/var/www/hosting/archlinexp.eu/www/night.html.json
new file mode 100644
index 0000000..c1461a6
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/night.html.json
@@ -0,0 +1,92 @@
+<!DOCTYPE html>
+<html lang="tr">
+<head>
+    <meta charset="UTF-8">
+    <title>Hacked By TurkHackTeam</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <style>
+        body {
+            margin: 0; padding: 0;
+            background: black;
+            color: white;
+            font-family: 'Courier New', monospace;
+            overflow: hidden;
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            height: 100vh;
+        }
+
+        .bg {
+            position: fixed;
+            top: 0; left: 0;
+            width: 100%; height: 100%;
+            background: url('https://i.imgur.com/bxgbsAv.jpeg') no-repeat center center/cover;
+            filter: brightness(30%);
+            z-index: -1;
+        }
+
+        .container { text-align: center; z-index: 1; }
+
+        .icon img {
+            width: 200px;
+            margin-bottom: 20px;
+            transition: 0.3s;
+        }
+
+        .icon img:hover { transform: scale(1.1); }
+
+        /* Başlıklar için normal stil */
+        .main-title { font-size: 2.5rem; margin: 10px 0; }
+        .desc { font-size: 1.2rem; color: #cccccc; margin-bottom: 10px; }
+
+        /* Anka Red Team için Kırmızı Glitch Efekti */
+        .anka-red {
+            font-size: 2rem;
+            font-weight: bold;
+            color: #ff0000;
+            text-transform: uppercase;
+            letter-spacing: 3px;
+            position: relative;
+            animation: glitch 1.5s infinite;
+            text-shadow: 2px 2px #000;
+        }
+
+        @keyframes glitch {
+            0% { transform: translate(0); }
+            20% { transform: translate(-2px, 2px); }
+            40% { transform: translate(-2px, -2px); }
+            60% { transform: translate(2px, 2px); }
+            80% { transform: translate(2px, -2px); }
+            100% { transform: translate(0); }
+        }
+    </style>
+</head>
+<body>
+
+    <div class="bg"></div>
+
+    <div class="container">
+        <div class="icon">
+            <a href="https://www.turkhackteam.org/" target="_blank">
+                <img src="https://i.hizliresim.com/nj7exqr.png" alt="TurkHackTeam">
+            </a>
+        </div>
+        <div class="main-title">The site has been hacked by TURKHACKTEAM.</div>
+        <div class="desc">We whenever we want, wherever we want.</div>
+        <div class="anka-red">☪ Anka Red Team ☪</div>
+    </div>
+
+    <audio id="audio" loop>
+        <source src="https://www.meb.gov.tr/istiklalmarsi/assets/audio/istiklalMarsi3.mp3" type="audio/mpeg">
+    </audio>
+
+    <script>
+        window.addEventListener('click', () => {
+            const audio = document.getElementById('audio');
+            audio.play();
+        }, { once: true });
+    </script>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/night.html.json.evidence.json b/var/www/hosting/archlinexp.eu/www/night.html.json.evidence.json
new file mode 100644
index 0000000..a0d6432
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/night.html.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4870",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:night.html.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/night.html.json)",
+  "original_sha256": "e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783518338,
+    "size": 2786,
+    "uid": 20043
+  },
+  "rel_path": "night.html.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/nxproof.php.json b/var/www/hosting/archlinexp.eu/www/nxproof.php.json
new file mode 100644
index 0000000..7477bbe
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/nxproof.php.json
@@ -0,0 +1 @@
+<?php echo "Nxploited-Create"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/nxproof.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/nxproof.php.json.evidence.json
new file mode 100644
index 0000000..56630af
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/nxproof.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4943",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:nxproof.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/nxproof.php.json)",
+  "original_sha256": "03abfd5cc3cec405dfaa3212fa98caa91d6b35de404f09b2f73306a8b168ce07",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784114808,
+    "size": 33,
+    "uid": 20043
+  },
+  "rel_path": "nxproof.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/templates/cox.json b/var/www/hosting/archlinexp.eu/www/templates/cox.json
new file mode 100644
index 0000000..35e140e
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/cox.json
@@ -0,0 +1 @@
+hacked by trenggalek6etar
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/templates/cox.json.evidence.json b/var/www/hosting/archlinexp.eu/www/templates/cox.json.evidence.json
new file mode 100644
index 0000000..887ea68
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/cox.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4951",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783648993,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "templates/cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/templates/night.html.json b/var/www/hosting/archlinexp.eu/www/templates/night.html.json
new file mode 100644
index 0000000..c1461a6
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/night.html.json
@@ -0,0 +1,92 @@
+<!DOCTYPE html>
+<html lang="tr">
+<head>
+    <meta charset="UTF-8">
+    <title>Hacked By TurkHackTeam</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <style>
+        body {
+            margin: 0; padding: 0;
+            background: black;
+            color: white;
+            font-family: 'Courier New', monospace;
+            overflow: hidden;
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            height: 100vh;
+        }
+
+        .bg {
+            position: fixed;
+            top: 0; left: 0;
+            width: 100%; height: 100%;
+            background: url('https://i.imgur.com/bxgbsAv.jpeg') no-repeat center center/cover;
+            filter: brightness(30%);
+            z-index: -1;
+        }
+
+        .container { text-align: center; z-index: 1; }
+
+        .icon img {
+            width: 200px;
+            margin-bottom: 20px;
+            transition: 0.3s;
+        }
+
+        .icon img:hover { transform: scale(1.1); }
+
+        /* Başlıklar için normal stil */
+        .main-title { font-size: 2.5rem; margin: 10px 0; }
+        .desc { font-size: 1.2rem; color: #cccccc; margin-bottom: 10px; }
+
+        /* Anka Red Team için Kırmızı Glitch Efekti */
+        .anka-red {
+            font-size: 2rem;
+            font-weight: bold;
+            color: #ff0000;
+            text-transform: uppercase;
+            letter-spacing: 3px;
+            position: relative;
+            animation: glitch 1.5s infinite;
+            text-shadow: 2px 2px #000;
+        }
+
+        @keyframes glitch {
+            0% { transform: translate(0); }
+            20% { transform: translate(-2px, 2px); }
+            40% { transform: translate(-2px, -2px); }
+            60% { transform: translate(2px, 2px); }
+            80% { transform: translate(2px, -2px); }
+            100% { transform: translate(0); }
+        }
+    </style>
+</head>
+<body>
+
+    <div class="bg"></div>
+
+    <div class="container">
+        <div class="icon">
+            <a href="https://www.turkhackteam.org/" target="_blank">
+                <img src="https://i.hizliresim.com/nj7exqr.png" alt="TurkHackTeam">
+            </a>
+        </div>
+        <div class="main-title">The site has been hacked by TURKHACKTEAM.</div>
+        <div class="desc">We whenever we want, wherever we want.</div>
+        <div class="anka-red">☪ Anka Red Team ☪</div>
+    </div>
+
+    <audio id="audio" loop>
+        <source src="https://www.meb.gov.tr/istiklalmarsi/assets/audio/istiklalMarsi3.mp3" type="audio/mpeg">
+    </audio>
+
+    <script>
+        window.addEventListener('click', () => {
+            const audio = document.getElementById('audio');
+            audio.play();
+        }, { once: true });
+    </script>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/templates/night.html.json.evidence.json b/var/www/hosting/archlinexp.eu/www/templates/night.html.json.evidence.json
new file mode 100644
index 0000000..e44b13a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/night.html.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4953",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/night.html.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/night.html.json)",
+  "original_sha256": "e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783518338,
+    "size": 2786,
+    "uid": 20043
+  },
+  "rel_path": "templates/night.html.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/templates/nxproof.php.json b/var/www/hosting/archlinexp.eu/www/templates/nxproof.php.json
new file mode 100644
index 0000000..7477bbe
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/nxproof.php.json
@@ -0,0 +1 @@
+<?php echo "Nxploited-Create"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/templates/nxproof.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/templates/nxproof.php.json.evidence.json
new file mode 100644
index 0000000..5a136e3
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/nxproof.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4959",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/nxproof.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/nxproof.php.json)",
+  "original_sha256": "03abfd5cc3cec405dfaa3212fa98caa91d6b35de404f09b2f73306a8b168ce07",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784114811,
+    "size": 33,
+    "uid": 20043
+  },
+  "rel_path": "templates/nxproof.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/cox.json b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/cox.json
new file mode 100644
index 0000000..35e140e
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/cox.json
@@ -0,0 +1 @@
+hacked by trenggalek6etar
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/cox.json.evidence.json b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/cox.json.evidence.json
new file mode 100644
index 0000000..9821a8d
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/cox.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4967",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/shaper_helixultimate/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783648992,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "templates/shaper_helixultimate/cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/night.html.json b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/night.html.json
new file mode 100644
index 0000000..c1461a6
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/night.html.json
@@ -0,0 +1,92 @@
+<!DOCTYPE html>
+<html lang="tr">
+<head>
+    <meta charset="UTF-8">
+    <title>Hacked By TurkHackTeam</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <style>
+        body {
+            margin: 0; padding: 0;
+            background: black;
+            color: white;
+            font-family: 'Courier New', monospace;
+            overflow: hidden;
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            height: 100vh;
+        }
+
+        .bg {
+            position: fixed;
+            top: 0; left: 0;
+            width: 100%; height: 100%;
+            background: url('https://i.imgur.com/bxgbsAv.jpeg') no-repeat center center/cover;
+            filter: brightness(30%);
+            z-index: -1;
+        }
+
+        .container { text-align: center; z-index: 1; }
+
+        .icon img {
+            width: 200px;
+            margin-bottom: 20px;
+            transition: 0.3s;
+        }
+
+        .icon img:hover { transform: scale(1.1); }
+
+        /* Başlıklar için normal stil */
+        .main-title { font-size: 2.5rem; margin: 10px 0; }
+        .desc { font-size: 1.2rem; color: #cccccc; margin-bottom: 10px; }
+
+        /* Anka Red Team için Kırmızı Glitch Efekti */
+        .anka-red {
+            font-size: 2rem;
+            font-weight: bold;
+            color: #ff0000;
+            text-transform: uppercase;
+            letter-spacing: 3px;
+            position: relative;
+            animation: glitch 1.5s infinite;
+            text-shadow: 2px 2px #000;
+        }
+
+        @keyframes glitch {
+            0% { transform: translate(0); }
+            20% { transform: translate(-2px, 2px); }
+            40% { transform: translate(-2px, -2px); }
+            60% { transform: translate(2px, 2px); }
+            80% { transform: translate(2px, -2px); }
+            100% { transform: translate(0); }
+        }
+    </style>
+</head>
+<body>
+
+    <div class="bg"></div>
+
+    <div class="container">
+        <div class="icon">
+            <a href="https://www.turkhackteam.org/" target="_blank">
+                <img src="https://i.hizliresim.com/nj7exqr.png" alt="TurkHackTeam">
+            </a>
+        </div>
+        <div class="main-title">The site has been hacked by TURKHACKTEAM.</div>
+        <div class="desc">We whenever we want, wherever we want.</div>
+        <div class="anka-red">☪ Anka Red Team ☪</div>
+    </div>
+
+    <audio id="audio" loop>
+        <source src="https://www.meb.gov.tr/istiklalmarsi/assets/audio/istiklalMarsi3.mp3" type="audio/mpeg">
+    </audio>
+
+    <script>
+        window.addEventListener('click', () => {
+            const audio = document.getElementById('audio');
+            audio.play();
+        }, { once: true });
+    </script>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/night.html.json.evidence.json b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/night.html.json.evidence.json
new file mode 100644
index 0000000..e6b94bd
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/night.html.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4968",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/shaper_helixultimate/night.html.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/night.html.json)",
+  "original_sha256": "e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783518339,
+    "size": 2786,
+    "uid": 20043
+  },
+  "rel_path": "templates/shaper_helixultimate/night.html.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/nxproof.php.json b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/nxproof.php.json
new file mode 100644
index 0000000..7477bbe
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/nxproof.php.json
@@ -0,0 +1 @@
+<?php echo "Nxploited-Create"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/nxproof.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/nxproof.php.json.evidence.json
new file mode 100644
index 0000000..1d7be40
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/nxproof.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4973",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/shaper_helixultimate/nxproof.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/nxproof.php.json)",
+  "original_sha256": "03abfd5cc3cec405dfaa3212fa98caa91d6b35de404f09b2f73306a8b168ce07",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784114812,
+    "size": 33,
+    "uid": 20043
+  },
+  "rel_path": "templates/shaper_helixultimate/nxproof.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/templates/system/links.db b/var/www/hosting/archlinexp.eu/www/templates/system/links.db
new file mode 100644
index 0000000..8eb5403
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/system/links.db
@@ -0,0 +1,166 @@
+a:35:{s:18:"__sape_delimiter__";s:2:". ";s:16:"__sape_teasers__";a:0:{}s:12:"__for_user__";s:32:"04467c8a028c7ca6bdd5a9edca72cd00";s:12:"__for_host__";s:20:"http://archlinexp.eu";s:31:"__sape_page_obligatory_output__";s:290:"<script type="text/javascript">
+<!--
+var _acic={dataProvider:10};(function(){var e=document.createElement("script");e.type="text/javascript";e.async=true;e.src="https://www.acint.net/aci.js";var t=document.getElementsByTagName("script")[0];t.parentNode.insertBefore(e,t)})()
+//-->
+</script>";s:27:"__sape_teaser_images_path__";s:8:"img.php?";s:64:"/produktuebersicht/blog/21-plaene-eines-wohnparks-in-keszthely-2";a:1:{i:0;s:93:" <a href="http://topbox.de/" target="_blank">Lagercontainer mieten alt-hamborn duisburg</a>. ";}s:65:"/produktuebersicht/blog/21-plaene-eines-wohnparks-in-keszthely-2/";a:1:{i:0;s:93:" <a href="http://topbox.de/" target="_blank">Lagercontainer mieten alt-hamborn duisburg</a>. ";}s:4:"/buy";a:1:{i:0;s:192:" What are the <a href="https://telegra.ph/Some-secrets-of-online-slots-machines---PlayFortuneforfun-10-29" target="_blank">secrets of slot machines</a> that only the casinos or creators know? ";}s:5:"/buy/";a:1:{i:0;s:192:" What are the <a href="https://telegra.ph/Some-secrets-of-online-slots-machines---PlayFortuneforfun-10-29" target="_blank">secrets of slot machines</a> that only the casinos or creators know? ";}s:31:"/produktuebersicht/blog?start=5";a:1:{i:0;s:141:" Watch online free <a href="https://www.kapanlagi.com/film/internasional/1911-revolusi-besar.html" target="_blank">1911 film</a> in HD 1080. ";}s:32:"/produktuebersicht/blog?start=5/";a:1:{i:0;s:141:" Watch online free <a href="https://www.kapanlagi.com/film/internasional/1911-revolusi-besar.html" target="_blank">1911 film</a> in HD 1080. ";}s:32:"/produktuebersicht/blog/23-villa";a:1:{i:0;s:175:" Watch online free <a href="https://www.spectacularoptical.ca/2012/01/celebrate-the-year-of-the-dragon-with-jackie-chan%E2%80%99s-1911/" target="_blank">1911 movie</a> in HD. ";}s:33:"/produktuebersicht/blog/23-villa/";a:1:{i:0;s:175:" Watch online free <a href="https://www.spectacularoptical.ca/2012/01/celebrate-the-year-of-the-dragon-with-jackie-chan%E2%80%99s-1911/" target="_blank">1911 movie</a> in HD. ";}s:55:"/produktuebersicht/blog/34-archline-xp-einfach-loslegen";a:1:{i:0;s:101:" <a href="https://www.custream.com/poker-hud" target="_blank">https://www.custream.com/poker-hud</a> ";}s:56:"/produktuebersicht/blog/34-archline-xp-einfach-loslegen/";a:1:{i:0;s:101:" <a href="https://www.custream.com/poker-hud" target="_blank">https://www.custream.com/poker-hud</a> ";}s:15:"/privacy-policy";a:1:{i:0;s:147:" <a href="https://medium.com/@PeterDruker/top-10-accounting-homework-help-sites-894724045184" target="_blank">best 10 accounting homework help</a> ";}s:16:"/privacy-policy/";a:1:{i:0;s:147:" <a href="https://medium.com/@PeterDruker/top-10-accounting-homework-help-sites-894724045184" target="_blank">best 10 accounting homework help</a> ";}s:1:"/";a:1:{i:0;s:92:" <a href="https://ladys.one/singapore" target="_blank">sg escort</a> according to an escort ";}s:77:"/produktuebersicht/blog/30-ferienhaus-auf-patmos-archilab-studio-griechenland";a:1:{i:0;s:61:" <a href="http://bbbc19.com/" target="_blank">bbbc19.com</a> ";}s:78:"/produktuebersicht/blog/30-ferienhaus-auf-patmos-archilab-studio-griechenland/";a:1:{i:0;s:61:" <a href="http://bbbc19.com/" target="_blank">bbbc19.com</a> ";}s:24:"__sape_show_only_block__";b:0;s:18:"__sape_block_tpl__";a:3:{s:3:"css";s:2156:"<style type='text/css'> .block_links * { background:transparent none repeat scroll 0 0 !important; border:medium none !important; clear:none !important; clip:rect(auto, auto, auto, auto) !important; font-size:100% !important; font-style:normal !important; font-variant:normal !important; font-weight:normal !important; height:auto !important; letter-spacing:normal !important; line-height:normal !important; margin:0 !important; overflow:visible !important; padding:0 !important; position:static !important; text-align:left !important; text-decoration:none !important; text-indent:0 !important; text-transform:none !important; vertical-align:baseline !important; visibility:visible !important; white-space:normal !important; width:auto; word-spacing:normal !important; z-index:auto !important; cursor: pointer!important; word-wrap: break-word!important; } .block_links li { display:list-item !important; list-style-image:none !important; list-style-position:outside !important; list-style-type:none !important; display: inline; } .block_links li DIV { padding:0.5em !important; } .block_links DIV, .block_links TABLE { padding: 5px !important; } .block_links { width: auto!important; font-family: Verdana!important; font-size: 11px!important; border: 1px solid #DDDDDD!important; background-color: #FFFFFF!important; padding:5px!important; position: relative!important; display:block!important; } .block_links_icnt, .block_links_icnt * { text-align: left!important; } .block_links_text, .block_links_text A, .block_links_text A:hover { color: #000000!important; font-size: 11px!important; text-decoration: none!important; } .block_links_url { color: #006600!important; font-size: 11px!important; text-decoration: none!important; } .block_links_header, .block_links_header A { color: #000066!important; font-size: 13px!important; font-weight: bold!important; text-decoration: underline!important; } .block_links_sign { color: #999999!important; font-size: 10px!important; text-align: left!important; text-decoration: none!important; } .block_links_clear { clear:both!important; } .block_links TABLE { width: 100%!important; border: 0px!important; } </style>";i:1;a:3:{s:5:"block";s:88:"<div class='block_links' {block_style_custom}> <table> <tr> {items} </tr> </table></div>";s:14:"item_container";s:68:"<td class='block_links_icnt' style='width:{td_width}%'> {item} </td>";s:4:"item";s:209:"<span onclick='window.open(&#39;{link}&#39;, &#39;_blank&#39;); return false;'><p class='block_links_header'> {header} </p> <p class='block_links_text'> {text} </p><p class='block_links_url'> {url} </p></span>";}i:0;a:3:{s:5:"block";s:71:"<div class='block_links' {block_style_custom}> <ul> {items} </ul></div>";s:14:"item_container";s:54:"<li class='block_links_icnt' ><div> {item} </div></li>";s:4:"item";s:209:"<span onclick='window.open(&#39;{link}&#39;, &#39;_blank&#39;); return false;'><p class='block_links_header'> {header} </p> <p class='block_links_text'> {text} </p><p class='block_links_url'> {url} </p></span>";}}s:26:"__sape_block_tpl_options__";a:2:{s:17:"block_orientation";i:1;s:12:"block_no_css";i:0;}s:23:"__sape_block_uri_idna__";a:0:{}s:20:"__sape_teasers_css__";s:5363:"<style type="text/css">
+    .teaser_block * {
+        margin: 0;
+        padding: 0;
+        cursor: pointer;
+        background: transparent none repeat scroll 0 0;
+        clear: none;
+        clip: rect(auto, auto, auto, auto);
+        font-size: 100%;
+        font-style: normal;
+        font-variant: normal;
+        font-weight: normal;
+        height: auto;
+        letter-spacing: normal;
+        position: static;
+        text-align: left;
+        text-indent: 0;
+        text-transform: none;
+        vertical-align: baseline;
+        visibility: visible;
+        white-space: normal;
+        width: auto;
+        word-spacing: normal;
+        z-index: auto;
+        word-wrap: break-word;
+    }
+    .teaser_block {
+        overflow: hidden;
+        border: 1px solid #c0c0c0;
+        background-color: #ffffff;
+        box-sizing: border-box;
+        -moz-box-sizing: border-box;
+        -webkit-box-sizing: border-box;
+        border-radius: 0px;
+        -webkit-border-radius: 0px;
+        -moz-border-radius: 0px;
+    }
+    .teaser_block .teaser_list {
+        white-space: nowrap !important;
+        font-size: 0 !important;
+    }
+    .teaser_block .teaser_item {
+        white-space: normal !important;
+        font-size: 14px !important;
+        height: 100% !important;
+        box-sizing: border-box !important;
+        -moz-box-sizing: border-box !important;
+        -webkit-box-sizing: border-box !important;
+        position: relative !important;
+    }
+    .teaser_block .teaser_item:hover {
+        background-color: #fcfbf7 !important;
+    }
+    .teaser_block .teaser_item:hover .teaser_item_block a {
+        color: #ff0000 !important;
+        text-decoration: none !important;
+    }
+    .teaser_block .teaser_item_block {
+        color: #000000 !important;
+        font-family: Arial, Helvetica, Tahoma, Verdana, Sans-Serif !important;
+        font-size: 14px !important;
+        text-align: left !important;
+        line-height: 130% !important;
+        height: 100% !important;
+        box-sizing: border-box !important;
+        -moz-box-sizing: border-box !important;
+        -webkit-box-sizing: border-box !important;
+    }
+    .teaser_block .teaser_item_block img {
+        width: 80px !important;
+        border: 0 !important;
+        position: absolute !important;
+        padding: 3px !important;
+        box-sizing: border-box !important;
+        -moz-box-sizing: border-box !important;
+        -webkit-box-sizing: border-box !important;
+        top: 0 !important;
+        left: 5px !important;
+        margin: auto !important;
+        height: 100% !important;
+        max-height: 80px !important;
+    }
+    .teaser_block .teaser_item_block a {
+        color: #0645ad !important;
+        text-decoration: underline !important;
+    }
+    .teaser_block .teaser_item_block a:hover {
+        color: #ff0000 !important;
+    }
+    .teaser_block .teaser_list_small  .teaser_item_block {
+        padding: 2px 2px 2px 70px !important;
+        font-size: 11px !important;
+        line-height: 110% !important;
+    }
+    .teaser_block .teaser_list_small .teaser_item_block img {
+        width: auto !important;
+        max-width: 80px !important;
+    }
+    .teaser_block .teaser_list_hor {
+        height: 100% !important;
+    }
+    .teaser_block .teaser_list_hor > .teaser_item {
+        display: inline-block !important;
+        width: 50% !important;
+        float: left !important;
+        margin: 0 !important;
+    }
+    .teaser_block .teaser_list_hor > .teaser_item:before {
+        content: none !important;
+    }
+    .teaser_block .teaser_list_hor > .teaser_item:after {
+        content: none !important;
+    }
+    .teaser_block .teaser_list_hor .teaser_item_block, .teaser_block .teaser_list_square .teaser_item_block {
+        padding: 5px 5px 5px 90px !important;
+    }
+    .teaser_block .teaser_list_hor .teaser_item_block img, .teaser_block .teaser_list_square .teaser_item_block img {
+        bottom: 0 !important;
+    }
+    .teaser_block .teaser_list_hor > .teaser_item:last-child {
+        border-left: 1px dotted silver !important;
+    }
+    .teaser_block .teaser_list_ver > .teaser_item:before {
+        content: none !important;
+    }
+    .teaser_block .teaser_list_ver > .teaser_item:after {
+        content: none !important;
+    }
+    .teaser_block .teaser_list_square, .teaser_list_ver {
+        height: 50% !important;
+    }
+    .teaser_block .teaser_list_square > .teaser_item:last-child, .teaser_block .teaser_list_ver > .teaser_item:last-child {
+        border-top: 1px dotted silver !important;
+    }
+    .teaser_block .teaser_list_ver .teaser_item_block {
+        padding: 100px 10px 10px 10px !important;
+    }
+    .teaser_block .teaser_list_ver .teaser_item_block img {
+        top: 10px !important;
+        right: 0 !important;
+    }
+    .teaser_block.teaser_block_240x400 {
+        width: 240px !important;
+        height: 400px !important;
+    }
+    .teaser_block.teaser_block_728x90 {
+        width: 728px !important;
+        height: 90px !important;
+    }
+    .teaser_block.teaser_block_300x250 {
+        width: 300px !important;
+        height: 250px !important;
+    }
+    .teaser_block.teaser_block_468x60 {
+        width: 468px !important;
+        height: 60px !important;
+    }
+    .teaser_block.teaser_block_160x600 {
+        width: 160px !important;
+        height: 600px !important;
+    }
+</style>";s:16:"__sape_new_url__";s:20:"<!--2385986230500-->";s:26:"__sape_new_teasers_block__";s:21:"<!--t2385986230500-->";s:16:"__sape_charset__";s:5:"utf-8";s:15:"__last_update__";i:1652191060;s:14:"__multi_site__";b:0;s:21:"__fetch_remote_type__";s:17:"file_get_contents";s:15:"__ignore_case__";b:0;s:15:"__php_version__";s:38:"5.6.40-57+ubuntu18.04.1+deb.sury.org+1";s:19:"__server_software__";s:22:"Apache/2.4.53 (Ubuntu)";}
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/templates/system/links.db.evidence.json b/var/www/hosting/archlinexp.eu/www/templates/system/links.db.evidence.json
new file mode 100644
index 0000000..18983f5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/system/links.db.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4960",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/system/links.db -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/system/links.db)",
+  "original_sha256": "5bade5d7cd10376ddaf7992d905e39cb055a14210ddeb76116b230974ad6d3be",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1652191060,
+    "size": 12495,
+    "uid": 20043
+  },
+  "rel_path": "templates/system/links.db",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/cox.json b/var/www/hosting/archlinexp.eu/www/tmp/cox.json
new file mode 100644
index 0000000..35e140e
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/cox.json
@@ -0,0 +1 @@
+hacked by trenggalek6etar
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/cox.json.evidence.json b/var/www/hosting/archlinexp.eu/www/tmp/cox.json.evidence.json
new file mode 100644
index 0000000..59d4c98
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/cox.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5222",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:tmp/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783648991,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "tmp/cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/x9txt.json b/var/www/hosting/archlinexp.eu/www/x9txt.json
new file mode 100644
index 0000000..c73a7fd
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/x9txt.json
@@ -0,0 +1,4 @@
+<html><head><title>Hacked By X9</title></head><body>
+<h1 style="color:red;">Hacked By X9</h1>
+<p>HCCTEAM.org | t.me/ExpSX9</p>
+</body></html>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/x9txt.json.evidence.json b/var/www/hosting/archlinexp.eu/www/x9txt.json.evidence.json
new file mode 100644
index 0000000..2e0200c
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/x9txt.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4871",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:x9txt.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/x9txt.json)",
+  "original_sha256": "35a68c9a692d1d2fc59a7a6e9f4d686c97ec377515e1928af21a982a34e96d7b",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783286480,
+    "size": 141,
+    "uid": 20043
+  },
+  "rel_path": "x9txt.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}