run-log: 20260718T155031Z (22 operation)

vhost: www.archlinexp.eu
rel_path: administrator/cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 5098

vhost: www.archlinexp.eu
rel_path: cache/cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 5021

vhost: www.archlinexp.eu
rel_path: captain.json
result: quarantined
evidence_sha256: 1f43ac8f363075c7926d2ac1a30b8f94df9d913c1e5b68b5da30b5109f4bfc25
timestamp: 20260718T155031Z
finding_ref: 4880

vhost: www.archlinexp.eu
rel_path: cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 4863

vhost: www.archlinexp.eu
rel_path: images/cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 5162

vhost: www.archlinexp.eu
rel_path: maintht.json
result: quarantined
evidence_sha256: e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc
timestamp: 20260718T155031Z
finding_ref: 4881

vhost: www.archlinexp.eu
rel_path: media/cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 4990

vhost: www.archlinexp.eu
rel_path: night.html.json
result: quarantined
evidence_sha256: e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc
timestamp: 20260718T155031Z
finding_ref: 4870

vhost: www.archlinexp.eu
rel_path: nxproof.php.json
result: quarantined
evidence_sha256: 03abfd5cc3cec405dfaa3212fa98caa91d6b35de404f09b2f73306a8b168ce07
timestamp: 20260718T155031Z
finding_ref: 4943

vhost: www.archlinexp.eu
rel_path: templates/cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 4951

vhost: www.archlinexp.eu
rel_path: templates/night.html.json
result: quarantined
evidence_sha256: e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc
timestamp: 20260718T155031Z
finding_ref: 4953

vhost: www.archlinexp.eu
rel_path: templates/nxproof.php.json
result: quarantined
evidence_sha256: 03abfd5cc3cec405dfaa3212fa98caa91d6b35de404f09b2f73306a8b168ce07
timestamp: 20260718T155031Z
finding_ref: 4959

vhost: www.archlinexp.eu
rel_path: templates/shaper_helixultimate/cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 4967

vhost: www.archlinexp.eu
rel_path: templates/shaper_helixultimate/night.html.json
result: quarantined
evidence_sha256: e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc
timestamp: 20260718T155031Z
finding_ref: 4968

vhost: www.archlinexp.eu
rel_path: templates/shaper_helixultimate/nxproof.php.json
result: quarantined
evidence_sha256: 03abfd5cc3cec405dfaa3212fa98caa91d6b35de404f09b2f73306a8b168ce07
timestamp: 20260718T155031Z
finding_ref: 4973

vhost: www.archlinexp.eu
rel_path: templates/system/links.db
result: quarantined
evidence_sha256: 5bade5d7cd10376ddaf7992d905e39cb055a14210ddeb76116b230974ad6d3be
timestamp: 20260718T155031Z
finding_ref: 4960

vhost: www.archlinexp.eu
rel_path: tmp/cox.json
result: quarantined
evidence_sha256: d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582
timestamp: 20260718T155031Z
finding_ref: 5222

vhost: www.archlinexp.eu
rel_path: x9txt.json
result: quarantined
evidence_sha256: 35a68c9a692d1d2fc59a7a6e9f4d686c97ec377515e1928af21a982a34e96d7b
timestamp: 20260718T155031Z
finding_ref: 4871

var/www/hosting/archlinexp.eu/www/administrator/cox.json

@@ -0,0 +1 @@
+hacked by trenggalek6etar

var/www/hosting/archlinexp.eu/www/administrator/cox.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5098",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:administrator/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/administrator/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783648994,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "administrator/cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/cache/cox.json

@@ -0,0 +1 @@
+hacked by trenggalek6etar

var/www/hosting/archlinexp.eu/www/cache/cox.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5021",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:cache/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783265637,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "cache/cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/captain.json

@@ -0,0 +1 @@
+Hacked By CaptainSmok3r - t.me/CaptainSmok3r_official

var/www/hosting/archlinexp.eu/www/captain.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4880",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:captain.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/captain.json)",
+  "original_sha256": "1f43ac8f363075c7926d2ac1a30b8f94df9d913c1e5b68b5da30b5109f4bfc25",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783259268,
+    "size": 53,
+    "uid": 20043
+  },
+  "rel_path": "captain.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/cox.json

@@ -0,0 +1 @@
+hacked by trenggalek6etar

var/www/hosting/archlinexp.eu/www/cox.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4863",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783648985,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/images/cox.json

@@ -0,0 +1 @@
+hacked by trenggalek6etar

var/www/hosting/archlinexp.eu/www/images/cox.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5162",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783648989,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "images/cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/maintht.json

@@ -0,0 +1,92 @@
+<!DOCTYPE html>
+<html lang="tr">
+<head>
+    <meta charset="UTF-8">
+    <title>Hacked By TurkHackTeam</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <style>
+        body {
+            margin: 0; padding: 0;
+            background: black;
+            color: white;
+            font-family: 'Courier New', monospace;
+            overflow: hidden;
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            height: 100vh;
+        }
+
+        .bg {
+            position: fixed;
+            top: 0; left: 0;
+            width: 100%; height: 100%;
+            background: url('https://i.imgur.com/bxgbsAv.jpeg') no-repeat center center/cover;
+            filter: brightness(30%);
+            z-index: -1;
+        }
+
+        .container { text-align: center; z-index: 1; }
+
+        .icon img {
+            width: 200px;
+            margin-bottom: 20px;
+            transition: 0.3s;
+        }
+
+        .icon img:hover { transform: scale(1.1); }
+
+        /* Başlıklar için normal stil */
+        .main-title { font-size: 2.5rem; margin: 10px 0; }
+        .desc { font-size: 1.2rem; color: #cccccc; margin-bottom: 10px; }
+
+        /* Anka Red Team için Kırmızı Glitch Efekti */
+        .anka-red {
+            font-size: 2rem;
+            font-weight: bold;
+            color: #ff0000;
+            text-transform: uppercase;
+            letter-spacing: 3px;
+            position: relative;
+            animation: glitch 1.5s infinite;
+            text-shadow: 2px 2px #000;
+        }
+
+        @keyframes glitch {
+            0% { transform: translate(0); }
+            20% { transform: translate(-2px, 2px); }
+            40% { transform: translate(-2px, -2px); }
+            60% { transform: translate(2px, 2px); }
+            80% { transform: translate(2px, -2px); }
+            100% { transform: translate(0); }
+        }
+    </style>
+</head>
+<body>
+
+    <div class="bg"></div>
+
+    <div class="container">
+        <div class="icon">
+            <a href="https://www.turkhackteam.org/" target="_blank">
+                <img src="https://i.hizliresim.com/nj7exqr.png" alt="TurkHackTeam">
+            </a>
+        </div>
+        <div class="main-title">The site has been hacked by TURKHACKTEAM.</div>
+        <div class="desc">We whenever we want, wherever we want.</div>
+        <div class="anka-red">☪ Anka Red Team ☪</div>
+    </div>
+
+    <audio id="audio" loop>
+        <source src="https://www.meb.gov.tr/istiklalmarsi/assets/audio/istiklalMarsi3.mp3" type="audio/mpeg">
+    </audio>
+
+    <script>
+        window.addEventListener('click', () => {
+            const audio = document.getElementById('audio');
+            audio.play();
+        }, { once: true });
+    </script>
+
+</body>
+</html>

var/www/hosting/archlinexp.eu/www/maintht.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4881",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:maintht.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/maintht.json)",
+  "original_sha256": "e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783519684,
+    "size": 2786,
+    "uid": 20043
+  },
+  "rel_path": "maintht.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/media/cox.json

@@ -0,0 +1 @@
+hacked by trenggalek6etar

var/www/hosting/archlinexp.eu/www/media/cox.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4990",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:media/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783648990,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "media/cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/night.html.json

@@ -0,0 +1,92 @@
+<!DOCTYPE html>
+<html lang="tr">
+<head>
+    <meta charset="UTF-8">
+    <title>Hacked By TurkHackTeam</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <style>
+        body {
+            margin: 0; padding: 0;
+            background: black;
+            color: white;
+            font-family: 'Courier New', monospace;
+            overflow: hidden;
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            height: 100vh;
+        }
+
+        .bg {
+            position: fixed;
+            top: 0; left: 0;
+            width: 100%; height: 100%;
+            background: url('https://i.imgur.com/bxgbsAv.jpeg') no-repeat center center/cover;
+            filter: brightness(30%);
+            z-index: -1;
+        }
+
+        .container { text-align: center; z-index: 1; }
+
+        .icon img {
+            width: 200px;
+            margin-bottom: 20px;
+            transition: 0.3s;
+        }
+
+        .icon img:hover { transform: scale(1.1); }
+
+        /* Başlıklar için normal stil */
+        .main-title { font-size: 2.5rem; margin: 10px 0; }
+        .desc { font-size: 1.2rem; color: #cccccc; margin-bottom: 10px; }
+
+        /* Anka Red Team için Kırmızı Glitch Efekti */
+        .anka-red {
+            font-size: 2rem;
+            font-weight: bold;
+            color: #ff0000;
+            text-transform: uppercase;
+            letter-spacing: 3px;
+            position: relative;
+            animation: glitch 1.5s infinite;
+            text-shadow: 2px 2px #000;
+        }
+
+        @keyframes glitch {
+            0% { transform: translate(0); }
+            20% { transform: translate(-2px, 2px); }
+            40% { transform: translate(-2px, -2px); }
+            60% { transform: translate(2px, 2px); }
+            80% { transform: translate(2px, -2px); }
+            100% { transform: translate(0); }
+        }
+    </style>
+</head>
+<body>
+
+    <div class="bg"></div>
+
+    <div class="container">
+        <div class="icon">
+            <a href="https://www.turkhackteam.org/" target="_blank">
+                <img src="https://i.hizliresim.com/nj7exqr.png" alt="TurkHackTeam">
+            </a>
+        </div>
+        <div class="main-title">The site has been hacked by TURKHACKTEAM.</div>
+        <div class="desc">We whenever we want, wherever we want.</div>
+        <div class="anka-red">☪ Anka Red Team ☪</div>
+    </div>
+
+    <audio id="audio" loop>
+        <source src="https://www.meb.gov.tr/istiklalmarsi/assets/audio/istiklalMarsi3.mp3" type="audio/mpeg">
+    </audio>
+
+    <script>
+        window.addEventListener('click', () => {
+            const audio = document.getElementById('audio');
+            audio.play();
+        }, { once: true });
+    </script>
+
+</body>
+</html>

var/www/hosting/archlinexp.eu/www/night.html.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4870",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:night.html.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/night.html.json)",
+  "original_sha256": "e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783518338,
+    "size": 2786,
+    "uid": 20043
+  },
+  "rel_path": "night.html.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/nxproof.php.json

@@ -0,0 +1 @@
+<?php echo "Nxploited-Create"; ?>

var/www/hosting/archlinexp.eu/www/nxproof.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4943",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:nxproof.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/nxproof.php.json)",
+  "original_sha256": "03abfd5cc3cec405dfaa3212fa98caa91d6b35de404f09b2f73306a8b168ce07",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784114808,
+    "size": 33,
+    "uid": 20043
+  },
+  "rel_path": "nxproof.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/templates/cox.json

@@ -0,0 +1 @@
+hacked by trenggalek6etar

var/www/hosting/archlinexp.eu/www/templates/cox.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4951",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783648993,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "templates/cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/templates/night.html.json

@@ -0,0 +1,92 @@
+<!DOCTYPE html>
+<html lang="tr">
+<head>
+    <meta charset="UTF-8">
+    <title>Hacked By TurkHackTeam</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <style>
+        body {
+            margin: 0; padding: 0;
+            background: black;
+            color: white;
+            font-family: 'Courier New', monospace;
+            overflow: hidden;
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            height: 100vh;
+        }
+
+        .bg {
+            position: fixed;
+            top: 0; left: 0;
+            width: 100%; height: 100%;
+            background: url('https://i.imgur.com/bxgbsAv.jpeg') no-repeat center center/cover;
+            filter: brightness(30%);
+            z-index: -1;
+        }
+
+        .container { text-align: center; z-index: 1; }
+
+        .icon img {
+            width: 200px;
+            margin-bottom: 20px;
+            transition: 0.3s;
+        }
+
+        .icon img:hover { transform: scale(1.1); }
+
+        /* Başlıklar için normal stil */
+        .main-title { font-size: 2.5rem; margin: 10px 0; }
+        .desc { font-size: 1.2rem; color: #cccccc; margin-bottom: 10px; }
+
+        /* Anka Red Team için Kırmızı Glitch Efekti */
+        .anka-red {
+            font-size: 2rem;
+            font-weight: bold;
+            color: #ff0000;
+            text-transform: uppercase;
+            letter-spacing: 3px;
+            position: relative;
+            animation: glitch 1.5s infinite;
+            text-shadow: 2px 2px #000;
+        }
+
+        @keyframes glitch {
+            0% { transform: translate(0); }
+            20% { transform: translate(-2px, 2px); }
+            40% { transform: translate(-2px, -2px); }
+            60% { transform: translate(2px, 2px); }
+            80% { transform: translate(2px, -2px); }
+            100% { transform: translate(0); }
+        }
+    </style>
+</head>
+<body>
+
+    <div class="bg"></div>
+
+    <div class="container">
+        <div class="icon">
+            <a href="https://www.turkhackteam.org/" target="_blank">
+                <img src="https://i.hizliresim.com/nj7exqr.png" alt="TurkHackTeam">
+            </a>
+        </div>
+        <div class="main-title">The site has been hacked by TURKHACKTEAM.</div>
+        <div class="desc">We whenever we want, wherever we want.</div>
+        <div class="anka-red">☪ Anka Red Team ☪</div>
+    </div>
+
+    <audio id="audio" loop>
+        <source src="https://www.meb.gov.tr/istiklalmarsi/assets/audio/istiklalMarsi3.mp3" type="audio/mpeg">
+    </audio>
+
+    <script>
+        window.addEventListener('click', () => {
+            const audio = document.getElementById('audio');
+            audio.play();
+        }, { once: true });
+    </script>
+
+</body>
+</html>

var/www/hosting/archlinexp.eu/www/templates/night.html.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4953",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/night.html.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/night.html.json)",
+  "original_sha256": "e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783518338,
+    "size": 2786,
+    "uid": 20043
+  },
+  "rel_path": "templates/night.html.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/templates/nxproof.php.json

@@ -0,0 +1 @@
+<?php echo "Nxploited-Create"; ?>

var/www/hosting/archlinexp.eu/www/templates/nxproof.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4959",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/nxproof.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/nxproof.php.json)",
+  "original_sha256": "03abfd5cc3cec405dfaa3212fa98caa91d6b35de404f09b2f73306a8b168ce07",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784114811,
+    "size": 33,
+    "uid": 20043
+  },
+  "rel_path": "templates/nxproof.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/cox.json

@@ -0,0 +1 @@
+hacked by trenggalek6etar

var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/cox.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4967",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/shaper_helixultimate/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783648992,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "templates/shaper_helixultimate/cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/night.html.json

@@ -0,0 +1,92 @@
+<!DOCTYPE html>
+<html lang="tr">
+<head>
+    <meta charset="UTF-8">
+    <title>Hacked By TurkHackTeam</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <style>
+        body {
+            margin: 0; padding: 0;
+            background: black;
+            color: white;
+            font-family: 'Courier New', monospace;
+            overflow: hidden;
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            height: 100vh;
+        }
+
+        .bg {
+            position: fixed;
+            top: 0; left: 0;
+            width: 100%; height: 100%;
+            background: url('https://i.imgur.com/bxgbsAv.jpeg') no-repeat center center/cover;
+            filter: brightness(30%);
+            z-index: -1;
+        }
+
+        .container { text-align: center; z-index: 1; }
+
+        .icon img {
+            width: 200px;
+            margin-bottom: 20px;
+            transition: 0.3s;
+        }
+
+        .icon img:hover { transform: scale(1.1); }
+
+        /* Başlıklar için normal stil */
+        .main-title { font-size: 2.5rem; margin: 10px 0; }
+        .desc { font-size: 1.2rem; color: #cccccc; margin-bottom: 10px; }
+
+        /* Anka Red Team için Kırmızı Glitch Efekti */
+        .anka-red {
+            font-size: 2rem;
+            font-weight: bold;
+            color: #ff0000;
+            text-transform: uppercase;
+            letter-spacing: 3px;
+            position: relative;
+            animation: glitch 1.5s infinite;
+            text-shadow: 2px 2px #000;
+        }
+
+        @keyframes glitch {
+            0% { transform: translate(0); }
+            20% { transform: translate(-2px, 2px); }
+            40% { transform: translate(-2px, -2px); }
+            60% { transform: translate(2px, 2px); }
+            80% { transform: translate(2px, -2px); }
+            100% { transform: translate(0); }
+        }
+    </style>
+</head>
+<body>
+
+    <div class="bg"></div>
+
+    <div class="container">
+        <div class="icon">
+            <a href="https://www.turkhackteam.org/" target="_blank">
+                <img src="https://i.hizliresim.com/nj7exqr.png" alt="TurkHackTeam">
+            </a>
+        </div>
+        <div class="main-title">The site has been hacked by TURKHACKTEAM.</div>
+        <div class="desc">We whenever we want, wherever we want.</div>
+        <div class="anka-red">☪ Anka Red Team ☪</div>
+    </div>
+
+    <audio id="audio" loop>
+        <source src="https://www.meb.gov.tr/istiklalmarsi/assets/audio/istiklalMarsi3.mp3" type="audio/mpeg">
+    </audio>
+
+    <script>
+        window.addEventListener('click', () => {
+            const audio = document.getElementById('audio');
+            audio.play();
+        }, { once: true });
+    </script>
+
+</body>
+</html>

var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/night.html.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4968",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/shaper_helixultimate/night.html.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/night.html.json)",
+  "original_sha256": "e5035e6120f1efc7d81ebf47b5e1a72f235b68c8c968dc330fcd6decab78a9bc",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783518339,
+    "size": 2786,
+    "uid": 20043
+  },
+  "rel_path": "templates/shaper_helixultimate/night.html.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/nxproof.php.json

@@ -0,0 +1 @@
+<?php echo "Nxploited-Create"; ?>

var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/nxproof.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4973",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/shaper_helixultimate/nxproof.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/nxproof.php.json)",
+  "original_sha256": "03abfd5cc3cec405dfaa3212fa98caa91d6b35de404f09b2f73306a8b168ce07",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784114812,
+    "size": 33,
+    "uid": 20043
+  },
+  "rel_path": "templates/shaper_helixultimate/nxproof.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/templates/system/links.db.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4960",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/system/links.db -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/system/links.db)",
+  "original_sha256": "5bade5d7cd10376ddaf7992d905e39cb055a14210ddeb76116b230974ad6d3be",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1652191060,
+    "size": 12495,
+    "uid": 20043
+  },
+  "rel_path": "templates/system/links.db",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/tmp/cox.json

@@ -0,0 +1 @@
+hacked by trenggalek6etar

var/www/hosting/archlinexp.eu/www/tmp/cox.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5222",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:tmp/cox.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/cox.json)",
+  "original_sha256": "d2bd1745b07c6104ea78fec7c66fa15726934a703912301b77c87e2c725d3582",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783648991,
+    "size": 25,
+    "uid": 20043
+  },
+  "rel_path": "tmp/cox.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/x9txt.json

@@ -0,0 +1,4 @@
+<html><head><title>Hacked By X9</title></head><body>
+<h1 style="color:red;">Hacked By X9</h1>
+<p>HCCTEAM.org | t.me/ExpSX9</p>
+</body></html>

var/www/hosting/archlinexp.eu/www/x9txt.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4871",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:x9txt.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/x9txt.json)",
+  "original_sha256": "35a68c9a692d1d2fc59a7a6e9f4d686c97ec377515e1928af21a982a34e96d7b",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783286480,
+    "size": 141,
+    "uid": 20043
+  },
+  "rel_path": "x9txt.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155031Z",
+  "vhost": "www.archlinexp.eu"
+}