| <- Previous Log | Select Different Log | Next Log -> |
Searching from 2026-08-02 00:00:00 to 2026-08-02 23:59:59.999999. Query completed in 0.50 seconds [2026-08-02 00:38:52] <-- Lucifer_arma has quit (Quit: Konversation terminated!) [2026-08-02 01:04:54] <armagetronbridge> 14discord:aarond3403| /auth [2026-08-02 01:04:54] <armagetron-bridge> 14discord:aarond3403| /auth [2026-08-02 01:06:01] <armagetronbridge> 14discord:aarond3403| /auth [2026-08-02 01:06:01] <armagetron-bridge> 14discord:aarond3403| /auth [2026-08-02 01:06:31] <armagetronbridge> 13discord:xkx| #pickup-open !auth [2026-08-02 01:06:31] <armagetron-bridge> 13discord:xkx| #pickup-open !auth [2026-08-02 01:07:01] <armagetronbridge> 14discord:aarond3403| !auth [2026-08-02 01:07:01] <armagetron-bridge> 14discord:aarond3403| !auth [2026-08-02 02:12:19] <armagetronbridge> 04discord:olive2306| Dont need the tea eggs. Just crack them after they have boiled a bit. [2026-08-02 02:12:34] <armagetron-bridge> 04discord:olive2306| Dont need the tea eggs. Just crack them after they have boiled a bit. [2026-08-02 02:44:14] <armagetronbridge> 07discord:rynkoo| ? wdym [2026-08-02 02:44:15] <armagetron-bridge> 07discord:rynkoo| ? wdym [2026-08-02 02:50:03] <armagetronbridge> 04discord:olive2306| Boil eggs for a few minutes, take them oil, crack the shell, boil in tea and leave overnight to soak [2026-08-02 02:50:03] <armagetron-bridge> 04discord:olive2306| Boil eggs for a few minutes, take them oil, crack the shell, boil in tea and leave overnight to soak [2026-08-02 07:21:14] <armagetronbridge> 15discord:syre0299| @vegannem come to das [2026-08-02 07:21:14] <armagetron-bridge> 15discord:syre0299| @vegannem come to das [2026-08-02 07:22:07] <armagetronbridge> 07discord:syn_acc| do you just use black tea [2026-08-02 07:22:07] <armagetron-bridge> 07discord:syn_acc| do you just use black tea [2026-08-02 07:22:09] <armagetronbridge> 07discord:syn_acc| or is it spiced [2026-08-02 07:22:09] <armagetron-bridge> 07discord:syn_acc| or is it spiced [2026-08-02 08:36:27] <armagetronbridge> 04discord:olive2306| Spices too [2026-08-02 08:36:27] <armagetron-bridge> 04discord:olive2306| Spices too [2026-08-02 09:15:39] <armagetronbridge> 07discord:syn_acc| whats your usual [2026-08-02 09:15:39] <armagetron-bridge> 07discord:syn_acc| whats your usual [2026-08-02 09:15:42] <armagetronbridge> 07discord:syn_acc| imma try some [2026-08-02 09:15:42] <armagetron-bridge> 07discord:syn_acc| imma try some [2026-08-02 11:16:36] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| just got sshd backdoored. feel asleeo yesterday woke up my pc was really slow i rebooted come to find out my login password was changed i then checked the logs and seen someone around 2:55pm gained rssh access and replaced my ssh key and a node user and installed a malware/ cryptomining malware. The attack came from ElPatrono1337 i mentioned to some people week ago about me getti <clipped message> [2026-08-02 11:16:36] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| just got sshd backdoored. feel asleeo yesterday woke up my pc was really slow i rebooted come to find out my login password was changed i then checked the logs and seen someone around 2:55pm gained rssh access and replaced my ssh key and a node user and installed a malware/ cryptomining malware. The attack came from ElPatrono1337 i mentioned to some people week ago about me getti <clipped message> [2026-08-02 11:16:36] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| ng possibly ddosed well this was because this whole time they been brute forcing my ssh key. First virus ive had before on linux/arch linux since ive switched to windows scary stuff it even speards through the network. be pretty damaging for a bunch of servers. [2026-08-02 11:16:37] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| ng possibly ddosed well this was because this whole time they been brute forcing my ssh key. First virus ive had before on linux/arch linux since ive switched to windows scary stuff it even speards through the network. be pretty damaging for a bunch of servers. [2026-08-02 11:16:37] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| https://tehtris.com/en/blog/linux-focus-on-a-cryptomining-attack-dubbed-color1337/ [2026-08-02 11:16:38] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| https://tehtris.com/en/blog/linux-focus-on-a-cryptomining-attack-dubbed-color1337/ [2026-08-02 11:17:42] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| i know for fact it was a shh into my pc bc the shh port was open when my pc was on and the ssh key they created had the name ElPatrono1337 in it [2026-08-02 11:17:42] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| i know for fact it was a shh into my pc bc the shh port was open when my pc was on and the ssh key they created had the name ElPatrono1337 in it [2026-08-02 12:15:17] <armagetronbridge> 15discord:girtrude| it was me [2026-08-02 12:15:17] <armagetron-bridge> 15discord:girtrude| it was me [2026-08-02 12:26:11] <armagetronbridge> 07discord:syn_acc| you should figure out exactly what happened and which vulnerability was exploited [2026-08-02 12:26:11] <armagetron-bridge> 07discord:syn_acc| you should figure out exactly what happened and which vulnerability was exploited [2026-08-02 12:28:48] <armagetronbridge> 07discord:rynkoo| i mean this seems like just basic ssh unsecure config, probably the default [2026-08-02 12:28:48] <armagetron-bridge> 07discord:rynkoo| i mean this seems like just basic ssh unsecure config, probably the default [2026-08-02 12:29:07] <armagetronbridge> 07discord:syn_acc| no “seems like” [2026-08-02 12:29:07] <armagetron-bridge> 07discord:syn_acc| no “seems like” [2026-08-02 12:29:39] <armagetronbridge> 07discord:syn_acc| if you have been hacked and you run systems you are obligated to do at least this [2026-08-02 12:29:39] <armagetron-bridge> 07discord:syn_acc| if you have been hacked and you run systems you are obligated to do at least this [2026-08-02 12:29:51] <armagetronbridge> 07discord:syn_acc| then figure out if your hosting platform is gonna come for your ass [2026-08-02 12:29:51] <armagetron-bridge> 07discord:syn_acc| then figure out if your hosting platform is gonna come for your ass [2026-08-02 12:30:01] <armagetronbridge> 07discord:syn_acc| they don’t want insecure bitcoin miners [2026-08-02 12:30:01] <armagetron-bridge> 07discord:syn_acc| they don’t want insecure bitcoin miners [2026-08-02 12:30:34] <armagetronbridge> 07discord:syn_acc| it’s very typical to expose SSH. that doesn’t mean you get insta pwned [2026-08-02 12:30:34] <armagetron-bridge> 07discord:syn_acc| it’s very typical to expose SSH. that doesn’t mean you get insta pwned [2026-08-02 12:30:40] <armagetronbridge> 07discord:syn_acc| a mistake was made [2026-08-02 12:30:40] <armagetron-bridge> 07discord:syn_acc| a mistake was made [2026-08-02 12:31:35] <armagetronbridge> 07discord:rynkoo| i just base it off them saying someone was brute forcing their ssh key in their message [2026-08-02 12:31:35] <armagetron-bridge> 07discord:rynkoo| i just base it off them saying someone was brute forcing their ssh key in their message [2026-08-02 12:33:12] <armagetronbridge> 07discord:rynkoo| and ssh password authentication is already known to have poor security if that's what was being used [2026-08-02 12:33:12] <armagetron-bridge> 07discord:rynkoo| and ssh password authentication is already known to have poor security if that's what was being used [2026-08-02 12:33:18] <armagetronbridge> 13discord:xkx| blah blah blah [2026-08-02 12:33:18] <armagetron-bridge> 13discord:xkx| blah blah blah [2026-08-02 12:33:34] <armagetronbridge> 13discord:xkx| anyways @syn_acc @rynkoo are yall signed up for ctf tourny? [2026-08-02 12:33:34] <armagetron-bridge> 13discord:xkx| anyways @syn_acc @rynkoo are yall signed up for ctf tourny? [2026-08-02 12:33:42] <armagetronbridge> 07discord:rynkoo| i am agent free [2026-08-02 12:33:42] <armagetron-bridge> 07discord:rynkoo| i am agent free [2026-08-02 12:33:46] <armagetronbridge> 13discord:xkx| ok good [2026-08-02 12:33:47] <armagetron-bridge> 13discord:xkx| ok good [2026-08-02 12:33:53] <armagetronbridge> 13discord:xkx| wbu syn [2026-08-02 12:33:53] <armagetron-bridge> 13discord:xkx| wbu syn [2026-08-02 12:34:56] <armagetronbridge> 07discord:syn_acc| yep but again, there’d be logs of this [2026-08-02 12:34:56] <armagetron-bridge> 07discord:syn_acc| yep but again, there’d be logs of this [2026-08-02 12:35:16] <armagetronbridge> 13discord:xkx| bro is ignoring the more important thing [2026-08-02 12:35:17] <armagetron-bridge> 13discord:xkx| bro is ignoring the more important thing [2026-08-02 12:35:29] <armagetronbridge> 07discord:syn_acc| fail2ban @duckyonquack.999 get this [2026-08-02 12:35:29] <armagetron-bridge> 07discord:syn_acc| fail2ban @duckyonquack.999 get this [2026-08-02 12:35:33] <armagetronbridge> 07discord:syn_acc| and please don’t ignore me [2026-08-02 12:35:33] <armagetron-bridge> 07discord:syn_acc| and please don’t ignore me [2026-08-02 12:35:42] <armagetronbridge> 13discord:xkx| bro invited me [2026-08-02 12:35:42] <armagetron-bridge> 13discord:xkx| bro invited me [2026-08-02 12:35:45] <armagetronbridge> 13discord:xkx| ignored* [2026-08-02 12:35:45] <armagetron-bridge> 13discord:xkx| ignored* [2026-08-02 12:35:51] <armagetronbridge> 13discord:xkx| and is asking people to not ignore him [2026-08-02 12:35:51] <armagetron-bridge> 13discord:xkx| and is asking people to not ignore him [2026-08-02 12:36:02] <armagetronbridge> 07discord:syn_acc| forgive me for prioritising user information security than ctf [2026-08-02 12:36:02] <armagetron-bridge> 07discord:syn_acc| forgive me for prioritising user information security than ctf [2026-08-02 12:36:08] <armagetronbridge> 07discord:rynkoo| yeah agree [2026-08-02 12:36:08] <armagetron-bridge> 07discord:rynkoo| yeah agree [2026-08-02 12:36:10] <armagetronbridge> 13discord:xkx| ctf is years above that [2026-08-02 12:36:10] <armagetron-bridge> 13discord:xkx| ctf is years above that [2026-08-02 12:36:39] <armagetronbridge> 07discord:syn_acc| i’ve seen systems get exploited, “patched” and then exploited again through the exact same initial vector [2026-08-02 12:36:39] <armagetron-bridge> 07discord:syn_acc| i’ve seen systems get exploited, “patched” and then exploited again through the exact same initial vector [2026-08-02 12:37:07] <armagetronbridge> 13discord:xkx| https://cdn.discordapp.com/attachments/209759416604426242/1533513992675393576/IMG_0809.png?ex=6a70c3b3&is=6a6f7233&hm=3b466101f84f4d1282a82f0d7eeeb7fea3c978a79282055ea4f2e518792fb579& [2026-08-02 12:37:07] <armagetron-bridge> 13discord:xkx| https://cdn.discordapp.com/attachments/209759416604426242/1533513992675393576/IMG_0809.png?ex=6a70c3b3&is=6a6f7233&hm=3b466101f84f4d1282a82f0d7eeeb7fea3c978a79282055ea4f2e518792fb579& [2026-08-02 12:37:23] <armagetronbridge> 07discord:syn_acc| hacker [2026-08-02 12:37:23] <armagetron-bridge> 07discord:syn_acc| hacker [2026-08-02 12:37:27] <armagetronbridge> 13discord:xkx| shit [2026-08-02 12:37:28] <armagetron-bridge> 13discord:xkx| shit [2026-08-02 12:49:15] <armagetronbridge> 08discord:delinquent| @duckyonquack.999 takeaways: [2026-08-02 12:49:15] <armagetron-bridge> 08discord:delinquent| @duckyonquack.999 takeaways: [2026-08-02 12:49:15] <armagetron-bridge> 08discord:delinquent| You **NEED** to install fail2ban and get it running [2026-08-02 12:49:16] <armagetronbridge> 08discord:delinquent| You **NEED** to install fail2ban and get it running [2026-08-02 12:49:17] <armagetron-bridge> 08discord:delinquent| You **NEED** to use certificates instead of passwords ( @lxvixk this is why the first thing we did with your new vps is set up cert auth) [2026-08-02 12:49:17] <armagetronbridge> 08discord:delinquent| You **NEED** to use certificates instead of passwords ( @lxvixk this is why the first thing we did with your new vps is set up cert auth) [2026-08-02 12:49:18] <armagetron-bridge> 08discord:delinquent| You **NEED** to follow our suggestions about reputable third party providers for payment stuff [2026-08-02 12:49:18] <armagetronbridge> 08discord:delinquent| You **NEED** to follow our suggestions about reputable third party providers for payment stuff [2026-08-02 12:49:19] <armagetron-bridge> 08discord:delinquent| You **NEED** to install an SSL certificate *pronto*. [2026-08-02 12:49:20] <armagetronbridge> 08discord:delinquent| You **NEED** to install an SSL certificate *pronto*. [2026-08-02 12:51:30] <armagetronbridge> 13discord:xkx| ohhhhh [2026-08-02 12:51:30] <armagetron-bridge> 13discord:xkx| ohhhhh [2026-08-02 12:51:36] <armagetronbridge> 08discord:delinquent| Also you should stop using the default site config for apache/nginx/whatever, and instead use a proper vhost so that pointing a browser at your IP does not result in proper site access. [2026-08-02 12:51:36] <armagetron-bridge> 08discord:delinquent| Also you should stop using the default site config for apache/nginx/whatever, and instead use a proper vhost so that pointing a browser at your IP does not result in proper site access. [2026-08-02 12:51:37] <armagetronbridge> 08discord:delinquent| Please take my (very) string recs on board. I do this shit professionally. I don't use an LLM, this is career experience. The bare minimum you need to do is fail2ban, ssl, and third party stuff. Certs are strongly recommended. [2026-08-02 12:51:37] <armagetron-bridge> 08discord:delinquent| Please take my (very) string recs on board. I do this shit professionally. I don't use an LLM, this is career experience. The bare minimum you need to do is fail2ban, ssl, and third party stuff. Certs are strongly recommended. [2026-08-02 12:52:56] <armagetronbridge> 08discord:delinquent| And yes, I know my servers don't *all* use certs. That's because they reject SSH attempts from any IP apart from my own, which is static. At some point I will convert this to hostnames, too, so I can fix up Nelg's access. [2026-08-02 12:52:56] <armagetron-bridge> 08discord:delinquent| And yes, I know my servers don't *all* use certs. That's because they reject SSH attempts from any IP apart from my own, which is static. At some point I will convert this to hostnames, too, so I can fix up Nelg's access. [2026-08-02 12:57:53] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| The Attack Timeline (Aug 1): [2026-08-02 12:57:53] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| The Attack Timeline (Aug 1): [2026-08-02 12:57:53] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| 1. ~before 14:53: Attacker brute-forced SSH (sshd had password auth + root login enabled since install via 10-archiso.conf) [2026-08-02 12:57:54] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| 1. ~before 14:53: Attacker brute-forced SSH (sshd had password auth + root login enabled since install via 10-archiso.conf) [2026-08-02 12:57:55] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| 2. 14:53:36: Created backdoor user node (uid 1001) [2026-08-02 12:57:55] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| 2. 14:53:36: Created backdoor user node (uid 1001) [2026-08-02 12:57:56] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| 3. 14:53: Replaced authorized_keys with ElPatrono1337 key [2026-08-02 12:57:57] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| 3. 14:53: Replaced authorized_keys with ElPatrono1337 key [2026-08-02 12:57:57] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| 4. 14:53: Added /etc/sudoers.d/node → node ALL=(ALL:ALL) NOPASSWD:ALL [2026-08-02 12:57:58] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| 4. 14:53: Added /etc/sudoers.d/node → node ALL=(ALL:ALL) NOPASSWD:ALL [2026-08-02 12:57:58] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| 5. 14:53: Wrote root crontab entry (miner persistence) [2026-08-02 12:57:59] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| 5. 14:53: Wrote root crontab entry (miner persistence) [2026-08-02 12:58:00] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| 6. 14:53: Changed user's password to lock them out [2026-08-02 12:58:01] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| 6. 14:53: Changed user's password to lock them out [2026-08-02 12:58:01] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| 7. 18:19: System crash (possibly miner/attacker killing it) [2026-08-02 12:58:02] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| 7. 18:19: System crash (possibly miner/attacker killing it) [2026-08-02 12:58:02] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| 8. 23:09: User did liveCD reset (but backdoors were still present) [2026-08-02 12:58:03] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| 8. 23:09: User did liveCD reset (but backdoors were still present) [2026-08-02 12:58:04] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| The Color1337 / ElPatrono1337 botnet: [2026-08-02 12:58:04] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| The Color1337 / ElPatrono1337 botnet: [2026-08-02 12:58:05] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| - Published malware indicator [2026-08-02 12:58:06] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| - Published malware indicator [2026-08-02 12:58:06] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| - Invirtuate incident report (June 2026) documents identical attack [2026-08-02 12:58:07] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| - Invirtuate incident report (June 2026) documents identical attack [2026-08-02 12:58:08] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| - Creates node user with same uid 1001 [2026-08-02 12:58:08] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| - Creates node user with same uid 1001 [2026-08-02 12:58:09] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| - SSH key fingerprint: SHA256:AkrAM6Cdbkqok1OHU527WzpYGQqPQJrubcEP9Dlj7yI / MD5:c7:02:8c:dc:d7:e3:35:99:81:7d:6a:4c:8a:b6:24:c3 [2026-08-02 12:58:10] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| - SSH key fingerprint: SHA256:AkrAM6Cdbkqok1OHU527WzpYGQqPQJrubcEP9Dlj7yI / MD5:c7:02:8c:dc:d7:e3:35:99:81:7d:6a:4c:8a:b6:24:c3 [2026-08-02 12:58:10] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| - MO: SSH brute-force → replace authorized_keys → create node user → root crontab → change password → install cryptominer → spread via LAN [2026-08-02 12:58:11] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| - MO: SSH brute-force → replace authorized_keys → create node user → root crontab → change password → install cryptominer → spread via LAN [2026-08-02 12:58:14] <armagetronbridge> 08discord:delinquent| Luigi, now is not the time for a post-mortem. Secure first, analyse later [2026-08-02 12:58:14] <armagetron-bridge> 08discord:delinquent| Luigi, now is not the time for a post-mortem. Secure first, analyse later [2026-08-02 12:58:29] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| https://cdn.discordapp.com/attachments/209759416604426242/1533519371320950825/message.txt?ex=6a70c8b5&is=6a6f7735&hm=e1d73f0fc9982b16e5229423c7c68962f8e01312712576ec486cd34a73490d86& [2026-08-02 12:58:29] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| https://cdn.discordapp.com/attachments/209759416604426242/1533519371320950825/message.txt?ex=6a70c8b5&is=6a6f7735&hm=e1d73f0fc9982b16e5229423c7c68962f8e01312712576ec486cd34a73490d86& [2026-08-02 12:58:44] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| thats the better report by opencode [2026-08-02 12:58:44] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| thats the better report by opencode [2026-08-02 12:59:26] <armagetronbridge> 08discord:delinquent| `PermitRootLogin yes` should *really* be `no` [2026-08-02 12:59:26] <armagetron-bridge> 08discord:delinquent| `PermitRootLogin yes` should *really* be `no` [2026-08-02 12:59:56] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| im good i already secured everything on a livelinuxcd iverified multiple times after the cron reinstalled everything again im pretty sure im good the ssh port now is closed [2026-08-02 12:59:56] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| im good i already secured everything on a livelinuxcd iverified multiple times after the cron reinstalled everything again im pretty sure im good the ssh port now is closed [2026-08-02 13:01:07] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| but yeah just something i would keep an eye out for idk how i got targeted by it [2026-08-02 13:01:07] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| but yeah just something i would keep an eye out for idk how i got targeted by it [2026-08-02 13:04:34] <armagetronbridge> 08discord:delinquent| you weren't directly targeted. There are hundreds of thousands of bots out there crawling for insecure SSH connections. [2026-08-02 13:04:34] <armagetron-bridge> 08discord:delinquent| you weren't directly targeted. There are hundreds of thousands of bots out there crawling for insecure SSH connections. [2026-08-02 13:08:51] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| crazy def gunna try and be more secure but yeah from reports it targets linux so my guess it trys to target server pcs with enough cpu power to cryptomine and my intel i9-9900kf was proabnly some how flaged when they got my ip just my guess just would check your servers just in case because its post to also try and collect information to send baCk to then spread else where so tha <clipped message> [2026-08-02 13:08:51] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| crazy def gunna try and be more secure but yeah from reports it targets linux so my guess it trys to target server pcs with enough cpu power to cryptomine and my intel i9-9900kf was proabnly some how flaged when they got my ip just my guess just would check your servers just in case because its post to also try and collect information to send baCk to then spread else where so tha <clipped message> [2026-08-02 13:08:52] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| ts my best guess crazy times we live in [2026-08-02 13:08:52] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| ts my best guess crazy times we live in [2026-08-02 13:10:38] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| especially with it taking also advatage off ssh it put server computers you use ssh to remote into at risk [2026-08-02 13:10:38] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| especially with it taking also advatage off ssh it put server computers you use ssh to remote into at risk [2026-08-02 13:12:07] <armagetronbridge> 14discord:˚.✦Rx.Luigi✦.˚| it wasnt my site or my vps it was my home pcc [2026-08-02 13:12:07] <armagetron-bridge> 14discord:˚.✦Rx.Luigi✦.˚| it wasnt my site or my vps it was my home pcc [2026-08-02 13:18:05] <armagetronbridge> 08discord:delinquent| you... you had ssh enabled on your desktop !? [2026-08-02 13:18:06] <armagetron-bridge> 08discord:delinquent| you... you had ssh enabled on your desktop !? [2026-08-02 13:19:12] <armagetronbridge> 07discord:syn_acc| ssh certificate auth is not a thing deli [2026-08-02 13:19:12] <armagetron-bridge> 07discord:syn_acc| ssh certificate auth is not a thing deli [2026-08-02 13:19:17] <armagetronbridge> 07discord:syn_acc| i assume you mean key based auth [2026-08-02 13:19:17] <armagetron-bridge> 07discord:syn_acc| i assume you mean key based auth [2026-08-02 13:19:27] <armagetronbridge> 07discord:syn_acc| if so then yes, agree [2026-08-02 13:19:27] <armagetron-bridge> 07discord:syn_acc| if so then yes, agree [2026-08-02 13:19:31] <armagetronbridge> 07discord:syn_acc| dont use ssh password [2026-08-02 13:19:32] <armagetron-bridge> 07discord:syn_acc| dont use ssh password [2026-08-02 13:19:38] <armagetronbridge> 07discord:syn_acc| if you do set it STUPID hard to crack [2026-08-02 13:19:38] <armagetron-bridge> 07discord:syn_acc| if you do set it STUPID hard to crack [2026-08-02 13:20:15] <armagetronbridge> 07discord:syn_acc| ...you ssh into root? [2026-08-02 13:20:15] <armagetron-bridge> 07discord:syn_acc| ...you ssh into root? [2026-08-02 13:20:31] <armagetronbridge> 07discord:syn_acc| these logs still dont show enough imo [2026-08-02 13:20:31] <armagetron-bridge> 07discord:syn_acc| these logs still dont show enough imo [2026-08-02 13:20:37] <armagetronbridge> 07discord:syn_acc| you have a likely password crack [2026-08-02 13:20:37] <armagetron-bridge> 07discord:syn_acc| you have a likely password crack [2026-08-02 13:21:11] <armagetronbridge> 08discord:delinquent| um [2026-08-02 13:21:11] <armagetron-bridge> 08discord:delinquent| um [2026-08-02 13:21:12] <armagetron-bridge> 08discord:delinquent| yes. I keep swapping words abotu lately, it's a new thing apparently. [2026-08-02 13:21:12] <armagetronbridge> 08discord:delinquent| yes. I keep swapping words abotu lately, it's a new thing apparently. [2026-08-02 13:22:01] <armagetronbridge> 07discord:syn_acc| weak password + auth straight into root [2026-08-02 13:22:01] <armagetron-bridge> 07discord:syn_acc| weak password + auth straight into root [2026-08-02 13:22:08] <armagetronbridge> 07discord:syn_acc| stupid insecure [2026-08-02 13:22:08] <armagetron-bridge> 07discord:syn_acc| stupid insecure [2026-08-02 13:24:41] <armagetronbridge> 07discord:syn_acc| home network being compromised is up there with one of my worst fears [2026-08-02 13:24:41] <armagetron-bridge> 07discord:syn_acc| home network being compromised is up there with one of my worst fears [2026-08-02 13:25:05] <armagetronbridge> 07discord:syn_acc| @duckyonquack.999 you mentioned it spreading to LAN. if this is your home network that means its your other machines [2026-08-02 13:25:05] <armagetron-bridge> 07discord:syn_acc| @duckyonquack.999 you mentioned it spreading to LAN. if this is your home network that means its your other machines [2026-08-02 13:25:06] <armagetron-bridge> 15discord:pruword| heya, anyone need a sub during ladle? [2026-08-02 13:25:06] <armagetronbridge> 15discord:pruword| heya, anyone need a sub during ladle? [2026-08-02 13:25:23] <armagetronbridge> 13discord:xkx| #ladle they do need some for open team i think [2026-08-02 13:25:24] <armagetron-bridge> 13discord:xkx| #ladle they do need some for open team i think [2026-08-02 13:25:28] <armagetronbridge> 13discord:xkx| go to that channel and ask [2026-08-02 13:25:28] <armagetron-bridge> 13discord:xkx| go to that channel and ask [2026-08-02 13:25:31] <armagetronbridge> 13discord:xkx| asap [2026-08-02 13:25:31] <armagetron-bridge> 13discord:xkx| asap [2026-08-02 13:25:34] <armagetronbridge> 15discord:pruword| thanks [2026-08-02 13:25:34] <armagetron-bridge> 15discord:pruword| thanks [2026-08-02 13:29:32] <armagetronbridge> 07discord:syn_acc| @duckyonquack.999 check your machine for a binary called `aliases` [2026-08-02 13:29:33] <armagetron-bridge> 07discord:syn_acc| @duckyonquack.999 check your machine for a binary called `aliases` [2026-08-02 13:29:50] <armagetronbridge> 07discord:syn_acc| its the module this threat actor is known to install on compromised machines to allow your machine to help compromise others [2026-08-02 13:29:50] <armagetron-bridge> 07discord:syn_acc| its the module this threat actor is known to install on compromised machines to allow your machine to help compromise others [2026-08-02 13:30:39] <armagetronbridge> 07discord:syn_acc| looks like a romanian APT called [Diicot](https://www.darktrace.com/blog/tracking-diicot-an-emerging-romanian-threat-actor) [2026-08-02 13:30:40] <armagetron-bridge> 07discord:syn_acc| looks like a romanian APT called [Diicot](https://www.darktrace.com/blog/tracking-diicot-an-emerging-romanian-threat-actor) [2026-08-02 13:41:27] --> Burguh has joined the channel [2026-08-02 13:41:29] <-- Burguh has quit () [2026-08-02 14:55:04] --> Monkey_arma has joined the channel [2026-08-02 14:55:29] <-- Monkey_arma has quit (Client Quit) [2026-08-02 17:43:59] <armagetronbridge> 03discord:Taco| ha, great name [2026-08-02 17:43:59] <armagetron-bridge> 03discord:Taco| ha, great name [2026-08-02 19:36:53] <armagetronbridge> 07discord:kwtee| @lxvixk nice ragequit [2026-08-02 19:36:53] <armagetron-bridge> 07discord:kwtee| @lxvixk nice ragequit [2026-08-02 23:47:37] <armagetronbridge> 15discord:pruword| @Lucifer: Not necessarily, you get 1m tokens with Fable or Opus as far as I know. I mean you pay a certain amount for your subscription and then you burn the "token credits" until you use up your weekly limit. Writing long precise prompts is better than writing a lot of short ones. They've disabled Fable for us 20€/$ subscribers but Opus 5 works just as well 90% of the time, on <clipped message> [2026-08-02 23:47:37] <armagetron-bridge> 15discord:pruword| @Lucifer: Not necessarily, you get 1m tokens with Fable or Opus as far as I know. I mean you pay a certain amount for your subscription and then you burn the "token credits" until you use up your weekly limit. Writing long precise prompts is better than writing a lot of short ones. They've disabled Fable for us 20€/$ subscribers but Opus 5 works just as well 90% of the time, on <clipped message> [2026-08-02 23:47:37] <armagetron-bridge> 15discord:pruword| ly a little slower at about half the tokens. [2026-08-02 23:47:38] <armagetronbridge> 15discord:pruword| ly a little slower at about half the tokens. [2026-08-02 23:49:54] <armagetronbridge> 15discord:pruword| It's a bit like rubber in armagetron, except you pay to have that rubber and the amount of rubber you can use up per week is finite... [2026-08-02 23:49:54] <armagetron-bridge> 15discord:pruword| It's a bit like rubber in armagetron, except you pay to have that rubber and the amount of rubber you can use up per week is finite... [2026-08-02 23:54:30] <armagetronbridge> 15discord:pruword| There is a fuctionality in your settings to automatically buy more tokens if you're running out of them but personally I wouldn't do that [2026-08-02 23:54:30] <armagetron-bridge> 15discord:pruword| There is a fuctionality in your settings to automatically buy more tokens if you're running out of them but personally I wouldn't do that [2026-08-02 23:56:42] <armagetronbridge> 15discord:pruword| If you want to use Fable which is 1m tokens by default, then you need that 100$ subscription and for me that'll burn money I need to get by. [2026-08-02 23:56:42] <armagetron-bridge> 15discord:pruword| If you want to use Fable which is 1m tokens by default, then you need that 100$ subscription and for me that'll burn money I need to get by. [2026-08-02 23:57:51] <armagetronbridge> 15discord:pruword| https://youtu.be/-0HRzXk8vlk?si=nb1BL1KpZIDHb-Dq [2026-08-02 23:57:51] <armagetron-bridge> 15discord:pruword| https://youtu.be/-0HRzXk8vlk?si=nb1BL1KpZIDHb-DqView entire month
is a site that has tools, maps, and other various items. It orignally only existed as a server control panel, but I slowly began adding stuff such as a homepage and tools.
----
This is an LLM-free zone. In general, I am unwilling to use (fight with) any form of "GenAI" to write code for me. So, for the forseeable future, everything on this site will continue to be written by a very silly goose (wait that's me honk honk) with some parts written by other humans as well (silly hu-mon) rather than any plausible-series-of-words token-eating machine. Even my libraries are out of date, and suddenly that's a good thing!
(Although the style has changed several times and content has been added and changed, the base of this site has barely been updated since 2015. But it Ain't Broke!)
This site is also occasionally tested with older browsers, but compatibility is not guarenteed. Although, if you have an old obscure browser and something isn't working that previously did, I guess you can tell me (nelg) about it...
Gridder
.