 Server : Apache/2 System : Linux server-15-235-50-60 5.15.0-164-generic #174-Ubuntu SMP Fri Nov 14 20:25:16 UTC 2025 x86_64 User : gositeme ( 1004) PHP Version : 8.2.29 Disable Function : exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname Directory : /home/gositeme/domains/soundstudiopro.com/public_html/ |
# 🚨 CRITICAL: ATTACKER BLOCKED - IMMEDIATE ACTIONS TAKEN
**Date:** December 12, 2025
**Status:** ATTACKER IP BLOCKED - BACKDOORS DELETED
---
## 🚨 WHAT HAPPENED
**YES, THIS WAS THE HACKER!** The log entry shows:
```
198.204.236.234 - - [12/Dec/2025:21:32:11 -0500]
"GET /445367/about.php?ac=u_h_s_1&api=&path=/home/gositeme/domains/soundstudiopro.com/private_html&t=8a802d2ce1b8d1f38a165e26c42efe97&s=3 HTTP/1.1"
200 607844
```
### Attack Analysis:
- **Attacker IP:** `198.204.236.234` ✅ **BLOCKED**
- **Target:** `/445367/about.php` (file manager backdoor)
- **Action:** File manager access (`ac=u_h_s_1` = upload/host/shell)
- **Target:** Trying to access `private_html` directory
- **Response:** 200 OK (607KB) - **BACKDOOR WAS ACTIVE!**
### What the Attacker Was Doing:
1. **File Manager Access:** Using backdoor to browse files
2. **Directory Browsing:** Trying to access `private_html`
3. **Active Session:** Using tokens to maintain access
4. **Large Response:** Got file manager interface (607KB)
---
## ✅ IMMEDIATE ACTIONS TAKEN
### 1. ✅ BLOCKED ATTACKER IP
**Added to root `.htaccess`:**
```apache
# BLOCK ATTACKER IP - CRITICAL SECURITY
<RequireAll>
Require all granted
Require not ip 198.204.236.234
</RequireAll>
```
### 2. ✅ DELETED MALICIOUS FILES
- `445367/index.php` - **DELETED** (was downloading code from `https://51la.zvo2.xyz/a2.txt`)
- `445367/about.php` - **ALREADY DELETED** (was file manager backdoor)
- `445367/.htaccess` - **REPLACED** (was allowing backdoor access)
### 3. ✅ SECURED 445367 DIRECTORY
**New `.htaccess` in `445367/`:**
```apache
# BLOCK ALL ACCESS - This directory was used for attacks
<RequireAll>
Require all denied
</RequireAll>
```
**Added to root `.htaccess`:**
```apache
# Block access to 445367 directory (was used for attacks)
<DirectoryMatch "^/445367">
Require all denied
</DirectoryMatch>
# BLOCK 445367 directory via rewrite
RewriteCond %{REQUEST_URI} ^/445367
RewriteRule ^ - [F,L]
```
---
## 🚨 CRITICAL FINDINGS
### Malicious File Found:
**`445367/index.php`** was downloading and executing code from:
```
https://51la.zvo2.xyz/a2.txt
```
**This is a REMOTE CODE EXECUTION backdoor!**
- Downloads malicious code from attacker's server
- Executes it on your server
- Deletes itself after execution (temp file)
- **EXTREMELY DANGEROUS**
### What This Means:
- Attacker had **FULL ACCESS** to your server
- Could execute **ANY PHP CODE**
- Could upload/download files
- Could access database
- Could modify any file
---
## ⚠️ ADDITIONAL ACTIONS REQUIRED
### 1. Check for Other Backdoors
```bash
# Search for similar patterns
find . -name "*.php" -exec grep -l "51la.zvo2.xyz\|zvo2.xyz" {} \;
find . -name "*about.php" -type f
find . -name "*radio.php" -type f
```
### 2. Check File Modifications
```bash
# Files modified around attack time (Dec 12 21:30-21:35)
find . -type f -newermt "2025-12-12 21:30:00" ! -newermt "2025-12-12 21:35:00" -name "*.php"
```
### 3. Check Database for Unauthorized Users
```sql
SELECT * FROM users WHERE created_at > '2025-12-12 21:00:00';
SELECT * FROM users WHERE last_login > '2025-12-12 21:00:00';
```
### 4. Review Access Logs
```bash
# Find all access from attacker IP
grep "198.204.236.234" /var/log/apache2/access.log
grep "198.204.236.234" /var/log/apache2/error.log
```
### 5. Check private_html Directory
```bash
# Check for unauthorized access
ls -la /home/gositeme/domains/soundstudiopro.com/private_html/
find /home/gositeme/domains/soundstudiopro.com/private_html/ -type f -mtime -1
```
### 6. Change ALL Passwords
- Database password
- FTP/SFTP password
- Admin user passwords
- API keys
- Stripe keys
### 7. Review File Permissions
```bash
# Check for world-writable files
find . -type f -perm -002 -name "*.php"
find . -type d -perm -002
```
---
## 🛡️ SECURITY MEASURES APPLIED
### ✅ IP Blocking
- Attacker IP `198.204.236.234` blocked in `.htaccess`
- Will return 403 Forbidden for all requests
### ✅ Directory Blocking
- `445367/` directory completely blocked
- All access denied via `.htaccess` and rewrite rules
### ✅ Malicious Files Deleted
- `445367/index.php` - Remote code execution backdoor
- `445367/about.php` - File manager backdoor (already deleted)
- `445367/.htaccess` - Replaced with security rules
---
## 📋 MONITORING CHECKLIST
- [x] Block attacker IP ✅
- [x] Delete malicious files ✅
- [x] Secure 445367 directory ✅
- [ ] Check for other backdoors
- [ ] Review file modifications
- [ ] Check database for unauthorized users
- [ ] Review access logs
- [ ] Check private_html directory
- [ ] Change all passwords
- [ ] Review file permissions
- [ ] Set up intrusion detection
---
## 🚨 CRITICAL WARNING
**The attacker had FULL ACCESS to your server:**
- ✅ Remote code execution (via `445367/index.php`)
- ✅ File manager access (via `445367/about.php`)
- ✅ Database access (via backdoors)
- ✅ File system access (browsing directories)
**You MUST:**
1. ✅ **Block the IP** - DONE
2. ✅ **Delete backdoors** - DONE
3. ⚠️ **Check for other backdoors** - TODO
4. ⚠️ **Review all file modifications** - TODO
5. ⚠️ **Change all passwords** - TODO
6. ⚠️ **Secure all directories** - TODO
---
**Status:** 🚨 **ATTACKER BLOCKED - ADDITIONAL SECURITY NEEDED**
The immediate threat is blocked, but you need to do a full security audit to ensure no other backdoors exist.