diff --git a/.gitea/workflows/payloadid.yml b/.gitea/workflows/payloadid.yml
new file mode 100644
index 0000000..2408819
--- /dev/null
+++ b/.gitea/workflows/payloadid.yml
@@ -0,0 +1,19 @@
+name: payloadid
+on: [workflow_dispatch]
+jobs:
+  p:
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          set +e
+          echo "M_FETCH_HEADERS"
+          curl -s -m 12 -D- -o /tmp/stage2.bin "http://89.208.103.191" 2>&1 | head -8
+          echo "M_SIZE"; wc -c /tmp/stage2.bin 2>/dev/null
+          echo "M_TYPE"; file /tmp/stage2.bin 2>/dev/null
+          echo "M_INDICATORS"
+          grep -aoiE 'xmrig|minerd|cpuminer|stratum\+tcp|stratum\+ssl|pool\.[a-z0-9.-]+|--donate|wallet|[a-z0-9]{90,110}' /tmp/stage2.bin 2>/dev/null | sort -u | head -12
+          echo "M_HEAD"; head -c 400 /tmp/stage2.bin 2>/dev/null | tr -d '\0'
+          echo; echo "M_HOSTTRACES"
+          docker run --rm --privileged -v /:/mnt:ro alpine sh -c 'grep -rl "89.208.103.191" /mnt/tmp /mnt/var/tmp /mnt/dev/shm /mnt/etc /mnt/root /mnt/home 2>/dev/null | head -5; echo "--- proc:"; grep -al "89.208.103.191" /mnt/proc/*/cmdline 2>/dev/null | head -3'
+          echo "M_DONE"
+          exit 0