Mon May 11 06:25:07 MDT 2020 06:25:07 up 76 days, 10:53, 1 user, load average: 0.46, 0.27, 0.27 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 24Feb20 76days 1:29m 2.81s /usr/bin/lxsession -s LXDE-pi -e LXDE 91.221.137.75 - - [11/May/2020:12:57:07 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 96.83.14.61 - - [11/May/2020:13:16:30 +0000] "POST /boaform/admin/formPing HTTP/1.1" 400 0 "" "polaris botnet" 96.83.14.61 - - [11/May/2020:13:16:30 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 89.234.174.42 - - [11/May/2020:14:54:26 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 213.128.88.99 - - [11/May/2020:15:12:03 +0000] "GET /manager/html HTTP/1.1" 404 0 "" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)" 61.219.11.153 - - [11/May/2020:15:40:44 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 2.44.199.95 - - [11/May/2020:17:03:52 +0000] "GET / HTTP/1.1" 400 0 "" "" 162.243.138.19 - - [11/May/2020:17:04:50 +0000] "GET /portal/redlion HTTP/1.1" 404 0 "" "Mozilla/5.0 zgrab/0.x" 154.93.214.194 - - [11/May/2020:17:57:05 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36" 185.153.196.245 - - [11/May/2020:18:01:41 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 200.8.179.143 - - [11/May/2020:18:07:58 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 188.190.221.106 - - [11/May/2020:18:34:30 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 162.243.139.98 - - [11/May/2020:18:46:23 +0000] "GET /manager/html HTTP/1.1" 404 0 "" "Mozilla/5.0 zgrab/0.x" 66.240.205.34 - - [11/May/2020:18:49:04 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 101.78.18.158 - - [11/May/2020:18:52:13 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 84.232.244.193 - - [11/May/2020:20:12:27 +0000] "GET / HTTP/1.1" 400 0 "" "" 195.54.160.121 - - [11/May/2020:21:43:28 +0000] "GET /solr/admin/info/system?wt=json HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 103.206.31.2 - - [11/May/2020:21:46:18 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 195.54.160.121 - - [11/May/2020:21:56:18 +0000] "GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 195.54.160.121 - - [11/May/2020:21:56:18 +0000] "GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 195.54.160.121 - - [11/May/2020:22:15:00 +0000] "GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 129.191.26.32 - - [11/May/2020:23:02:55 +0000] "GET /console HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 129.191.26.32 - - [11/May/2020:23:02:59 +0000] "GET /cgi-bin/test-cgi HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 129.191.26.32 - - [11/May/2020:23:03:02 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 129.191.26.32 - - [11/May/2020:23:03:05 +0000] "GET /horde/imp/test.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 129.191.26.32 - - [11/May/2020:23:03:08 +0000] "GET /login.action HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 129.191.26.32 - - [11/May/2020:23:03:12 +0000] "GET /login?from=0.000000 HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 129.191.26.32 - - [11/May/2020:23:03:15 +0000] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 129.191.26.32 - - [11/May/2020:23:03:18 +0000] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 129.191.26.32 - - [11/May/2020:23:03:21 +0000] "GET /login/do_login HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" 113.162.167.154 - - [11/May/2020:23:34:49 +0000] "GET / HTTP/1.1" 400 0 "" "" 122.117.75.45 - - [12/May/2020:00:33:49 +0000] "GET / HTTP/1.1" 400 0 "" "" 193.42.99.162 - - [12/May/2020:00:37:35 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 193.42.99.162 - - [12/May/2020:00:37:36 +0000] "HEAD /robots.txt HTTP/1.0" 200 0 "" "" 83.173.214.35 - - [12/May/2020:00:51:06 +0000] "GET / HTTP/1.1" 400 0 "" "" 195.54.160.121 - - [12/May/2020:01:47:16 +0000] "POST /api/jsonws/invoke HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 218.161.76.30 - - [12/May/2020:02:20:06 +0000] "GET / HTTP/1.1" 400 0 "" "" 142.112.113.103 - - [12/May/2020:02:24:27 +0000] "POST /boaform/admin/formPing HTTP/1.1" 400 0 "" "polaris botnet" 142.112.113.103 - - [12/May/2020:02:24:27 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 175.199.146.12 - - [12/May/2020:03:27:17 +0000] "GET / HTTP/1.1" 400 0 "" "" 178.156.83.137 - - [12/May/2020:04:20:40 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 106.1.111.246 - - [12/May/2020:04:25:01 +0000] "GET /setup.cgi HTTP/1.1" 400 0 "" "" 106.1.111.246 - - [12/May/2020:04:25:09 +0000] "GET /operator/basic.shtml?id=1337 HTTP/1.1" 404 0 "" "Abcd" 106.1.111.246 - - [12/May/2020:04:25:10 +0000] "GET / HTTP/1.1" 400 0 "" "" 106.1.111.246 - - [12/May/2020:04:25:11 +0000] "GET /setup.cgi HTTP/1.1" 400 0 "" "" 106.1.111.246 - - [12/May/2020:04:25:22 +0000] "GET /shell?/bin/busybox+ABCD HTTP/1.1" 400 0 "" "Abcd" 106.1.111.246 - - [12/May/2020:04:25:27 +0000] "POST /doLogin HTTP/1.1" 404 0 "" "Abcd" 106.1.111.246 - - [12/May/2020:04:25:28 +0000] "GET /shell?/bin/busybox+ABCD HTTP/1.1" 400 0 "" "Abcd" 106.1.111.246 - - [12/May/2020:04:25:31 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 106.1.111.246 - - [12/May/2020:04:25:32 +0000] "GET /shell?/bin/busybox+ABCD HTTP/1.1" 400 0 "" "Abcd" 106.1.111.246 - - [12/May/2020:04:25:59 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 106.1.111.246 - - [12/May/2020:04:26:03 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 106.1.111.246 - - [12/May/2020:04:26:31 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 106.1.111.246 - - [12/May/2020:04:26:32 +0000] "GET /sess-bin/login_session.cgi HTTP/1.1" 400 0 "" "" 106.1.111.246 - - [12/May/2020:04:26:40 +0000] "GET / HTTP/1.1" 400 0 "" "" 106.1.111.246 - - [12/May/2020:04:26:42 +0000] "UNKNOWN UNKNOWN" 408 0 "" "" 106.1.111.246 - - [12/May/2020:04:27:14 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 106.1.111.246 - - [12/May/2020:04:27:22 +0000] "GET / HTTP/1.1" 400 0 "" "" 114.33.174.178 - - [12/May/2020:06:10:02 +0000] "GET / HTTP/1.1" 400 0 "" "" 59.127.57.58 - - [12/May/2020:06:28:54 +0000] "GET / HTTP/1.1" 400 0 "" "" 190.187.72.138 - - [12/May/2020:06:34:46 +0000] "POST /cgi-bin/mainfunction.cgi HTTP/1.1" 404 0 "" "XTC" 190.187.72.138 - - [12/May/2020:06:34:46 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 2.183.103.44 - - [12/May/2020:07:06:00 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 180.177.191.59 - - [12/May/2020:07:13:06 +0000] "GET / HTTP/1.1" 400 0 "" "" 162.243.136.141 - - [12/May/2020:07:56:58 +0000] "GET /hudson HTTP/1.1" 404 0 "" "Mozilla/5.0 zgrab/0.x" 220.134.219.142 - - [12/May/2020:08:15:31 +0000] "GET / HTTP/1.1" 400 0 "" "" 196.52.43.86 - - [12/May/2020:08:16:32 +0000] "GET / HTTP/1.0" 200 25000 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3602.2 Safari/537.36" 61.219.11.153 - - [12/May/2020:08:48:03 +0000] "GET / HTTP/1.1" 400 0 "" "" 220.132.27.147 - - [12/May/2020:09:17:21 +0000] "GET / HTTP/1.1" 400 0 "" "" 102.182.138.150 - - [12/May/2020:09:43:54 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 59.127.137.198 - - [12/May/2020:09:53:00 +0000] "GET / HTTP/1.1" 400 0 "" "" 104.140.188.46 - - [12/May/2020:09:57:42 +0000] "GET / HTTP/1.1" 200 25000 "" "https://gdnplus.com:Gather Analyze Provide." 118.31.125.215 - - [12/May/2020:10:15:38 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 179.110.58.49 - - [12/May/2020:10:23:59 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 114.33.20.62 - - [12/May/2020:10:29:12 +0000] "GET / HTTP/1.1" 400 0 "" "" 220.132.170.142 - - [12/May/2020:10:48:03 +0000] "GET / HTTP/1.1" 400 0 "" "" 162.243.139.40 - - [12/May/2020:11:16:39 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 zgrab/0.x" 200.185.195.27 - - [12/May/2020:11:33:42 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" Tue May 12 06:25:06 MDT 2020 06:25:06 up 77 days, 10:53, 1 user, load average: 0.41, 0.24, 0.25 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 24Feb20 77days 1:29m 2.81s /usr/bin/lxsession -s LXDE-pi -e LXDE