ls
cd domains/
cd shadoflex.com/
cd public_html/
ls
node -v
npm install -g pm2
apt update && apt upgrade -y
curl -fsSL https://deb.nodesource.com/setup_lts.x | bash -
apt install -y nodejs
which node
/usr/bin/which: no node in (...)
ls /opt/alt/
/opt/alt/alt-nodejs18
/opt/alt/alt-nodejs20
/opt/alt/alt-nodejs22
/opt/alt/alt-nodejs24
/opt/alt/alt-nodejs22/root/usr/bin/node -v
export PATH=/opt/alt/alt-nodejs22/root/usr/bin:$PATH
node -v
pm2 -v
npm install -g pm2
pm2 -v
mkdir -p ~/.npm-global
npm config set prefix ~/.npm-global
npm config get prefix
npm install -g pm2
pm2 list
ls ~/.npm-global/bin
export PATH=$HOME/.npm-global/bin:$PATH
pm2 -v
which pm2
node -v
pm2 list
npm -v
ls
cd domains/
ls
find / -type d -name ".render-cache" 2>/dev/null
find / -type d -name ".render-cache" 2>/dev/null | wc -l
exit
ls
cd domains/
ls
cd bellmultikraft.com
cd public_html/
ls
find ~/public_html -type f -name ".htaccess" > htaccess_list.txt
find . -type f -name ".htaccess" > htaccess_list.txt
find . -type f -name ".htaccess" | wc -l
find . -type f -name ".htaccess" -delete
find . -type f -name ".htaccess" | wc -l
cd ..
ls
cd cerototiles.com
ls
cd public_html/
find . -type f -name ".htaccess" | wc -l
ls
find . -type f -name ".htaccess" -delete
find . -type f -name ".htaccess" | wc -l
cd ..
cd cementationindia.com/
ls
cd public_html/
find . -type f -name ".htaccess" | wc -l
find . -type f -name ".htaccess" -delete
find . -type f -name ".htaccess" | wc -l
cd ..
cd ...
cd ,,
cd ..
ls
exot
exit
ls
cd domains/
find . -type f -name ".render-cache"
exit
cd /home/u331382243/
ls
cd domains/
cd accuraindustry.com/
ls
cd public_html/
grep -rnl ./ -e "Sole Sad"
find -type f -name ".htaccess"
cd uploads/
ls
nano .htaccess 
cd ../
grep -rnl ./ -e "Sole Sad"
mysql
mysql -u root
mysql -u root -p
exot
exit
ls
cd domains/
find . -type f -name ".render-cache"
grep -rnl ./ -e 'Sole Sad'
exit
echo "Starting optimized security cleanup..." && find /home/u505738920/domains -name ".htaccess" -type f ! -perm 644 -exec chmod 644 {} \; && echo "✅ .htaccess permissions fixed" && find /home/u505738920/domains -type f ! -perm 644 -exec chmod 644 {} \; && echo "✅ File permissions fixed" && find /home/u505738920/domains -type d ! -perm 755 -exec chmod 755 {} \; && echo "✅ Directory permissions fixed" && echo "Optimized cleanup complete!"
echo "Starting optimized security cleanup..." && find /home/u331382243/domains -name ".htaccess" -type f ! -perm 644 -exec chmod 644 {} \; && echo "✅ .htaccess permissions fixed" && find /home/u331382243/domains -type f ! -perm 644 -exec chmod 644 {} \; && echo "✅ File permissions fixed" && find /home/u331382243/domains -type d ! -perm 755 -exec chmod 755 {} \; && echo "✅ Directory permissions fixed" && echo "Optimized cleanup complete!"
grep -rnl ./ -e 'Sole Sad'
find ./ -type f \( -name "*.Eren" -o -name "*render-cache*" -o -name "*.render*.php" \)
cd /home/u331382243/domains/
find ./ -type f \( -name "*.Eren" -o -name "*render-cache*" -o -name "*.render*.php" \)
grep -rnl ./ -e "Sole Sad"
exit
ls
cd domains/
ls
exit
ls
cd domains/
ls
exit
cd /home/u331382243/domains/
find /home/u284385663/domains/ -type f ! -iname "*.pdf" ! -iname "*.webp" ! -iname "*.jpg" ! -name "*.jpeg" ! -iname "*.png" ! -path "*/ckeditor4-4.22.1/*" ! -path "*/hbuilds/*" ! -path "*/ckeditor/*" ! -path "*/excel/*" -newermt "2026-08-07 00:00:00" -printf "%TY-%Tm-%Td %TH:%TM:%TS  %p\n" 2>/dev/null | sort | tee ./lvgranito.com/public_html/infected_files_scan.txt
find /home/u331382243/domains/ -type f ! -iname "*.pdf" ! -iname "*.webp" ! -iname "*.jpg" ! -name "*.jpeg" ! -iname "*.png" ! -path "*/ckeditor4-4.22.1/*" ! -path "*/hbuilds/*" ! -path "*/ckeditor/*" ! -path "*/excel/*" -newermt "2026-08-10 00:00:00" -printf "%TY-%Tm-%Td %TH:%TM:%TS  %p\n" 2>/dev/null | sort | tee ~/infected_files_scan.txt
rm -rf ~/infected_files_scan.txt 
exit
cd /home/u331382243/domains/
grep -rnl --include="*.php" -e "n isGoogleUserAgent" ./
nano arttile.in/public_html/index.php
nano spentopapers.com/public_html/infrastructure.php 
clear
grep -rnl --include="*.php" -e "n isGoogleUserAgent" ./
stat spentopapers.com/public_html/index.php 
nano spentopapers.com/public_html/index.php 
grep -rnl --include="*.php" -e "n isGoogleUserAgent" ./
grep -rnl --include="*.htaccess" -e "Google" ./
grep -rn --include="*.htaccess" -e "Google" ./
nano ./dynovatileadhesive.com/public_html/.htaccess
exit
grep -E '(^|[[:space:];|&])(find|grep)([[:space:]]|$)' ~/.bash_history
cd /home/u331382243/domains/
{     echo "===== SCAN START: $(date) =====";      echo;     echo "===== 1. suhosin blacklist =====";     grep -rnlI --include="*.php" -e "ini_get('suhosin.executor.func.blacklist');" ./;      echo;     echo "===== 2. require base64_decode =====";     grep -rnlI --include="*.php" -e 'require base64_decode("' ./;      echo;     echo "===== 3. Suspicious filenames =====";     find ./ -type f \( -name "*.Eren" -o -name "*render-cache*" -o -name "*.render*.php" \);      echo;     echo "===== 4. Sole Sad =====";     grep -rnlI --include="*.php" --include="*.htaccess" -e "Sole Sad" ./;      echo;     echo "===== 5. eval(base64_decode =====";     grep -rnlI --include="*.php" --include="*.htaccess" -e "eval(base64_decode(" ./;      echo;     echo "===== 6. Suspicious filenames =====";     find ./ -type f \( -name "lufix.php" -o -name "fixxxedd.php" -o -name "fixxed.txt" -o -name "ad.php" -o -name "m.php" -o -name "into.php" \);      echo;     echo "===== 7. .render-cache directories =====";     find ./ -type d -name ".render-cache";      echo;     echo "===== 8. isGoogleUserAgent =====";     grep -rnlI --include="*.php" -e "n isGoogleUserAgent" ./;      echo;     echo "===== 9. fcalpha =====";     grep -rnlI --include="*.php" -e "fcalpha" ./;      echo;     echo "===== 10. eval(eval =====";     grep -rnlI --include="*.php" -e "eval(eval(" ./;      echo;     echo "===== SCAN END: $(date) ====="; } > ~/scan.txt 2>&1
less ~/scan.txt 
nano segatiles.com/public_html/wp-content/plugins/wp-optimize/vendor/rosell-dk/exec-with-fallback/src/ExecWithFallback.php 
less ~/scan.txt 
nano segatiles.com/public_html/wp-content/plugins/wp-optimize/vendor/rosell-dk/exec-with-fallback/src/ExecWithFallback.php 
less ~/scan.txt 
nano segatiles.com/public_html/wp-content/plugins/wp-optimize/vendor/rosell-dk/exec-with-fallback/src/ExecWithFallback.php 
rm -rf segatiles.com/public_html/wp-content/plugins/wp-optimize/vendor/rosell-dk/exec-with-fallback/src/ExecWithFallback.php 
rm -rf 
rm -rf segatiles.com/public_html/wp-content/plugins/wp-optimize/vendor/rosell-dk/exec-with-fallback
less ~/scan.txt 
cat ~/scan.txt 
nano prasummetals.com/public_html/lufix.php
find ./ -type f \( -name "lufix.php" -o -name "fixxxedd.php" -o -name "fixxed.txt" -o -name "ad.php" -o -name "m.php" -o -name "into.php" \)
find ./ -type f \( -name "lufix.php" -o -name "fixxxedd.php" -o -name "fixxed.txt" -o -name "ad.php" -o -name "m.php" -o -name "into.php" \) -delete
find ./ -type f \( -name "lufix.php" -o -name "fixxxedd.php" -o -name "fixxed.txt" -o -name "ad.php" -o -name "m.php" -o -name "into.php" \)
rm -rf ./arttile.in/public_html/m.php
nano ./arttile.in/public_html/uploads/application/6a7553fbcc919.php 
rm -rf ./arttile.in/public_html/uploads/application/6a7553fbcc919.php 
{     echo "===== SCAN START: $(date) =====";      echo;     echo "===== 1. suhosin blacklist =====";     grep -rnlI --include="*.php" -e "ini_get('suhosin.executor.func.blacklist');" ./;      echo;     echo "===== 2. require base64_decode =====";     grep -rnlI --include="*.php" -e 'require base64_decode("' ./;      echo;     echo "===== 3. Suspicious filenames =====";     find ./ -type f \( -name "*.Eren" -o -name "*render-cache*" -o -name "*.render*.php" \);      echo;     echo "===== 4. Sole Sad =====";     grep -rnlI --include="*.php" --include="*.htaccess" -e "Sole Sad" ./;      echo;     echo "===== 5. eval(base64_decode =====";     grep -rnlI --include="*.php" --include="*.htaccess" -e "eval(base64_decode(" ./;      echo;     echo "===== 6. Suspicious filenames =====";     find ./ -type f \( -name "lufix.php" -o -name "fixxxedd.php" -o -name "fixxed.txt" -o -name "ad.php" -o -name "m.php" -o -name "into.php" \);      echo;     echo "===== 7. .render-cache directories =====";     find ./ -type d -name ".render-cache";      echo;     echo "===== 8. isGoogleUserAgent =====";     grep -rnlI --include="*.php" -e "n isGoogleUserAgent" ./;      echo;     echo "===== 9. fcalpha =====";     grep -rnlI --include="*.php" -e "fcalpha" ./;      echo;     echo "===== 10. eval(eval =====";     grep -rnlI --include="*.php" -e "eval(eval(" ./;      echo;     echo "===== 11. .nox-helper.php references in PHP files =====";     grep -rnlI --include="*.php" -F ".nox-helper.php" ./;      echo;     echo "===== SCAN END: $(date) ====="; } > ~/scan.txt 2>&1
rm -rf ~/scan.txt 
{     echo "===== SCAN START: $(date) =====";      echo;     echo "===== 1. suhosin blacklist =====";     grep -rnlI --include="*.php" -e "ini_get('suhosin.executor.func.blacklist');" ./;      echo;     echo "===== 2. require base64_decode =====";     grep -rnlI --include="*.php" -e 'require base64_decode("' ./;      echo;     echo "===== 3. Suspicious filenames =====";     find ./ -type f \( -name "*.Eren" -o -name "*render-cache*" -o -name "*.render*.php" \);      echo;     echo "===== 4. Sole Sad =====";     grep -rnlI --include="*.php" --include="*.htaccess" -e "Sole Sad" ./;      echo;     echo "===== 5. eval(base64_decode =====";     grep -rnlI --include="*.php" --include="*.htaccess" -e "eval(base64_decode(" ./;      echo;     echo "===== 6. Suspicious filenames =====";     find ./ -type f \( -name "lufix.php" -o -name "fixxxedd.php" -o -name "fixxed.txt" -o -name "ad.php" -o -name "m.php" -o -name "into.php" \);      echo;     echo "===== 7. .render-cache directories =====";     find ./ -type d -name ".render-cache";      echo;     echo "===== 8. isGoogleUserAgent =====";     grep -rnlI --include="*.php" -e "n isGoogleUserAgent" ./;      echo;     echo "===== 9. fcalpha =====";     grep -rnlI --include="*.php" -e "fcalpha" ./;      echo;     echo "===== 10. eval(eval =====";     grep -rnlI --include="*.php" -e "eval(eval(" ./;      echo;     echo "===== 11. .nox-helper.php references in PHP files =====";     grep -rnlI --include="*.php" -F ".nox-helper.php" ./;      echo;     echo "===== SCAN END: $(date) ====="; } > ~/scan.txt 2>&1
cat ~/scan.txt 
rm -rf ./cerototiles.com/public_html/admin_cerototiles/img/assets/assets
{     echo "===== SCAN START: $(date) =====";      echo;     echo "===== 1. suhosin blacklist =====";     grep -rnlI --include="*.php" -e "ini_get('suhosin.executor.func.blacklist');" ./;      echo;     echo "===== 2. require base64_decode =====";     grep -rnlI --include="*.php" -e 'require base64_decode("' ./;      echo;     echo "===== 3. Suspicious filenames =====";     find ./ -type f \( -name "*.Eren" -o -name "*render-cache*" -o -name "*.render*.php" \);      echo;     echo "===== 4. Sole Sad =====";     grep -rnlI --include="*.php" --include="*.htaccess" -e "Sole Sad" ./;      echo;     echo "===== 5. eval(base64_decode =====";     grep -rnlI --include="*.php" --include="*.htaccess" -e "eval(base64_decode(" ./;      echo;     echo "===== 6. Suspicious filenames =====";     find ./ -type f \( -name "lufix.php" -o -name "fixxxedd.php" -o -name "fixxed.txt" -o -name "ad.php" -o -name "m.php" -o -name "into.php" \);      echo;     echo "===== 7. .render-cache directories =====";     find ./ -type d -name ".render-cache";      echo;     echo "===== 8. isGoogleUserAgent =====";     grep -rnlI --include="*.php" -e "n isGoogleUserAgent" ./;      echo;     echo "===== 9. fcalpha =====";     grep -rnlI --include="*.php" -e "fcalpha" ./;      echo;     echo "===== 10. eval(eval =====";     grep -rnlI --include="*.php" -e "eval(eval(" ./;      echo;     echo "===== 11. .nox-helper.php references in PHP files =====";     grep -rnlI --include="*.php" -F ".nox-helper.php" ./;      echo;     echo "===== SCAN END: $(date) ====="; } > ~/scan.txt 2>&1
cat ~/scan.txt 
ls
cd domains/
{     echo "===== SCAN START: $(date) =====";      echo;     echo "===== 1. suhosin blacklist =====";     grep -rnlI --include="*.php" -e "ini_get('suhosin.executor.func.blacklist');" ./;      echo;     echo "===== 2. require base64_decode =====";     grep -rnlI --include="*.php" -e 'require base64_decode("' ./;      echo;     echo "===== 3. Suspicious filenames =====";     find ./ -type f \( -name "*.Eren" -o -name "*render-cache*" -o -name "*.render*.php" \);      echo;     echo "===== 4. Sole Sad =====";     grep -rnlI --include="*.php" --include="*.htaccess" -e "Sole Sad" ./;      echo;     echo "===== 5. eval(base64_decode =====";     grep -rnlI --include="*.php" --include="*.htaccess" -e "eval(base64_decode(" ./;      echo;     echo "===== 6. Suspicious filenames =====";     find ./ -type f \( -name "lufix.php" -o -name "fixxxedd.php" -o -name "fixxed.txt" -o -name "ad.php" -o -name "m.php" -o -name "into.php" \);      echo;     echo "===== 7. .render-cache directories =====";     find ./ -type d -name ".render-cache";      echo;     echo "===== 8. isGoogleUserAgent =====";     grep -rnlI --include="*.php" -e "n isGoogleUserAgent" ./;      echo;     echo "===== 9. fcalpha =====";     grep -rnlI --include="*.php" -e "fcalpha" ./;      echo;     echo "===== 10. eval(eval =====";     grep -rnlI --include="*.php" -e "eval(eval(" ./;      echo;     echo "===== 11. .nox-helper.php references in PHP files =====";     grep -rnlI --include="*.php" -F ".nox-helper.php" ./;      echo;     echo "===== SCAN END: $(date) ====="; } > ~/scan.txt 2>&1
cat ~/scan.txt 
exit
ls
cd domains/
{     echo "===== SCAN START: $(date) =====";      echo;     echo "===== 1. suhosin blacklist =====";     grep -rnlI --include="*.php" -e "ini_get('suhosin.executor.func.blacklist');" ./;      echo;     echo "===== 2. require base64_decode =====";     grep -rnlI --include="*.php" -e 'require base64_decode("' ./;      echo;     echo "===== 3. Suspicious filenames =====";     find ./ -type f \( -name "*.Eren" -o -name "*render-cache*" -o -name "*.render*.php" \);      echo;     echo "===== 4. Sole Sad =====";     grep -rnlI --include="*.php" --include="*.htaccess" -e "Sole Sad" ./;      echo;     echo "===== 5. eval(base64_decode =====";     grep -rnlI --include="*.php" --include="*.htaccess" -e "eval(base64_decode(" ./;      echo;     echo "===== 6. Suspicious filenames =====";     find ./ -type f \( -name "lufix.php" -o -name "fixxxedd.php" -o -name "fixxed.txt" -o -name "ad.php" -o -name "m.php" -o -name "into.php" \);      echo;     echo "===== 7. .render-cache directories =====";     find ./ -type d -name ".render-cache";      echo;     echo "===== 8. isGoogleUserAgent =====";     grep -rnlI --include="*.php" -e "n isGoogleUserAgent" ./;      echo;     echo "===== 9. fcalpha =====";     grep -rnlI --include="*.php" -e "fcalpha" ./;      echo;     echo "===== 10. eval(eval =====";     grep -rnlI --include="*.php" -e "eval(eval(" ./;      echo;     echo "===== 11. .nox-helper.php references in PHP files =====";     grep -rnlI --include="*.php" -F ".nox-helper.php" ./;      echo;     echo "===== SCAN END: $(date) ====="; } > ~/scan.txt 2>&1
cat ~/scan.txt 
exit