#1689331684
vim /home/blanktec/slow-queries-10-Jul-2023.txt 
#1689332329
cd hisvahan.com/public_html/
#1689332338
wp db repair && wp db optimize && wp cache flush
#1689332359
cd ../../atapol/public_html/
#1689332362
wp db repair && wp db optimize && wp cache flush
#1690859916
find /home/blanktec/ -maxdepth 7 ! -path "/home/*/tmp/analog/*" -type f -size +250M -exec du -hsxc {} + | sort -rh
#1690973039
df -h
#1692196316
sudo su
#1692196317
ls
#1692196319
cd ..
#1692196353
ps -aux
#1692196360
ls
#1692196366
cd home/blanktec/
#1692196366
ls
#1692196379
cd etc/
#1692196381
cd blanktechs.com/
#1692196382
ls
#1692196383
cd ..
#1692196386
ls
#1692196391
cd public_html/
#1692196392
ls
#1692196394
cd ..
#1692196396
ls
#1692276874
cd public_html/
#1692276874
ls
#1692276876
cd css
#1692276877
ls
#1692276880
ls -al
#1692276885
cd ..
#1692276886
ls
#1692276891
nano .htaccess 
#1692357811
ls
#1692357814
cd public_html/
#1692357817
cd php/
#1692357817
ls
#1692357838
tail -f error_log 
#1692358030
ls
#1692358046
nano /var/log/alt-php
#1692358159
ls
#1692358244
tail -f error_log 
#1692358832
/usr/sbin/sendmail
#1692358851
/usr/sbin/sendmail -t -i
#1692358977
cd /var/log
#1692358977
ls
#1692358985
cd alt-php81-newrelic/
#1692358985
ls
#1692358986
cd ..
#1692358990
ls
#1692358996
cd run/
#1692358997
ls
#1692359000
cd ..
#1692359010
cd /usr/sbin/
#1692359010
ls
#1692359014
cd ..
#1692359019
ls
#1692359139
cd /home/blanktec/
#1692359140
ls
#1692359152
cd mail/
#1692359152
ls
#1692359160
ls -al
#1692359172
date
#1692359185
tail -f dovecot.index.log
#1692359195
cd blanktechs.com/
#1692359195
ls
#1692359196
cd ..
#1692359198
ls
#1692359201
cd logs/
#1692359201
ls
#1692359203
cd ..
#1692359206
cd access-logs/
#1692359208
ls
#1692359230
tail -f blanktechs.com 
#1692359237
ls
#1692359248
cd ..
#1692359248
ls
#1692359258
cd public_
#1692359260
cd public_html/
#1692359261
ls
#1692359269
cd php/
#1692359270
ls
#1692359274
tail -f error_log 
#1706117982
hosts
#1732931367
top
#1733432518
hosts
#1733432519
prop
#1747127138
find . -type d -print0 | xargs -0 chmod 0755 && find . -type f -print0 | xargs -0 chmod 0644
#1747127459
cd zcchina.reputeus.com/
#1747127463
wp core update
#1747127500
wp core version
#1773157871
df -h
#1773158472
du -ah . | sort -rh | head -n 20
#1776683951
du -sch * |grep G
#1780762375
cd reputeus/public_html
#1780762442
wp core download --force
#1780838496
ls -lah
#1780838504
cd public_html
#1780838507
ls -lah
#1780838524
cd penriths.com
#1780838537
wp core download --force --skip-content --version=7.0
#1780920481
cd /home/blanktec/parkinncityflorya.com
#1780920494
wp option get siteurl
#1780920496
   wp option get home
#1780920613
wp search-replace 'parkcityflorya.com.tr' 'X' --dry-run --all-tables 2>&1 | grep -v "no version information available"
#1780920646
wp search-replace 'parkcityflorya.com' 'parkinncityflorya.com' --all-tables --precise --recount --report-changed-only 2>&1 | grep -v "no version information available"
#1780920772
wp search-replace 'parkcityflorya.com' 'parkinncityflorya.com' --all-tables --precise --report-changed-only 2>&1 | grep -v "no version information available"
#1780920788
wp option get siteurl 2>&1 | grep -v "no version information available"
#1780920789
wp option get home 2>&1 | grep -v "no version information available"
#1780920812
wp db search 'home/blanktec' --all-tables 2>/dev/null | head -30
#1780920964
wp transient delete --all 2>&1 | grep -v "no version information available"
#1780920974
wp rewrite flush 2>&1 | grep -v "no version information available"
#1780920980
wp cache flush 2>&1 | grep -v "no version information available"
#1780920990
ls /home/blanktec/parkinncityflorya.com/wp-content/uploads/fusion-styles/ 2>/dev/null
#1780921004
rm -f /home/blanktec/parkinncityflorya.com/wp-content/uploads/fusion-styles/*.css
#1783759067
export PATH=/usr/local/bin:/usr/bin:/bin; echo "===== ENFEKTE wp-blog-header/index (lph/dosabedagenre) ====="; for f in $(find ~ -maxdepth 3 \( -name wp-blog-header.php -o -name index.php \) 2>/dev/null); do grep -qlE "lph_requests|dosabedagenre|preg_match\(.?\\\$botchar" "$f" 2>/dev/null && echo "INFECTED [$(wc -l < "$f")sat] $f"; done; echo "(bos=temiz)"; echo; echo "===== google-verify dosyalari ====="; find ~ -maxdepth 3 -iname "google*.html" 2>/dev/null; echo; echo "===== bilinen webshell adlari ====="; find ~ -maxdepth 3 \( -name loginwp.php -o -name "*bypass*plg*" -o -name gazian.php -o -name rtopslhqnd.php \) 2>/dev/null
#1783759138
export PATH=/usr/local/bin:/usr/bin:/bin; GB="Googlebot/2.1 (+http://www.google.com/bot.html)"; IP=172.105.84.81; echo "== CANLI Googlebot testi (verify dosyali siteler) =="; for d in koypantry.com seckinarikan.com bilgicopy.com piyaaccountancy.co.uk; do t=$(curl -s -k --resolve $d:443:$IP -A "$GB" https://$d/ 2>/dev/null | grep -oiE "<title>[^<]*</title>" | head -1); echo "$d => $t"; done; echo; echo "== genis cloak/backdoor imza (dosabedagenre|lph|followfromapps|md5.909) =="; grep -rlIE "dosabedagenre|lph_requests|followfromapps|a4300b002bcfb71f291dac175d52df94" ~/*.com ~/*.net ~/HMDDevs ~/ReputeUs-26 2>/dev/null | head -20; echo "(bos=temiz)"
#1783759284
clear; export PATH=/usr/local/bin:/usr/bin:/bin; echo "== genis cloak/backdoor imza taramasi (tum hesap PHP) =="; grep -rlIE "dosabedagenre|lph_requests|followfromapps|a4300b002bcfb71f291dac175d52df94|yahoo.*auction|yafuoku" ~ --include="*.php" 2>/dev/null | head -30; echo "(bos=temiz)"
#1783759518
export PATH=/usr/local/bin:/usr/bin:/bin; grep -rlIE "dosabedagenre|lph_requests|followfromapps|yafuoku|yahoo" ~ --include="*.php" 2>/dev/null | head -30; echo "GREP_BITT