diff --git a/opsec/anonymous_server_monitoring/index.html b/opsec/anonymous_server_monitoring/index.html
index 5a268d6..846b2b4 100644
--- a/opsec/anonymous_server_monitoring/index.html
+++ b/opsec/anonymous_server_monitoring/index.html
@@ -109,16 +109,72 @@
 	</div><!-- /grey -->
 
 
-	<div id="anon2">
+	<div id="anon3">
 	    <div class="container">
 			<div class="row">
 				<div class="col-lg-8 col-lg-offset-2">
+                    <h1><b>Basic tools</b></h1>
+
+                    Let's look at a cryptojacked server... In this case the intruder did not take any precautions or try to hide their activity. This often happens with basic scripts that scan the internet in large-scale low-cost credential stuffing attacks.
+
+                    <h2>glances</h2>
+                    Here we will look at glances. Glances is a python tool that gives nice looking visuals with information about server status
+                    <img src="glances.png" class="imgRz">
+
+                    <h3>Pros</h3>
+                    <ul>
+                        <li>looks nice</li>
+                    </ul>
+                    <h3>Cons</h3>
+                    <ul>
+                        <li>Requires python</li>
+                        <li>not part of the POSIX convention</li>
+                        <li>somewhat resource intensive for limited hardware</li>
+                    </ul>
+
+                    <h2>top</h2>
+                    Now, an oldie but a goodie: top! Wherever you find a unix you'll find top, from MacOS to BSD...
+
+                    <img src="top.png" class="imgRz">
+
+                    <h3>Pros</h3>
+                    <ul>
+                        <li>Lightweight</li>
+                        <li>POSIX Compliant</li>
+                    </ul>
+                    <h3>Cons</h3>
+                    <ul>
+                        <li>Ugly</li>
+                        <li>limited ordering/filtering features compared to glances</li>
+                    </ul>
+
           
 	       </div>
 			</div><!-- /row -->
 	    </div> <!-- /container -->
 	</div><!-- /grey -->
 
+	<div id="anon2">
+	    <div class="container">
+			<div class="row">
+				<div class="col-lg-8 col-lg-offset-2">
+                <h1><b>Risks</b></h1>
+                Whenever you connect to your server, such as for monitoring or other administrative tasks, if you do so through the clearweb then you are liable to being recorded. Even when using SSH you will leave a trail of metadata all the way back to your access point. That might be enough to get your door busted down the line.
+
+                <br><br>
+                In the following part of the post we will look into:
+
+                <ul>
+                    <li>How to connect to your server safely and anonymously</li>
+                    <li>How to set up advanced monitoring tools so you don't have to keep an eye on a bunch of tmux sessions with glances/top open</li>
+                </ul>
+          
+	       </div>
+			</div><!-- /row -->
+	    </div> <!-- /container -->
+	</div><!-- /grey -->
+
+
 
 	<div id="anon3">
 	    <div class="container">