eligio.nft

PHP Developer 3KXHPHYH

[eligio.nft @eligio]

@PLDT_Cares PLDT bulok, puro bot kausap, puro walang kwenta kausap.

[eligio.nft @eligio]

hahaha, sakto ata, meron ng internet after 3 days. haha

[eligio.nft @eligio]

Every month nalang meron outage, then ilang days mawawala. May pa Netflix at Cignal cable pa kayo na bundle. Ang bulok nyo! #PLDT @bamaquino @bongbongmarcos @indaysara @VicoSotto @risahontiveros @DtiPhilippines @IdolRaffyTulfo @netflix

[PLDT HOME @PLDTHome]

Bitin? Never sa #PLDTHomeFiberPrepaid 😉

Kayang-kayang sabayan ang activities ng buong pamilya dahil #SumaksesKaSaUnli

Mag-PLDT Prepaid na! 👉 https://t.co/UyOr21p8HD

[eligio.nft @eligio]

@everestchris6 BOT

[eligio.nft @eligio]

@tec_safwan KIDS

[NativePHP @nativephp]

NativePHP Desktop AND MOBILE are now FREEE!!!!

Guess what else is.... Github stars 🌟

Can ya hook a brother up?

[eligio.nft @eligio]

AppSumo's giving away a Claude + Mac + Lovable Stack 🔥 #giveaway https://t.co/bx7wFEnOU8

[Eduardo Borges @duborges]

i've been hacked

and traced the malware's wallet to see how much money they actually made from this new exploit

(if you use Next.js/React, READ THIS!)

I woke up to a terrifying email from Hetzner: "Netscan Detected."

my server was blocked and a botnet was using my IP to attack others

i dug into the logs and what I found the anatomy of the attack:

1) The Symptoms: I logged into htop and saw the mess:

- CPU usage: 361%
- A process named ./3ZU1yLK4 running wild
- Random connections to an IP in the Netherlands

my server wasn't serving my app anymore; it was mining crypto for someone else!

2) The Culprit: It wasn't a random SSH brute force. It was inside my Next.js container

the malware was sophisticated

it renamed itself nginxs and apaches to look like web servers

it even had a "killer" script that hunted down other hackers' miners to kill the competition

3) The "Root" Cause (literally): Probably the recent React/Next.js CVE-2025-66478 exploit was the entry point

(my project was running on "next": "15.5.4", behind cloudflare dns, but their recent fix didn't work apparently)

but the fatal error was mine: my Docker container was running as ROOT

Coolify deploys like this automatically when using Nixpacks, and I never changed it...

so because of USER root, the malware could install cron, systemd, and persistence scripts to survive reboots

meaning, it was able to infect my whole server, from a single Next.js docker!

4) The Forensics: I ran docker diff on the container - the hacker didn't just run a script, they installed a whole toolset..

- /tmp/apaches.sh (The installer)
- /var/spool/cron/root (The persistence)
- /c.json (The wallet config)

5) The Fix: I killed the container, scrubbed the host, and extracted the malware for analysis.

but the real fix is in the Dockerfile. if you are deploying Node/Next.js, DO NOT use the default (root), you must:

- RUN adduser --system nextjs
- USER nextjs

if you have Docker on ROOT and didn't update the exploited react version, you'll be hacked soon

check your containers NOW. Run: docker exec <container_id> id

(or get the full list first: docker stats --no-stream)

If it says uid=0(root), you are one vulnerability away from being a crypto-miner host.

(it's easy to notice when hacked, it will be a command running on the top CPU%, using all your hardware resources)

6) The Money: I dug deeper and recovered the config file (c.json)

- Wallet: A Monero (XMR) address: 831abXJn8dBdVe5nZ***
- Pool: auto.c3pool . org

and ofc i tracked the hacker’s wallet on the mining pool

7) The Scale: My server wasn't alone. It was just 1 of 415 active zombies in this botnet

they are burning the CPU of 400+ cloud servers... to earn...

guess how many millions?

$4.26/day

on the image attached you can see: "Total Paid: 0.00", meaning this campaign just started. I caught them on Day 1.

i also tracked back the server where they hosted the malware, and by inspecting the code, I found several comments in Chinese, so I guess that's their origin

im rebuilding from scratch on a fresh VPS. the lesson was expensive, but at least I caught it before the hosting nuked my account permanently...

PS: I have the IP for all the other machines mining with that malware, not sure how I can help them, but feel free to contact me if ur doing infosec

stay safe

[eligio.nft @eligio]

6 days and still no PLDT internet, in the Philippines, you need to secure 2 to 3 internet providers to properly WFH. #PLDT #TorreVsBaste #GOMO #WebDevelopment

[eligio.nft @eligio]

@PLDTHome @PLDT_Cares @pldt Ano na, nung friday pa kami walang internet, ibang street namin meron, kami wala, pangalawang customer service ticket na ako, sabi aayusin wala naman!!!!

[Benj Arriola @BenjArriola]

Lost SEO traffic after adding a cookie consent banner? You're not alone.

Learn how to estimate the organic search traffic and conversions you're missing using GSC, analytics, and a little math.

Don't fly blind: https://t.co/04plgo8efO
#SEO #GDPR #DigitalMarketing #Analytics

[eligio.nft @eligio]

@PLDT_Cares I thought it was fixed, nawalan nanaman after an hour
Pa dc dc sya. Wala na yung taga ayos.

[eligio.nft @eligio]

@PLDT_Cares ano na! Mag 2 weeks natong issue ko sa internet. Every morning 6am, 7am nawawala na internet. Tapos babalik for at least an hour tapos wala nanaman. minsan LOS, minsan green lahat pero no internet. Twice na ako nag report, may pending ticket pa. May promo pa kayo, hyp

[eligio.nft @eligio]

@PLDT_Cares Third party contractor from pldt fixed the issue. Thanks

[eligio.nft @eligio]

@PLDT_Cares Sa tingin mo may natira pang pasensya sa more than a week paputol putol na internet?

[Billions @billions_ntwk]

Introducing Billions: The Global Human &amp; AI Network

Today, we take the first step towards a future where billions of humans and AI agents can trust each other.

Here’s how we’re making it happen 🧵👇

[eligio.nft @eligio]

@billions_ntwk https://t.co/yCQNNfVW1P

[eligio.nft @eligio]

💧 I Got My AirDROP! Earned Tokens for my Twitter account age! #DropOnX

#Airdrop #Solana #SOL #Crypto

[eligio.nft @eligio]

Loot rush energy party is happening now. WOW @pixels_online @LootRushGames #LootRushEnergyParty