We host an anchor that went offline on Sept 1, 2026.  During
troubleshooting, I noticed the following in root's .bash_history:

> ping pl-szz-as28785.anchors.atlas.ripe.net
> tail -f /var/log/ansible.log
> yum -y update
> reboot
> cat /etc/redhat-release
> dd if=/dev/zero of=$(mount|grep boot|awk '{print $1}')
> rm -rf /etc/ /home/ /srv/ /export/
> systemctl poweroff

Indeed, the boot partition is corrupted, grub can't identify any
filesystem on it, nor can any other file system tools.

 From the messages, I can see that a named user from RIPE (meaning, it
didn't appear to be an automated login) was logged in at this time.

I opened a ticket in the portal on September 11 and have not received an
update, nor can I open a second ticket on the same node.

Before I begin to reinstall or recover this node, I'd like to know
what's going on.  Has anyone else seen anything like this?





--
________________________________
Andrew Gallo
The George Washington University

-----
To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/ripe-atlas.ripe.net/
As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings.
More details at: https://www.ripe.net/membership/mail/mailman-3-migration/