APROFUNDAMENTO - Mon Aug 31 18:07:43 -03 2026 | vps-5708200.metacampinformatica.com.br ============ [A1] CONTA garciaeng - DIMENSAO DA INFECCAO ============ --- Estado da conta: NAO suspensa --- Total de PHP na conta: 0 --- Arquivos em wp-content/wp-atom: 0 --- Profundidade do aninhamento wp-content/wp-content/...: --- Datas (min/max) dos arquivos do kit: --- Primeiros 200 bytes de amostras (identificar familia do malware): --- index.php da raiz do garciaeng foi adulterado? --- Esses arquivos executam? (handler PHP ativo mesmo suspenso) ============ [A2] MESMA FAMILIA EM OUTRAS CONTAS? ============ Procurando os mesmos nomes de arquivo nas demais contas: (vazio = infeccao contida na conta garciaeng) --- Arquivos PHP ocultos (comecando com ponto) em todas as contas: ?? /home/catedralbotucatu/public_html/.index.php ?? /home/circuitoseguros/public_html/.index.php ?? /home/sidneyfedel/public_html/wp-admin__b41a00d/.index.php --- Diretorios de quarentena do provedor (sufixo __hex): drwxr-xr-x 2 sidneyfedel sidneyfedel 4096 Dec 17 2025 /home/sidneyfedel/public_html/57271__b41a00d drw-r--r-- 3 sidneyfedel sidneyfedel 4096 Dec 1 2025 /home/sidneyfedel/public_html/cgi-bin__b41a00d drwxr-xr-x 3 sidneyfedel sidneyfedel 4096 Jan 8 2026 /home/sidneyfedel/public_html/d828ae__b41a00d -rw-r--r-- 1 sidneyfedel sidneyfedel 919 Dec 3 2025 /home/sidneyfedel/public_html/error_log__b41a00d -rw-r--r-- 1 sidneyfedel sidneyfedel 53 Oct 24 2025 /home/sidneyfedel/public_html/googleb2628730716c5a90.html__b41a00d -rw-r--r-- 1 sidneyfedel sidneyfedel 53 Oct 29 2025 /home/sidneyfedel/public_html/googleeb6b0dd79be5db90.html__b41a00d -rw-r--r-- 1 sidneyfedel sidneyfedel 2712 Dec 17 2025 /home/sidneyfedel/public_html/index.php__b41a00d -rw-r--r-- 1 sidneyfedel sidneyfedel 19903 Dec 3 2025 /home/sidneyfedel/public_html/license.txt__b41a00d -rw-r--r-- 1 sidneyfedel sidneyfedel 7425 Dec 3 2025 /home/sidneyfedel/public_html/readme.html__b41a00d -rw-r--r-- 1 sidneyfedel sidneyfedel 327 Dec 1 2025 /home/sidneyfedel/public_html/robots.txt__b41a00d ============ [A3] ISOLAMENTO ENTRE CONTAS (risco de propagacao) ============ --- CageFS (isolamento por conta): ?? cagefsctl ausente - sem CageFS --- Handler PHP / usuario de execucao do Apache: DEFAULT PHP: ea-php71 ea-php56 SAPI: cgi ea-php71 SAPI: cgi ea-php73 SAPI: cgi ea-php74 SAPI: cgi ea-php80 SAPI: cgi --- Protecao contra symlink attack: --- wp-config.php legiveis por outros usuarios: ?? /home/catedralbotucatu/public_html/wp-config.php ?? /home/circuitoseguros/public_html/wp-config.php ?? /home/transkompa/public_html/wp-config.php --- Permissoes dos /home/*: drwxr-xr-x root /home/SYS-SNAP/ drwxr-xr-x root /home/cPanelInstall/ drwx--x--x catedralbotucatu /home/catedralbotucatu/ drwx--x--x circuitoseguros /home/circuitoseguros/ drwx--x--x metacampinformat /home/metacampinformat/ drwx--x--x serenityseguros /home/serenityseguros/ drwx--x--x sidneyfedel /home/sidneyfedel/ drwx--x--x transkompa /home/transkompa/ drwx--x--x root /home/virtfs/ ============ [A4] IMUNIFY360 - O QUE ELE JA VIU ============ --- Versao/estado: 8.6.10 --- Ultimas deteccoes de malware: --- Estado do scan e da licenca: OK ============ [A5] CRONTAB ORFA: cometogetherfnd ============ --- Usuario existe no sistema? id: cometogetherfnd: no such user entradas em passwd: 0 --- Conteudo integral do crontab: --- Metadados do arquivo: /var/spool/cron/cometogetherfnd | 2 bytes | modificado 2021-10-08 08:24:53 --- Home correspondente existe? ls: cannot access /home/cometogetherfnd: No such file or directory ============ [A6] LOGS ARQUIVADOS - RASTRO HISTORICO DO PHISHING ============ --- Logs mensais compactados por conta: -rw-r--r-- 1 catedralbotucatu catedralbotucatu 2.4K Feb 2 2024 /home/catedralbotucatu/logs/ftp.catedraldebotucatu.org.br-ftp_log-Feb-2024.gz -rw-r--r-- 1 catedralbotucatu catedralbotucatu 35K Jan 30 2024 /home/catedralbotucatu/logs/ftp.catedraldebotucatu.org.br-ftp_log-Jan-2024.gz -rw-r--r-- 1 catedralbotucatu catedralbotucatu 248 Mar 7 2023 /home/catedralbotucatu/logs/ftp.catedraldebotucatu.org.br-ftp_log-Mar-2023.gz -rw-r--r-- 1 catedralbotucatu catedralbotucatu 54K May 22 2021 /home/catedralbotucatu/logs/ftp.catedraldebotucatu.org.br-ftp_log-May-2021.gz -rw-r--r-- 1 catedralbotucatu catedralbotucatu 52K Sep 21 2022 /home/catedralbotucatu/logs/ftp.catedraldebotucatu.org.br-ftp_log-Sep-2022.gz -rw-r--r-- 1 circuitoseguros circuitoseguros 179K Aug 31 09:10 /home/circuitoseguros/logs/circuitoseguros.com.br-Aug-2026.gz -rw-r--r-- 1 circuitoseguros circuitoseguros 640K Aug 31 09:10 /home/circuitoseguros/logs/circuitoseguros.com.br-ssl_log-Aug-2026.gz -rw-r--r-- 1 circuitoseguros circuitoseguros 155K Aug 31 09:10 /home/circuitoseguros/logs/planodesaude.circuitoseguros.com.br-Aug-2026.gz -rw-r--r-- 1 circuitoseguros circuitoseguros 149K Aug 31 09:10 /home/circuitoseguros/logs/planodesaude.circuitoseguros.com.br-ssl_log-Aug-2026.gz -rw-r--r-- 1 circuitoseguros circuitoseguros 155K Aug 31 09:10 /home/circuitoseguros/logs/seguroresidencial.circuitoseguros.com.br-Aug-2026.gz -rw-r--r-- 1 circuitoseguros circuitoseguros 167K Aug 31 09:10 /home/circuitoseguros/logs/seguroresidencial.circuitoseguros.com.br-ssl_log-Aug-2026.gz -rw-r--r-- 1 metacampinformat metacampinformat 202K Aug 31 09:10 /home/metacampinformat/logs/metacampinformatica.com.br-Aug-2026.gz -rw-r--r-- 1 metacampinformat metacampinformat 3.2M Aug 31 09:10 /home/metacampinformat/logs/metacampinformatica.com.br-ssl_log-Aug-2026.gz -rw-r--r-- 1 serenityseguros serenityseguros 479K Aug 31 09:10 /home/serenityseguros/logs/serenityseguros.com.br-Aug-2026.gz -rw-r--r-- 1 serenityseguros serenityseguros 808K Aug 31 09:10 /home/serenityseguros/logs/serenityseguros.com.br-ssl_log-Aug-2026.gz -rw-r--r-- 1 sidneyfedel sidneyfedel 629 Jul 20 09:01 /home/sidneyfedel/logs/sidneyfedel.com.br-Jul-2026.gz -rw-r--r-- 1 sidneyfedel sidneyfedel 448K May 29 09:11 /home/sidneyfedel/logs/sidneyfedel.com.br-May-2026.gz -rw-r--r-- 1 sidneyfedel sidneyfedel 1.2K Jul 27 09:02 /home/sidneyfedel/logs/sidneyfedel.com.br-ssl_log-Jul-2026.gz -rw-r--r-- 1 transkompa transkompa 1.4M Aug 31 09:10 /home/transkompa/logs/transkompa.com.br-Aug-2026.gz -rw-r--r-- 1 transkompa transkompa 2.6M Aug 31 09:10 /home/transkompa/logs/transkompa.com.br-ssl_log-Aug-2026.gz --- Acessos historicos a earthlink-net nos arquivos compactados: --- Total historico e IPs de origem: total: 0 --- Acessos aos scripts do kit do garciaeng (uso ativo?): !! 20.226.5.174 - - [01/Aug/2026:12:46:25 -0300] "GET /wp-atomx.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0. !! 51.116.180.165 - - [15/Aug/2026:13:20:59 -0300] "GET /wp-atomx.php HTTP/1.1" 200 39293 "-" "-" !! 51.116.180.165 - - [15/Aug/2026:13:23:58 -0300] "GET /wp-atomx.php HTTP/1.1" 200 39293 "-" "-" !! 40.74.68.220 - - [16/Aug/2026:15:16:11 -0300] "GET /wp-atom.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0 !! 20.97.182.130 - - [23/Aug/2026:22:07:21 -0300] "GET /wp-atom.php HTTP/1.1" 200 39292 "-" "-" !! 20.97.182.130 - - [23/Aug/2026:22:10:16 -0300] "GET /wp-atom.php HTTP/1.1" 200 39292 "-" "-" !! 4.223.165.84 - - [15/Aug/2026:18:21:25 -0300] "GET /wp-atomx.php HTTP/1.1" 404 23582 "-" "-" !! 132.196.30.78 - - [24/Aug/2026:02:35:09 -0300] "GET /wp-atom.php HTTP/1.1" 301 - "-" "-" !! 20.250.10.77 - - [15/Aug/2026:06:08:19 -0300] "GET /wp-atomx.php HTTP/1.1" 404 24766 "-" "-" !! 20.151.128.234 - - [23/Aug/2026:18:36:31 -0300] "GET /wp-atom.php HTTP/1.1" 301 - "-" "-" !! 20.104.18.253 - - [31/Jul/2026:10:46:22 -0300] "GET /wp-atomx.php HTTP/1.1" 401 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120. !! 135.119.63.61 - - [31/Jul/2026:15:27:45 -0300] "GET /wp-atomx.php HTTP/1.1" 503 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 !! 20.104.18.253 - - [31/Jul/2026:20:01:38 -0300] "GET /wp-atomx.php HTTP/1.1" 200 12089 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1 !! 135.119.63.61 - - [31/Jul/2026:21:45:54 -0300] "GET /wp-atomx.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 !! 51.120.79.29 - - [14/Aug/2026:20:49:18 -0300] "GET /wp-atomx.php HTTP/1.1" 200 39305 "-" "-" !! 52.161.1.141 - - [13/Mar/2022:20:38:34 -0300] "GET /wp-includes/wp-atom.php HTTP/1.1" 301 142 "www.bing.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, l !! 20.25.110.166 - - [16/Mar/2022:23:47:08 -0300] "GET /wp-includes/wp-atom.php HTTP/1.1" 301 149 "www.bing.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, !! 20.25.110.166 - - [17/Mar/2022:06:00:32 -0300] "GET /wp-includes/wp-atom.php HTTP/1.1" 301 147 "www.bing.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, !! 20.25.110.166 - - [17/Mar/2022:09:13:39 -0300] "GET /wp-includes/wp-atom.php HTTP/1.1" 301 151 "www.bing.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, !! 104.208.88.72 - - [17/Mar/2022:21:29:21 -0300] "GET /wp-includes/wp-atom.php HTTP/1.1" 301 139 "www.bing.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, !! 52.161.1.141 - - [18/Mar/2022:02:40:56 -0300] "GET /wp-includes/wp-atom.php HTTP/1.1" 301 139 "www.bing.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, l !! 52.161.1.141 - - [18/Mar/2022:06:07:29 -0300] "GET /wp-includes/wp-atom.php HTTP/1.1" 301 139 "www.bing.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, l !! 104.208.88.72 - - [22/Mar/2022:13:17:16 -0300] "GET /wp-includes/wp-atom.php HTTP/1.1" 301 139 "www.bing.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, !! 40.77.68.81 - - [28/Mar/2022:00:59:04 -0300] "GET /wp-includes/wp-atom.php HTTP/1.1" 301 149 "www.bing.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li !! 40.77.68.81 - - [28/Mar/2022:08:00:39 -0300] "GET /wp-includes/wp-atom.php HTTP/1.1" 301 147 "www.bing.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li ============ [A7] E-MAIL: ORIGEM DOS ENVIOS ============ --- Envios por conta nas ultimas 24h: 533 cwd=/var/spool/exim 4 cwd=/root --- Autenticacoes SMTP por usuario (conta usada para spam aparece aqui): 41 A=dovecot_login:emissao@circuitoseguros.com.br 28 A=dovecot_login:circuitoseguros@circuitoseguros.com.br 9 A=dovecot_login:contato@circuitoseguros.com.br 6 A=dovecot_login:mauro@circuitoseguros.com.br 5 A=dovecot_login:caovila@circuitoseguros.com.br 4 A=dovecot_login:pendencias@circuitoseguros.com.br 3 A=dovecot_login:adm@circuitoseguros.com.br 2 A=dovecot_login:ariane.costa@circuitoseguros.com.br 1 A=dovecot_login:ygor@circuitoseguros.com.br 1 A=dovecot_login:sinistrosvarginha@circuitoseguros.com.br 1 A=dovecot_login:proposta@circuitoseguros.com.br 1 A=dovecot_login:comercial@circuitoseguros.com.br 1 A=dovecot_login:cadastro@circuitoseguros.com.br --- Rejeicoes por limite (indicio de tentativa de spam em massa): ocorrencias: 0 ============ [A8] DEFESAS - VERIFICACAO PRECISA ============ --- ModSecurity ativo? configs: [] command: modsec_get_configs --- Firewall em uso: Chain INPUT (policy ACCEPT) target prot opt source destination cphulk all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 /* Inbound Allow lo */ tcpchk tcp -- 0.0.0.0/0 0.0.0.0/0 udpchk udp -- 0.0.0.0/0 0.0.0.0/0 regras INPUT: 81 servicos: inactive active unknown --- cPHulk (protecao de forca bruta): --- PHP: versao por conta e funcoes perigosas: catedraldebotucatu.org.br -> padrao circuitoseguros.com.br -> padrao metacampinformatica.com.br -> padrao serenityseguros.com.br -> padrao sidneyfedel.com.br -> padrao transkompa.com.br -> padrao ea-php56: disable_functions = ea-php71: disable_functions = ea-php73: disable_functions = ea-php74: disable_functions = ea-php80: disable_functions =