cadline_web/malware_remediation
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: cadline_web:367eacf1f851886061dfb70f5cdd906ecce327a1
Branches Tags
cadline_web:main
cadline_web:store-cleanup-fp
...
compare: cadline_web:37612af714098cd37ddf8938256416ae675cd54d
Branches Tags
cadline_web:main
cadline_web:store-cleanup-fp

2 Commits
367eacf1f8 ... 37612af714

Author SHA1 Message Date
imrcli-remediator
37612af714 run-log: 20260718T155031Z (22 operation) 2026-07-18 17:50:31 +02:00
imrcli-remediator
87bb321a40 quarantine: family=defacement-seo (18 fájl) 
vhost: www.archlinexp.eu
rel_path: administrator/cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 5098

vhost: www.archlinexp.eu
rel_path: cache/cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 5021

vhost: www.archlinexp.eu
rel_path: captain.json
result: quarantined
evidence_sha256: 1f43ac8f363075c7926d2ac1a30b8f94df9d913c1e5b68b5da30b5109f4bfc25
timestamp: 20260718T155031Z
finding_ref: 4880

vhost: www.archlinexp.eu
rel_path: cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 4863

vhost: www.archlinexp.eu
rel_path: images/cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 5162

vhost: www.archlinexp.eu
rel_path: maintht.json
result: quarantined
evidence_sha256: e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc
timestamp: 20260718T155031Z
finding_ref: 4881

vhost: www.archlinexp.eu
rel_path: media/cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 4990

vhost: www.archlinexp.eu
rel_path: night.html.json
result: quarantined
evidence_sha256: e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc
timestamp: 20260718T155031Z
finding_ref: 4870

vhost: www.archlinexp.eu
rel_path: nxproof.php.json
result: quarantined
evidence_sha256: 03abfd5cc3cec405dfaa3212fa98caa91d6b35de404f09b2f73306a8b168ce07
timestamp: 20260718T155031Z
finding_ref: 4943

vhost: www.archlinexp.eu
rel_path: templates/cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 4951

vhost: www.archlinexp.eu
rel_path: templates/night.html.json
result: quarantined
evidence_sha256: e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc
timestamp: 20260718T155031Z
finding_ref: 4953

vhost: www.archlinexp.eu
rel_path: templates/nxproof.php.json
result: quarantined
evidence_sha256: 03abfd5cc3cec405dfaa3212fa98caa91d6b35de404f09b2f73306a8b168ce07
timestamp: 20260718T155031Z
finding_ref: 4959

vhost: www.archlinexp.eu
rel_path: templates/shaper_helixultimate/cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 4967

vhost: www.archlinexp.eu
rel_path: templates/shaper_helixultimate/night.html.json
result: quarantined
evidence_sha256: e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc
timestamp: 20260718T155031Z
finding_ref: 4968

vhost: www.archlinexp.eu
rel_path: templates/shaper_helixultimate/nxproof.php.json
result: quarantined
evidence_sha256: 03abfd5cc3cec405dfaa3212fa98caa91d6b35de404f09b2f73306a8b168ce07
timestamp: 20260718T155031Z
finding_ref: 4973

vhost: www.archlinexp.eu
rel_path: templates/system/links.db
result: quarantined
evidence_sha256: 5bade5d7cd10376ddaf7992d905e39cb055a14210ddeb76116b230974ad6d3be
timestamp: 20260718T155031Z
finding_ref: 4960

vhost: www.archlinexp.eu
rel_path: tmp/cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 5222

vhost: www.archlinexp.eu
rel_path: x9txt.json
result: quarantined
evidence_sha256: 35a68c9a692d1d2fc59a7a6e9f4d686c97ec377515e1928af21a982a34e96d7b
timestamp: 20260718T155031Z
finding_ref: 4871
 2026-07-18 17:50:31 +02:00
37 changed files with 2423 additions and 0 deletions
Show Stats Expand all files Collapse all files

1603
logs/20260718T155031Z.log Normal file
View File

File diff suppressed because it is too large Load Diff

1
var/www/hosting/archlinexp.eu/www/administrator/cox.json Normal file
View File

@ -0,0 +1 @@
hacked by trenggalek6etar

15
var/www/hosting/archlinexp.eu/www/administrator/cox.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "5098",
"log_excerpt": "[quarantine] www.archlinexp.eu:administrator/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/administrator/cox.json)",
"original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
"original_stat": {
"gid": 30037,
"mtime": 1783648994,
"size": 25,
"uid": 20043
},
"rel_path": "administrator/cox.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

1
var/www/hosting/archlinexp.eu/www/cache/cox.json vendored Normal file
View File

@ -0,0 +1 @@
hacked by trenggalek6etar

15
var/www/hosting/archlinexp.eu/www/cache/cox.json.evidence.json vendored Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "5021",
"log_excerpt": "[quarantine] www.archlinexp.eu:cache/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/cox.json)",
"original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
"original_stat": {
"gid": 30037,
"mtime": 1783265637,
"size": 25,
"uid": 20043
},
"rel_path": "cache/cox.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

1
var/www/hosting/archlinexp.eu/www/captain.json Normal file
View File

@ -0,0 +1 @@
Hacked By CaptainSmok3r - t.me/CaptainSmok3r_official

15
var/www/hosting/archlinexp.eu/www/captain.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "4880",
"log_excerpt": "[quarantine] www.archlinexp.eu:captain.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/captain.json)",
"original_sha256": "1f43ac8f363075c7926d2ac1a30b8f94df9d913c1e5b68b5da30b5109f4bfc25",
"original_stat": {
"gid": 30037,
"mtime": 1783259268,
"size": 53,
"uid": 20043
},
"rel_path": "captain.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

1
var/www/hosting/archlinexp.eu/www/cox.json Normal file
View File

@ -0,0 +1 @@
hacked by trenggalek6etar

15
var/www/hosting/archlinexp.eu/www/cox.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "4863",
"log_excerpt": "[quarantine] www.archlinexp.eu:cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cox.json)",
"original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
"original_stat": {
"gid": 30037,
"mtime": 1783648985,
"size": 25,
"uid": 20043
},
"rel_path": "cox.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

1
var/www/hosting/archlinexp.eu/www/images/cox.json Normal file
View File

@ -0,0 +1 @@
hacked by trenggalek6etar

15
var/www/hosting/archlinexp.eu/www/images/cox.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "5162",
"log_excerpt": "[quarantine] www.archlinexp.eu:images/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/cox.json)",
"original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
"original_stat": {
"gid": 30037,
"mtime": 1783648989,
"size": 25,
"uid": 20043
},
"rel_path": "images/cox.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

92
var/www/hosting/archlinexp.eu/www/maintht.json Normal file
View File

@ -0,0 +1,92 @@
<!DOCTYPE html>
<html lang="tr">
<head>
<meta charset="UTF-8">
<title>Hacked By TurkHackTeam</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<style>
body {
margin: 0; padding: 0;
background: black;
color: white;
font-family: 'Courier New', monospace;
overflow: hidden;
display: flex;
justify-content: center;
align-items: center;
height: 100vh;
}
.bg {
position: fixed;
top: 0; left: 0;
width: 100%; height: 100%;
background: url('https://i.imgur.com/bxgbsAv.jpeg') no-repeat center center/cover;
filter: brightness(30%);
z-index: -1;
}
.container { text-align: center; z-index: 1; }
.icon img {
width: 200px;
margin-bottom: 20px;
transition: 0.3s;
}
.icon img:hover { transform: scale(1.1); }
/* Başlıklar için normal stil */
.main-title { font-size: 2.5rem; margin: 10px 0; }
.desc { font-size: 1.2rem; color: #cccccc; margin-bottom: 10px; }
/* Anka Red Team için Kırmızı Glitch Efekti */
.anka-red {
font-size: 2rem;
font-weight: bold;
color: #ff0000;
text-transform: uppercase;
letter-spacing: 3px;
position: relative;
animation: glitch 1.5s infinite;
text-shadow: 2px 2px #000;
}
@keyframes glitch {
0% { transform: translate(0); }
20% { transform: translate(-2px, 2px); }
40% { transform: translate(-2px, -2px); }
60% { transform: translate(2px, 2px); }
80% { transform: translate(2px, -2px); }
100% { transform: translate(0); }
}
</style>
</head>
<body>
<div class="bg"></div>
<div class="container">
<div class="icon">
<a href="https://www.turkhackteam.org/" target="_blank">
<img src="https://i.hizliresim.com/nj7exqr.png" alt="TurkHackTeam">
</a>
</div>
<div class="main-title">The site has been hacked by TURKHACKTEAM.</div>
<div class="desc">We whenever we want, wherever we want.</div>
<div class="anka-red">☪ Anka Red Team ☪</div>
</div>
<audio id="audio" loop>
<source src="https://www.meb.gov.tr/istiklalmarsi/assets/audio/istiklalMarsi3.mp3" type="audio/mpeg">
</audio>
<script>
window.addEventListener('click', () => {
const audio = document.getElementById('audio');
audio.play();
}, { once: true });
</script>
</body>
</html>

15
var/www/hosting/archlinexp.eu/www/maintht.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "4881",
"log_excerpt": "[quarantine] www.archlinexp.eu:maintht.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/maintht.json)",
"original_sha256": "e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc",
"original_stat": {
"gid": 30037,
"mtime": 1783519684,
"size": 2786,
"uid": 20043
},
"rel_path": "maintht.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

1
var/www/hosting/archlinexp.eu/www/media/cox.json Normal file
View File

@ -0,0 +1 @@
hacked by trenggalek6etar

15
var/www/hosting/archlinexp.eu/www/media/cox.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "4990",
"log_excerpt": "[quarantine] www.archlinexp.eu:media/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/cox.json)",
"original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
"original_stat": {
"gid": 30037,
"mtime": 1783648990,
"size": 25,
"uid": 20043
},
"rel_path": "media/cox.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

92
var/www/hosting/archlinexp.eu/www/night.html.json Normal file
View File

@ -0,0 +1,92 @@
<!DOCTYPE html>
<html lang="tr">
<head>
<meta charset="UTF-8">
<title>Hacked By TurkHackTeam</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<style>
body {
margin: 0; padding: 0;
background: black;
color: white;
font-family: 'Courier New', monospace;
overflow: hidden;
display: flex;
justify-content: center;
align-items: center;
height: 100vh;
}
.bg {
position: fixed;
top: 0; left: 0;
width: 100%; height: 100%;
background: url('https://i.imgur.com/bxgbsAv.jpeg') no-repeat center center/cover;
filter: brightness(30%);
z-index: -1;
}
.container { text-align: center; z-index: 1; }
.icon img {
width: 200px;
margin-bottom: 20px;
transition: 0.3s;
}
.icon img:hover { transform: scale(1.1); }
/* Başlıklar için normal stil */
.main-title { font-size: 2.5rem; margin: 10px 0; }
.desc { font-size: 1.2rem; color: #cccccc; margin-bottom: 10px; }
/* Anka Red Team için Kırmızı Glitch Efekti */
.anka-red {
font-size: 2rem;
font-weight: bold;
color: #ff0000;
text-transform: uppercase;
letter-spacing: 3px;
position: relative;
animation: glitch 1.5s infinite;
text-shadow: 2px 2px #000;
}
@keyframes glitch {
0% { transform: translate(0); }
20% { transform: translate(-2px, 2px); }
40% { transform: translate(-2px, -2px); }
60% { transform: translate(2px, 2px); }
80% { transform: translate(2px, -2px); }
100% { transform: translate(0); }
}
</style>
</head>
<body>
<div class="bg"></div>
<div class="container">
<div class="icon">
<a href="https://www.turkhackteam.org/" target="_blank">
<img src="https://i.hizliresim.com/nj7exqr.png" alt="TurkHackTeam">
</a>
</div>
<div class="main-title">The site has been hacked by TURKHACKTEAM.</div>
<div class="desc">We whenever we want, wherever we want.</div>
<div class="anka-red">☪ Anka Red Team ☪</div>
</div>
<audio id="audio" loop>
<source src="https://www.meb.gov.tr/istiklalmarsi/assets/audio/istiklalMarsi3.mp3" type="audio/mpeg">
</audio>
<script>
window.addEventListener('click', () => {
const audio = document.getElementById('audio');
audio.play();
}, { once: true });
</script>
</body>
</html>

15
var/www/hosting/archlinexp.eu/www/night.html.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "4870",
"log_excerpt": "[quarantine] www.archlinexp.eu:night.html.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/night.html.json)",
"original_sha256": "e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc",
"original_stat": {
"gid": 30037,
"mtime": 1783518338,
"size": 2786,
"uid": 20043
},
"rel_path": "night.html.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

1
var/www/hosting/archlinexp.eu/www/nxproof.php.json Normal file
View File

@ -0,0 +1 @@
<?php echo "Nxploited-Create"; ?>

15
var/www/hosting/archlinexp.eu/www/nxproof.php.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "4943",
"log_excerpt": "[quarantine] www.archlinexp.eu:nxproof.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/nxproof.php.json)",
"original_sha256": "03abfd5cc3cec405dfaa3212fa98caa91d6b35de404f09b2f73306a8b168ce07",
"original_stat": {
"gid": 30037,
"mtime": 1784114808,
"size": 33,
"uid": 20043
},
"rel_path": "nxproof.php.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

1
var/www/hosting/archlinexp.eu/www/templates/cox.json Normal file
View File

@ -0,0 +1 @@
hacked by trenggalek6etar

15
var/www/hosting/archlinexp.eu/www/templates/cox.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "4951",
"log_excerpt": "[quarantine] www.archlinexp.eu:templates/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/cox.json)",
"original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
"original_stat": {
"gid": 30037,
"mtime": 1783648993,
"size": 25,
"uid": 20043
},
"rel_path": "templates/cox.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

92
var/www/hosting/archlinexp.eu/www/templates/night.html.json Normal file
View File

@ -0,0 +1,92 @@
<!DOCTYPE html>
<html lang="tr">
<head>
<meta charset="UTF-8">
<title>Hacked By TurkHackTeam</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<style>
body {
margin: 0; padding: 0;
background: black;
color: white;
font-family: 'Courier New', monospace;
overflow: hidden;
display: flex;
justify-content: center;
align-items: center;
height: 100vh;
}
.bg {
position: fixed;
top: 0; left: 0;
width: 100%; height: 100%;
background: url('https://i.imgur.com/bxgbsAv.jpeg') no-repeat center center/cover;
filter: brightness(30%);
z-index: -1;
}
.container { text-align: center; z-index: 1; }
.icon img {
width: 200px;
margin-bottom: 20px;
transition: 0.3s;
}
.icon img:hover { transform: scale(1.1); }
/* Başlıklar için normal stil */
.main-title { font-size: 2.5rem; margin: 10px 0; }
.desc { font-size: 1.2rem; color: #cccccc; margin-bottom: 10px; }
/* Anka Red Team için Kırmızı Glitch Efekti */
.anka-red {
font-size: 2rem;
font-weight: bold;
color: #ff0000;
text-transform: uppercase;
letter-spacing: 3px;
position: relative;
animation: glitch 1.5s infinite;
text-shadow: 2px 2px #000;
}
@keyframes glitch {
0% { transform: translate(0); }
20% { transform: translate(-2px, 2px); }
40% { transform: translate(-2px, -2px); }
60% { transform: translate(2px, 2px); }
80% { transform: translate(2px, -2px); }
100% { transform: translate(0); }
}
</style>
</head>
<body>
<div class="bg"></div>
<div class="container">
<div class="icon">
<a href="https://www.turkhackteam.org/" target="_blank">
<img src="https://i.hizliresim.com/nj7exqr.png" alt="TurkHackTeam">
</a>
</div>
<div class="main-title">The site has been hacked by TURKHACKTEAM.</div>
<div class="desc">We whenever we want, wherever we want.</div>
<div class="anka-red">☪ Anka Red Team ☪</div>
</div>
<audio id="audio" loop>
<source src="https://www.meb.gov.tr/istiklalmarsi/assets/audio/istiklalMarsi3.mp3" type="audio/mpeg">
</audio>
<script>
window.addEventListener('click', () => {
const audio = document.getElementById('audio');
audio.play();
}, { once: true });
</script>
</body>
</html>

15
var/www/hosting/archlinexp.eu/www/templates/night.html.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "4953",
"log_excerpt": "[quarantine] www.archlinexp.eu:templates/night.html.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/night.html.json)",
"original_sha256": "e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc",
"original_stat": {
"gid": 30037,
"mtime": 1783518338,
"size": 2786,
"uid": 20043
},
"rel_path": "templates/night.html.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

1
var/www/hosting/archlinexp.eu/www/templates/nxproof.php.json Normal file
View File

@ -0,0 +1 @@
<?php echo "Nxploited-Create"; ?>

15
var/www/hosting/archlinexp.eu/www/templates/nxproof.php.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "4959",
"log_excerpt": "[quarantine] www.archlinexp.eu:templates/nxproof.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/nxproof.php.json)",
"original_sha256": "03abfd5cc3cec405dfaa3212fa98caa91d6b35de404f09b2f73306a8b168ce07",
"original_stat": {
"gid": 30037,
"mtime": 1784114811,
"size": 33,
"uid": 20043
},
"rel_path": "templates/nxproof.php.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

1
var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/cox.json Normal file
View File

@ -0,0 +1 @@
hacked by trenggalek6etar

15
var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/cox.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "4967",
"log_excerpt": "[quarantine] www.archlinexp.eu:templates/shaper_helixultimate/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/cox.json)",
"original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
"original_stat": {
"gid": 30037,
"mtime": 1783648992,
"size": 25,
"uid": 20043
},
"rel_path": "templates/shaper_helixultimate/cox.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

92
var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/night.html.json Normal file
View File

@ -0,0 +1,92 @@
<!DOCTYPE html>
<html lang="tr">
<head>
<meta charset="UTF-8">
<title>Hacked By TurkHackTeam</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<style>
body {
margin: 0; padding: 0;
background: black;
color: white;
font-family: 'Courier New', monospace;
overflow: hidden;
display: flex;
justify-content: center;
align-items: center;
height: 100vh;
}
.bg {
position: fixed;
top: 0; left: 0;
width: 100%; height: 100%;
background: url('https://i.imgur.com/bxgbsAv.jpeg') no-repeat center center/cover;
filter: brightness(30%);
z-index: -1;
}
.container { text-align: center; z-index: 1; }
.icon img {
width: 200px;
margin-bottom: 20px;
transition: 0.3s;
}
.icon img:hover { transform: scale(1.1); }
/* Başlıklar için normal stil */
.main-title { font-size: 2.5rem; margin: 10px 0; }
.desc { font-size: 1.2rem; color: #cccccc; margin-bottom: 10px; }
/* Anka Red Team için Kırmızı Glitch Efekti */
.anka-red {
font-size: 2rem;
font-weight: bold;
color: #ff0000;
text-transform: uppercase;
letter-spacing: 3px;
position: relative;
animation: glitch 1.5s infinite;
text-shadow: 2px 2px #000;
}
@keyframes glitch {
0% { transform: translate(0); }
20% { transform: translate(-2px, 2px); }
40% { transform: translate(-2px, -2px); }
60% { transform: translate(2px, 2px); }
80% { transform: translate(2px, -2px); }
100% { transform: translate(0); }
}
</style>
</head>
<body>
<div class="bg"></div>
<div class="container">
<div class="icon">
<a href="https://www.turkhackteam.org/" target="_blank">
<img src="https://i.hizliresim.com/nj7exqr.png" alt="TurkHackTeam">
</a>
</div>
<div class="main-title">The site has been hacked by TURKHACKTEAM.</div>
<div class="desc">We whenever we want, wherever we want.</div>
<div class="anka-red">☪ Anka Red Team ☪</div>
</div>
<audio id="audio" loop>
<source src="https://www.meb.gov.tr/istiklalmarsi/assets/audio/istiklalMarsi3.mp3" type="audio/mpeg">
</audio>
<script>
window.addEventListener('click', () => {
const audio = document.getElementById('audio');
audio.play();
}, { once: true });
</script>
</body>
</html>

15
var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/night.html.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "4968",
"log_excerpt": "[quarantine] www.archlinexp.eu:templates/shaper_helixultimate/night.html.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/night.html.json)",
"original_sha256": "e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc",
"original_stat": {
"gid": 30037,
"mtime": 1783518339,
"size": 2786,
"uid": 20043
},
"rel_path": "templates/shaper_helixultimate/night.html.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

1
var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/nxproof.php.json Normal file
View File

@ -0,0 +1 @@
<?php echo "Nxploited-Create"; ?>

15
var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/nxproof.php.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "4973",
"log_excerpt": "[quarantine] www.archlinexp.eu:templates/shaper_helixultimate/nxproof.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/nxproof.php.json)",
"original_sha256": "03abfd5cc3cec405dfaa3212fa98caa91d6b35de404f09b2f73306a8b168ce07",
"original_stat": {
"gid": 30037,
"mtime": 1784114812,
"size": 33,
"uid": 20043
},
"rel_path": "templates/shaper_helixultimate/nxproof.php.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

166
var/www/hosting/archlinexp.eu/www/templates/system/links.db Normal file
View File

File diff suppressed because one or more lines are too long

15
var/www/hosting/archlinexp.eu/www/templates/system/links.db.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "4960",
"log_excerpt": "[quarantine] www.archlinexp.eu:templates/system/links.db -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/system/links.db)",
"original_sha256": "5bade5d7cd10376ddaf7992d905e39cb055a14210ddeb76116b230974ad6d3be",
"original_stat": {
"gid": 30037,
"mtime": 1652191060,
"size": 12495,
"uid": 20043
},
"rel_path": "templates/system/links.db",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

1
var/www/hosting/archlinexp.eu/www/tmp/cox.json Normal file
View File

@ -0,0 +1 @@
hacked by trenggalek6etar

15
var/www/hosting/archlinexp.eu/www/tmp/cox.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "5222",
"log_excerpt": "[quarantine] www.archlinexp.eu:tmp/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/cox.json)",
"original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
"original_stat": {
"gid": 30037,
"mtime": 1783648991,
"size": 25,
"uid": 20043
},
"rel_path": "tmp/cox.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}

4
var/www/hosting/archlinexp.eu/www/x9txt.json Normal file
View File

@ -0,0 +1,4 @@
<html><head><title>Hacked By X9</title></head><body>
<h1 style="color:red;">Hacked By X9</h1>
<p>HCCTEAM.org | t.me/ExpSX9</p>
</body></html>

15
var/www/hosting/archlinexp.eu/www/x9txt.json.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "4871",
"log_excerpt": "[quarantine] www.archlinexp.eu:x9txt.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/x9txt.json)",
"original_sha256": "35a68c9a692d1d2fc59a7a6e9f4d686c97ec377515e1928af21a982a34e96d7b",
"original_stat": {
"gid": 30037,
"mtime": 1783286480,
"size": 141,
"uid": 20043
},
"rel_path": "x9txt.json",
"result": "quarantined",
"timestamp": "20260718T155031Z",
"vhost": "www.archlinexp.eu"
}