Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon - Check Point Research

What Happened

Since mid-2025, a hacker group linked to a known Chinese cybercrime organization called Earth Berberoka has been breaking into Brazilian government websites and using them to push fraudulent gambling and fake app-store pages. The attackers install hidden software on the web servers that redirects certain visitor requests to fake websites while making it look like the pages are coming from the legitimate government domains. This makes the fake pages rank higher in search results because search engines trust government websites. The fake pages impersonate Google Play, Microsoft Store, and Amazon to trick people into downloading malicious apps. The same approach is being expanded to Vietnam, Spain, and English-speaking countries. Brazilian organizations should audit their Apache web servers for unknown modules, check SSH configurations, and patch internet-facing services to prevent further abuse.

Key Takeaways

• A Chinese-speaking threat group linked to Earth Berberoka compromised Brazilian government web servers to serve phishing and gambling content via custom Apache reverse-proxy modules.
• The campaign deploys a full Linux toolkit including DownPro downloader, AlphaAgent and oRAT backdoors, a 3snake-based credential stealer, SSH brute-forcer, and recon scripts with Chinese-language comments.
• Custom Apache modules (opsproxy.c and a content-injection module) intercept requests matching hardcoded URL prefixes (/wps, /bmw, /card) and reverse-proxy traffic to attacker-controlled phishing infrastructure while stripping CSP headers.
• The same infrastructure is being adapted for Vietnamese, Spanish, and English targets, with daily domain generators producing fresh domains to outpace blocklists.
• C2 communication uses gRPC over HTTPS with Google API camouflage, DNS tunneling on port 53, and an embedded SSH server inside oRAT, with geofencing that exits if the host is in China.

Affected Systems

• Linux web servers running Apache (Debian/Ubuntu and CentOS/RedHat)
• Brazilian government .gov.br domains (federal ministries, state assemblies, state courts, municipal administrations)
• Brazilian commercial .com.br sites (news outlets, health clinics, business associations)
• Internet-facing services with weak SSH credentials or unpatched vulnerabilities

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Compromise of internet-facing Linux web servers via unpatched services or weak SSH credentials on Brazilian government and commercial domains
2. Reconnaissance: Deployment of info.sh and findweb.sh scripts to inventory SSH keys, bash history, network mounts, web-server configurations, virtual hosts, and reverse-proxy rules
3. Execution: DownPro Go downloader fetches additional toolkit components including AlphaAgent, oRAT, ChUser backdoor, and PasswordHarvester, dropping payloads to system-mimicking paths
4. Persistence: Custom Apache modules (opsproxy.c and content-injection module) compiled on victim via apxs and wired into Apache config; oRAT registers as systemd service xtables-addons; ChUser installed as setuid binary at /usr/bin/chuser
5. Defense Evasion: Process names spoofed to mimic kernel threads (kworker, ksoftirqd, systemd); timestomping of .so files to match legitimate Apache modules; SELinux disabled; source files and build artifacts deleted after compilation
6. C2 and Exfiltration: AlphaAgent communicates via gRPC over HTTPS with Google API camouflage or DNS tunneling on port 53; oRAT exposes embedded SSH server; credential stealer exfiltrates captured credentials RC4-encrypted and Base64-encoded; phishing pages served via reverse-proxy through compromised .gov.br domains

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article does not include detection rules. It provides SHA256 hashes, domains, and IP addresses that can be used to build custom detections.

Detection Engineering Assessment

Required Log Sources

• Apache access and error logs (for /wps, /bmw, /card URI prefix patterns)
• Apache module configuration changes (apxs invocation, new .so files in modules directory)
• Linux process execution logs with full command-line arguments (for process name spoofing and masquerading)
• Linux auditd or EDR telemetry for ptrace syscalls, netlink socket subscriptions, and bind-mount operations
• DNS query logs (for TXT-record tunneling patterns and Base32-encoded payloads)
• SSH authentication logs (for brute-force patterns and unusual SSH sessions)
• File integrity monitoring for /etc/protocols modifications and new files in /usr/local/bin/
• Systemd service creation logs for xtables-addons service registration

Hunting Hypotheses

Control Gaps

• Signature-based antivirus would not detect the custom Apache modules compiled on-host from source
• Network-level DNS filtering may not catch Base32-encoded DNS tunneling to newly registered domains
• File integrity monitoring may miss timestomped files if it relies on modification timestamps rather than cryptographic hashes
• Process allowlisting would not flag processes masquerading as legitimate kernel threads or system daemons
• Web application firewalls may not detect the reverse-proxy module since traffic appears to originate from the legitimate compromised domain
• CSP enforcement is bypassed by the Apache module stripping and replacing CSP headers on proxied paths

Key Behavioral Indicators

• Apache access log entries for URI paths /wps, /bmw, or /card on domains that should not serve content at those paths
• New .so files in Apache modules directory with timestamps matching existing modules like mod_ssl or mod_suexec
• Process names matching kernel threads (kworker, ksoftirqd, watchdog, migration, kswapd) running with non-zero UID or outside PID 2
• setenforce 0 followed by systemd service registration for xtables-addons
• Files written to /usr/local/bin/ with names mimicking system utilities (systemd-udevd, rsync-tsl, tcp-tsl, snapd-ext, fsck-disk, nftables-init)
• setuid binary at /usr/bin/chuser with owner root and timestamp matching /bin/ls
• GUID comment lines appended to /etc/protocols
• Lock file at /tmp/.lock with no corresponding legitimate process
• gRPC traffic to api.google.com SNI with Cloudflare-style auth parameters (_cf_auth_ts, _cf_auth_nonce, _cf_auth_method) in HTTP headers
• DNS TXT queries to newly registered domains in the kernel-lib.com, team-hw.com, or team-c2.com infrastructure

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider enforcing SSH key-based authentication and disabling password-based SSH login on all internet-facing Linux servers to prevent credential brute-force success.
• Evaluate whether your organization's patch management covers all internet-facing services, as the campaign relies on unpatched services for initial access.
• Consider implementing file integrity monitoring on Apache module directories that uses cryptographic hashes rather than filesystem timestamps, since the malware timestomps its .so files to match legitimate modules.
• Consider deploying DNS tunneling detection or DNS monitoring for high-volume TXT-record queries to newly registered domains.
• If your environment uses SELinux, consider monitoring for setenforce 0 execution as an alert trigger, since oRAT disables it during installation.
• Consider auditing systemd service configurations for entries named xtables-addons that do not correspond to the legitimate netfilter extension package.

User Protection

• Consider warning users that app-download pages appearing on government domains may be compromised, and that legitimate app stores do not host content on .gov.br paths such as /jogos or /nova.
• If your organization uses mobile device management, consider blocking installation of apps from the specific gambling and betting packages identified in the campaign's fake store listings.
• Consider educating users that search-engine rankings for gambling and betting apps may be manipulated through compromised government domains.

Security Awareness

• Consider adding phishing-awareness training content covering fake app-store listings, particularly those that appear on government or trusted institutional websites.
• Consider training web-server administrators to recognize the signs of Apache module compromise, including unexpected .so files, apxs invocation in shell history, and reverse-proxy rules pointing to unknown upstream servers.
• If applicable to your awareness program, consider highlighting that trusted-domain reputation can be abused by attackers to manipulate search rankings and serve phishing content.

MITRE ATT&CK Mapping

Additional IOCs

• Ips:
  • 15[.]228[.]251[.]82 - C2 or staging IP used by the group, hosted on Amazon AWS infrastructure
  • 56[.]124[.]87[.]60 - C2 or staging IP associated with the campaign infrastructure
  • 18[.]229[.]255[.]14 - C2 or staging IP hosted on Amazon AWS, used in the Brazilian-focused campaign
  • 18[.]166[.]208[.]57 - C2 or staging IP hosted on Amazon AWS
  • 18[.]228[.]136[.]28 - C2 or staging IP hosted on Amazon AWS
  • 43[.]198[.]248[.]193 - C2 or staging IP hosted on Amazon AWS
  • 43[.]199[.]133[.]195 - C2 or staging IP hosted on Amazon AWS
  • 18[.]166[.]243[.]179 - C2 or staging IP hosted on Amazon AWS
  • 18[.]164[.]116[.]24 - C2 or staging IP hosted on Amazon AWS
  • 13[.]203[.]9[.]172 - C2 or staging IP hosted on Amazon AWS
  • 43[.]198[.]30[.]170 - C2 or staging IP hosted on Amazon AWS
  • 18[.]162[.]210[.]53 - C2 or staging IP hosted on Amazon AWS
  • 56[.]125[.]218[.]234 - C2 or staging IP associated with the campaign
  • 18[.]228[.]195[.]216 - C2 or staging IP hosted on Amazon AWS
  • 56[.]124[.]49[.]89 - C2 or staging IP associated with the campaign
  • 54[.]207[.]196[.]189 - C2 or staging IP hosted on Amazon AWS
  • 165[.]22[.]101[.]200 - C2 or staging IP used by the group
  • 172[.]80[.]8[.]202 - C2 or staging IP used by the group
  • 104[.]206[.]37[.]134 - C2 or staging IP used by the group
  • 108[.]187[.]28[.]158 - C2 or staging IP used by the group
  • 202[.]146[.]222[.]18 - C2 or staging IP used by the group
  • 192[.]253[.]229[.]23 - C2 or staging IP used by the group
  • 16[.]162[.]255[.]92 - C2 or staging IP hosted on Amazon AWS
  • 13[.]250[.]18[.]158 - C2 or staging IP hosted on Amazon AWS
  • 18[.]163[.]182[.]231 - C2 or staging IP hosted on Amazon AWS
  • 204[.]16[.]172[.]106 - C2 or staging IP used by the group
• Domains:
  • rb[.]aliyuntsl[.]com - C2 domain used by the group's backdoor toolkit
  • br[.]team-c2[.]com - C2 domain, Brazil-region variant of team-c2 infrastructure
  • hwlocal[.]team-hw[.]com - C2 domain used by the group's backdoor toolkit
  • br[.]team-hw[.]com - C2 domain, Brazil-region variant of team-hw infrastructure
  • data[.]mirrors-inc[.]com - C2 domain used for data exfiltration or staging
  • update[.]team-c2[.]com - C2 domain used for update delivery
  • devops[.]aliyuntsl[.]com - C2 domain impersonating Alibaba Cloud (aliyun) naming conventions
  • bageyi[.]kernel-lib[.]com - C2 domain used by the group's backdoor toolkit
  • 8yiu[.]kernel-lib[.]com - C2 domain used by the group's backdoor toolkit
  • dnslog[.]kernel-lib[.]com - DNS logging domain used for out-of-band DNS exfiltration or tunneling confirmation
  • js[.]ai-jquery[.]com - C2 domain impersonating jQuery CDN infrastructure
  • file[.]ijjjst23m[.]com - C2 domain used for file transfer operations
  • kerneltty[.]com - C2 domain using kernel-themed naming for legitimacy
  • 80[.]443[.]team - C2 domain using port-number naming convention
  • up[.]443[.]team - C2 domain using port-number naming convention
  • 404[.]443[.]team - C2 domain using port-number naming convention
  • data[.]windows-update-cdn[.]com - C2 domain impersonating Windows Update CDN infrastructure
  • microsoft-azure-loadbalance[.]com - C2 domain impersonating Microsoft Azure load-balancer infrastructure
  • update[.]aliyun[.]la - C2 domain impersonating Alibaba Cloud update infrastructure on .la TLD
  • update[.]opentls2[.]com - C2 domain impersonating TLS update infrastructure
  • alsfzcj[.]com - Domain hosting a Chinese gambling landing page identified in the campaign's domain generator output
• File Hashes:
  • 232ef6be134c2b7c14648aa193daf7e23e987477b8a40150dd77883947fdf017 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 088d0742a667f1acfc83edb94671a10b951f6745badec6d5c754ef594dddf815 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 88544d36beb6dc621c9376806836d0ad109ece64b589605d5674e0c86313d1c0 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 9d3085eac9a59a94f0473db5ec0173def8777d2f794da281fb1749389ae33cdb (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 263c14e84398339b25cd3e59da7e108340306fdbb8112bbe7dc0f07a71eb8a31 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 12af9d95c44e20a375148c25f8a2978a62ee95489134654c3537ccfb2d42120d (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 5af1bec4635e52da4909bf744ea4b7e4483ec944241218855212f4a9e3d48611 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • e8bb763bd10e727228ca9a8e3e6cf10bf4de4639b6be680a3abfb181a0adc052 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • fa7fc029ac13af2f3880151e9c408e9afadeba7b2cff01659806fb7c3c83288d (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • c3c09fe219e10808f053e5806289aeb87b1f00fc683c810aa828905fe03cda98f (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 2567d6b42dac97a391217ad22ee375f504d541940d3fbb9436a3f5e9bb23ab91 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 1829efbf7946e1a958779a3e7f1e50ca63fe61c6a2ddc177c14a7b0c5e10020a (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • f025520d648c7799ca5bed4a9be5bee14ac33be1f1e9b20c090c8c6319404fcf (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 5a11ed7931fb6358846e0f3c8d69921f43f8ccade5937fc41e5c262cc49f82e8 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 0d4a28d5cf7b99f11ffe972abd0284d9e35b6858eeb288532a55633b3e29f9c7 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 5f6d112637545a2e8c1a9f260c39698852c7a22e83db5ccfc99b99d9f6274710 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • c4d2efa57eef0c5defc4ca708ebe35832f8b543cf764beebef56fef6d36d4f69 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • c3c6ab58514cd13638cf049332186ef6d4ec7b256913edb1cd66a19437608882 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 582ecca146a6aef478706e4b2774d6115a9220a18d1db8f92ee54a5118ecebd9 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 3a8f464f1f2b5c38173e2a96f95a690af327d85c13c04d37cf0a91893d487bdb (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 02f5e07dd4c97a3de48cc886f46dad35443f1c221a352630e2c7787806ee21b6 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 16d35a725819142d2bd5bc0949dc518d344d6f63626a517e67fcba7322eb3844 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • a71498bfffae8ac694356b3f2436820b396946c9e71c8915e282c1b2fdba4162 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • d138d5f4fbc77650bc3be1cbf8fbd0ee292aa30eed5feec1ea7ba02e57da932b (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 44373953431d7570d9585c91377dbe8b6527ccc00662d249f383b003b68b459f (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 45b9382d7e91a4178b47c908b9b5f6884de7c5a1ef849fbf01d6c23d06d81b88 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 1eb40363a64e0cad15e340af476d106ccf57ebb6662c1389da1347429ee68c9c (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • fc789397742aee60b01292b071f79b4165981c31aa431eb1577a47c5911381c3 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • adbee84e9a43949b0a816f052ffb3c0b7855e078b985fea95532158c3b9389bc (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 0f26e1ba39ddd1f0a7e6f72bd8c4e02a5f0140de72eeda9fe5ab56402821e31e (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • ab7d531d298f0d77bc7bbbdc36f4f8a1732ceca90ff60e3f225a99b9b10f334e (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • ac99754357bd4a69c1de576977e0ee19c7354f29f7f52a9893b7a60f9c2f5248 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 94aa88ff6222583b2a5b791ddd655837787e31f59483ed91f860857d3399b84a (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 3ad35ea116b2c0855c13459a04699318b3944762385e8a47144f1d03b48f0bb1 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 0611c153bf8b8561ef53f2a5ba1413115bdc0e4554e0c22cf9641bd8845db03e (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 114824bccfafcbb42040f119fdcd3ec48f54eb154ffee6676d06986cba2b0af0 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 297c53d935c501864e15fe7abcfdafed83df9aafdf241094604ae405529c5eb7 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 0963c0034a5e0665729d686d50c5375948c4a684c56770adb13d24ff5df8013d (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 749784fb7846bb3b52dd8c2f660b53d95d5df30387b87b65b584ef9cc781ae52 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 8495598b1fec814d72caf76f1460b132071bb7305335331fed3bac9876c6e40c (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 98e17fe36ff77106bbbb9a04f3e00004bf872b88aab22438076966913ea83322 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • bcd7e5964630c34f06a43e48d696d99d7abae6b679509ad839ffa5179a972838 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 24f7296ac5ce844678c5f7470eaf64b28e870108ca06851c8f66a27a52003f12 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 2de964314a8aacc40897140f6fe21d268e24503a69f9821177e31bca7b1e4035 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 52863d36a216a86b2f90914db2d9229cba7ea317ab5ee9a678cb229087f04611 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 9d513a419bf129a42017b29eb7d084451a4f34be0828f6871439ec79f7f9b5fb (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • d478f867512e18d839180ceafc980c8fb26c3aa7d1c9e96d054819c81afef6f4 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • b88a7f3288bdf4b97d75dad4e47e5cb3d4e0962b12674a08e32e5f96e762e877 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • f4aceaf5c0740093f8040f5e0f29c7582a1bd7ab2bca628d162fb45c29045063 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 2305ae23ea350e31b05b9f071d315ee60c5a88e96ce11be8ff9db16314a6197c (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 99b5404df81992cad104dd242bc736d75fd6c58af34dc1a75a8ee3c5e1784fa4 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 85b5e95cbb5103202abebf8f84b91a286994e61b33ddef53355ab0df2a2b6d9a (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • cff25a9c84c893e32a9a75c1dae385934cf917f709efa11172a53ea2337fa109 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 154c977a113ff4d94ff2f29f7b93a8d0bd6ad8e67a820c09505117f5d386fd40 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 67ccc12c0a17dc31388a8c851d076edaaf1213e80398b01d46f5a29b8c7b8b9b (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 612fe3a3ace706725aa5415a1cd1cf18548627b4b40636c5443cb770def30b4c (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
  • 96488c59287889fcd3b9952ec78b78914fabb901c8b61a7354552439170ed148 (SHA256) - SHA256 hash of a malware sample from the campaign toolkit
• File Paths:
  • /usr/local/bin/systemd-udevd - DownPro root drop path mimicking a legitimate systemd component
  • /usr/local/bin/rsync-tsl - DownPro root drop path mimicking rsync utility
  • /usr/local/bin/tcp-tsl - DownPro root drop path mimicking a TCP utility
  • /usr/local/bin/snapd-ext - DownPro root drop path mimicking snapd extension
  • /usr/local/bin/fsck-disk - DownPro root drop path mimicking filesystem check utility
  • /usr/local/bin/nftables-init - DownPro root drop path mimicking nftables initialization
  • /usr/bin/chuser - Setuid backdoor installed by DownPro with 0755 permissions and root ownership, timestomped to match /bin/ls
  • /usr/sbin/unix_updates - PasswordHarvester payload path executed with -v flag by DownPro
  • /usr/local/bin/xtables-addons - oRAT persistence path mimicking legitimate netfilter/iptables extension package
  • /tmp/.lock - oRAT lock file preventing multiple concurrent agent instances
  • /etc/protocols - System file where oRAT appends a GUID comment line for tracking, an unusual location for malware artifacts
  • /tmp/asset-scan - Working directory for the cam-agent reconnaissance tool
  • opsproxy.c - Apache module source file downloaded from a staging server and compiled on victim via apxs, deleted after compilation
  • info.sh - Recon Bash script with Chinese-language comments that inventories SSH keys, bash history, network mounts, and lateral-movement targets
  • findweb.sh - Recon Bash script with Chinese-language comments that maps web-server configurations, virtual hosts, and reverse-proxy rules
  • res.txt - Plaintext results file where the SSH brute-forcer appends successful credentials
• Command Lines:
  • Purpose: DownPro downloader execution with encrypted URL parameters | Tools: DownPro | Stage: Execution | downpro -u <url> -id <url> -up <url> -logs <path>
  • Purpose: Setuid privilege-escalation backdoor activation via chuser utility | Tools: chuser | Stage: Privilege Escalation | chuser -c <command>
  • Purpose: SSH brute-force credential checking against target IP lists | Tools: SSH brute-forcer | Stage: Credential Access | ssh_bruteforcer -f <ip_list> -u <user_list> -p <pass_list>
  • Purpose: Apache module compilation and installation via apxs tooling | Tools: apxs, gcc | Stage: Persistence | apxs -i -a -n <modname> <module>.c
  • Purpose: SELinux enforcement disablement by oRAT during preparation routine | Tools: setenforce | Stage: Defense Evasion | setenforce 0
  • Purpose: cam-agent network reconnaissance tool execution with JSON scan policies | Tools: cam-agent | Stage: Reconnaissance | cam-agent -f <config> -flog <path> -h -v