repairbizcredit.com - Faizzz-Chin ShellXploit

SHELL BYPASS 403 |

Modern UI. Responsive. Powerful.

Faizzz-Chin Shell

: /proc/self/root/proc/thread-self/root/home/repauqkb/access-logs/ [ drwxr-x--- ]

43.131.39.179 - - [12/May/2026:09:12:54 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" 4.43.184.113 - - [12/May/2026:09:55:53 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36" 43.156.116.44 - - [12/May/2026:10:07:17 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" 168.144.46.114 - - [12/May/2026:10:08:22 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 213.240.252.58 - - [12/May/2026:10:40:26 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36" 66.249.79.65 - - [12/May/2026:10:56:20 -0400] "GET /robots.txt HTTP/1.1" 301 795 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 102.129.223.92 - - [12/May/2026:11:30:47 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 OPR/127.0.0.0" 43.172.198.18 - - [12/May/2026:12:19:44 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 157.254.223.210 - - [12/May/2026:12:22:41 -0400] "GET /wp-login.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 43.165.195.234 - - [12/May/2026:13:01:23 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" 45.74.3.87 - - [12/May/2026:13:15:52 -0400] "GET / HTTP/1.1" 301 795 "http://repairbizcredit.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 CCleaner/130.0.0.0" 66.249.79.67 - - [12/May/2026:13:51:59 -0400] "GET /robots.txt HTTP/1.1" 301 795 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 66.249.79.66 - - [12/May/2026:13:52:00 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.7727.137 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 195.226.194.95 - - [12/May/2026:14:11:14 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 5.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2956.75 Safari/537.36" 43.134.165.242 - - [12/May/2026:13:58:28 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" 2a0e:8140:2afc:4f67:ee43:f6ff:fef3:68ab - - [12/May/2026:15:27:09 -0400] "GET / HTTP/1.1" 301 795 "http://repairbizcredit.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36" 146.56.197.150 - - [12/May/2026:16:07:55 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" 2804:c2c:cf09:659c:9997:68e0:8b5e:f798 - - [12/May/2026:16:03:23 -0400] "GET /wp-login.php HTTP/1.1" 301 795 "https://www.google.com/search?q=wordpress" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 43.156.34.42 - - [12/May/2026:17:16:56 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" 216.244.66.249 - - [12/May/2026:17:38:08 -0400] "GET /top-lenders-that-check-equifax-and-experian-business-credit-reports-why-keeping-your-business-credit-clean-matters/feed/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; [email protected])" 43.153.208.49 - - [12/May/2026:18:13:42 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" 43.173.181.91 - - [12/May/2026:18:15:16 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 192.42.116.145 - - [12/May/2026:18:51:35 -0400] "GET / HTTP/1.1" 301 795 "repairbizcredit.com" "Mozilla/5.0 (Linux; Android 8.1.0; MI PLAY) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Mobile Safari/537.36" 45.92.1.17 - - [12/May/2026:19:10:11 -0400] "POST /ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1" 301 795 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 45.92.1.17 - - [12/May/2026:19:10:28 -0400] "POST /alfacgiapi/perl.alfa HTTP/1.1" 301 795 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 45.92.1.17 - - [12/May/2026:19:10:11 -0400] "POST /wp-plain.php HTTP/1.1" 301 795 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 45.92.1.17 - - [12/May/2026:19:10:11 -0400] "GET /wp-content/plugins/fix/up.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36" 45.92.1.17 - - [12/May/2026:19:10:11 -0400] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 301 795 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 45.92.1.17 - - [12/May/2026:19:10:22 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 45.92.1.17 - - [12/May/2026:19:10:26 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 202.51.207.191 - - [12/May/2026:19:21:57 -0400] "GET /wp-admin/css/ HTTP/1.1" 301 795 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" 202.51.207.191 - - [12/May/2026:19:22:02 -0400] "GET /.well-known/ HTTP/1.1" 301 795 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" 202.51.207.191 - - [12/May/2026:19:22:17 -0400] "GET /admin/controller/extension/extension/ HTTP/1.1" 301 795 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" 202.51.207.191 - - [12/May/2026:19:22:31 -0400] "GET /images/ HTTP/1.1" 301 795 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" 202.51.207.191 - - [12/May/2026:19:22:11 -0400] "GET /sites/default/files/ HTTP/1.1" 301 795 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" 202.51.207.191 - - [12/May/2026:19:22:24 -0400] "GET /uploads/ HTTP/1.1" 301 795 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" 202.51.207.191 - - [12/May/2026:19:22:38 -0400] "GET /files/ HTTP/1.1" 301 795 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" 216.244.66.249 - - [12/May/2026:20:26:46 -0400] "GET /robots.txt HTTP/1.1" 301 795 "-" "Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; [email protected])" 178.176.78.73 - - [12/May/2026:20:39:25 -0400] "GET / HTTP/1.1" 301 795 "http://repairbizcredit.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 CCleaner/130.0.0.0" 43.156.204.134 - - [12/May/2026:21:29:40 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" 45.3.38.198 - - [12/May/2026:21:53:47 -0400] "GET /.git/HEAD HTTP/1.1" 403 1242 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15" 43.167.239.66 - - [12/May/2026:22:30:34 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" 216.244.66.249 - - [12/May/2026:22:37:12 -0400] "GET /robots.txt HTTP/1.1" 301 795 "-" "Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; [email protected])" 94.19.10.143 - - [12/May/2026:23:33:51 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux i686 on x86_64; rv:49.0) Gecko/20100101 Firefox/49.0" 94.19.10.143 - - [12/May/2026:23:33:36 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2691.97 Safari/537.36" 114.10.114.128 - - [12/May/2026:23:50:51 -0400] "GET /wp-admin/wp-init.php HTTP/1.1" 301 795 "-" "python-httpx/0.28.1" 216.26.243.54 - - [13/May/2026:00:10:04 -0400] "GET /.env HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15" 43.172.195.13 - - [13/May/2026:00:15:01 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 85.137.48.160 - - [13/May/2026:00:58:31 -0400] "GET /txets.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" 216.244.66.249 - - [13/May/2026:01:01:19 -0400] "GET /tag/remove-negative-items-from-business-credit/page/3/?path=/home HTTP/1.1" 301 795 "-" "Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; [email protected])" 206.189.43.116 - - [13/May/2026:01:02:56 -0400] "GET /a7.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:02:57 -0400] "GET /xx.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:02:57 -0400] "GET /wp-content/uploads/a7.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:02:58 -0400] "GET /wp-content/uploads/about.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:02:58 -0400] "GET /wp-content/uploads/admin.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:02:59 -0400] "GET /about.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:02:59 -0400] "GET /admin.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:02:59 -0400] "GET /wp-content/uploads/alamak.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:02:59 -0400] "GET /adminer.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:02:59 -0400] "GET /alamak.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:00 -0400] "GET /alfa.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:00 -0400] "GET /wp-content/uploads/anonsec2.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:00 -0400] "GET /wp-content/uploads/b374k.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:00 -0400] "GET /wp-content/uploads/backdoor.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:01 -0400] "GET /wp-content/uploads/c99.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:01 -0400] "GET /wp-content/uploads/cmd.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:01 -0400] "GET /wp-content/uploads/default.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:02 -0400] "GET /wp-content/uploads/fomo.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:02 -0400] "GET /wp-content/uploads/indoxploit.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:02 -0400] "GET /backdoor.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:02:55 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:02:56 -0400] "GET /waychk_uzaolofpjn.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:02:56 -0400] "GET /x.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:01 -0400] "GET /anonsec2.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:01 -0400] "GET /b374k.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:01 -0400] "GET /wp-content/uploads/config.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:01 -0400] "GET /wp-content/uploads/file.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:01 -0400] "GET /wp-content/uploads/files.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:01 -0400] "GET /wp-content/uploads/filesman.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:02 -0400] "GET /wp-content/uploads/input.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:03 -0400] "GET /wp-content/uploads/k.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:03 -0400] "GET /wp-content/uploads/leafmailer.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:03 -0400] "GET /wp-content/uploads/log.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:03 -0400] "GET /bypass.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:04 -0400] "GET /wp-content/uploads/mar.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:04 -0400] "GET /wp-content/uploads/mini.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:04 -0400] "GET /wp-content/uploads/session.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:05 -0400] "GET /wp-content/uploads/shell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:05 -0400] "GET /wp-content/uploads/upload.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:05 -0400] "GET /wp-content/uploads/up.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:02 -0400] "GET /wp-content/uploads/info.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:03 -0400] "GET /c99.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:03 -0400] "GET /wp-content/uploads/mah.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:04 -0400] "GET /cmd.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:04 -0400] "GET /wp-content/uploads/ok.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:04 -0400] "GET /wp-content/uploads/pas.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:04 -0400] "GET /wp-content/uploads/pomo.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:04 -0400] "GET /wp-content/uploads/priv8.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:04 -0400] "GET /wp-content/uploads/pro.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:04 -0400] "GET /wp-content/uploads/r57.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:04 -0400] "GET /wp-content/uploads/radio.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:04 -0400] "GET /wp-content/uploads/rootshell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:05 -0400] "GET /wp-content/uploads/sh.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:05 -0400] "GET /wp-content/uploads/test.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:05 -0400] "GET /wp-content/uploads/uploader.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:05 -0400] "GET /wp-content/uploads/webshell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:05 -0400] "GET /wp-content/uploads/wp-care.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:05 -0400] "GET /wp-content/uploads/wso.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:05 -0400] "GET /wp-content/uploads/x.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:06 -0400] "GET /wp-includes/adminer.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:05 -0400] "GET /config.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:05 -0400] "GET /wp-content/uploads/wp-tibtok.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:05 -0400] "GET /wp-content/uploads/wso2.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:05 -0400] "GET /wp-content/uploads/xx.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:06 -0400] "GET /wp-includes/a7.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:06 -0400] "GET /wp-includes/admin.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:06 -0400] "GET /wp-includes/about.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:06 -0400] "GET /wp-includes/anonsec2.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:06 -0400] "GET /wp-includes/alfa.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:06 -0400] "GET /wp-includes/b374k.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:07 -0400] "GET /wp-includes/filesman.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:07 -0400] "GET /wp-includes/fomo.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:07 -0400] "GET /wp-includes/index.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:07 -0400] "GET /wp-includes/info.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:07 -0400] "GET /wp-includes/input.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:07 -0400] "GET /wp-includes/indoxploit.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:07 -0400] "GET /wp-includes/k.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:07 -0400] "GET /wp-includes/log.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /default.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /wp-includes/ok.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:06 -0400] "GET /wp-includes/alamak.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:06 -0400] "GET /wp-includes/backdoor.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:06 -0400] "GET /wp-includes/bypass.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:06 -0400] "GET /wp-includes/c99.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:06 -0400] "GET /wp-includes/cmd.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:07 -0400] "GET /wp-includes/config.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:07 -0400] "GET /wp-includes/default.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:07 -0400] "GET /file.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:07 -0400] "GET /wp-includes/files.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:07 -0400] "GET /wp-includes/js.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:07 -0400] "GET /wp-includes/leafmailer.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /wp-includes/mah.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /wp-includes/pas.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /wp-includes/priv8.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /wp-includes/rootshell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /wp-includes/session.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:09 -0400] "GET /wp-includes/uploader.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:09 -0400] "GET /wp-includes/webshell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:09 -0400] "GET /wp-includes/wp-care.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:09 -0400] "GET /wp-includes/up.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /wp-includes/mini.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /wp-includes/mar.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /wp-includes/pomo.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /wp-includes/pro.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /files.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /wp-includes/r57.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /wp-includes/radio.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /wp-includes/sh.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /wp-includes/shell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:08 -0400] "GET /wp-includes/test.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:09 -0400] "GET /filesman.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:09 -0400] "GET /wp-includes/upload.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:09 -0400] "GET /fomo.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:10 -0400] "GET /indoxploit.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:10 -0400] "GET /info.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:12 -0400] "GET /leafmailer.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:14 -0400] "GET /mar.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:15 -0400] "GET /ok.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:17 -0400] "GET /pomo.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:18 -0400] "GET /r57.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:10 -0400] "GET /index.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:11 -0400] "GET /input.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:11 -0400] "GET /js.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:12 -0400] "GET /k.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:14 -0400] "GET /log.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:14 -0400] "GET /mah.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:14 -0400] "GET /mini.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:16 -0400] "GET /pas.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:17 -0400] "GET /priv8.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:17 -0400] "GET /pro.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:19 -0400] "GET /rootshell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:20 -0400] "GET /session.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:20 -0400] "GET /sh.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:21 -0400] "GET /shell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:21 -0400] "GET /test.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:21 -0400] "GET /up.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:22 -0400] "GET /wp-tibtok.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:25 -0400] "GET /wp-content/uploads/bypass.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:27 -0400] "GET /wp-content/uploads/index.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:27 -0400] "GET /wp-content/uploads/js.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:27 -0400] "GET /wp-includes/file.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:18 -0400] "GET /radio.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:21 -0400] "GET /upload.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:21 -0400] "GET /uploader.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:21 -0400] "GET /webshell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:22 -0400] "GET /wp-care.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:23 -0400] "GET /wrapper.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:23 -0400] "GET /wso.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:24 -0400] "GET /wso2.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:25 -0400] "GET /wp-content/uploads/adminer.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:25 -0400] "GET /wp-content/uploads/alfa.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:27 -0400] "GET /wp-content/uploads/wrapper.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:28 -0400] "GET /wp-includes/wso.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:28 -0400] "GET /wp-includes/wrapper.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:28 -0400] "GET /wp-includes/xx.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:28 -0400] "GET /.well-known/acme-challenge/a7.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /wp-includes/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /.well-known/acme-challenge/about.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /cgi-bin/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /.well-known/acme-challenge/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /wp-includes/ID3/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:28 -0400] "GET /wp-includes/wp-tibtok.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:28 -0400] "GET /wp-includes/x.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:28 -0400] "GET /wp-includes/wso2.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:28 -0400] "GET /.well-known/acme-challenge/webshell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:28 -0400] "GET /.well-known/acme-challenge/wp-care.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:28 -0400] "GET /.well-known/acme-challenge/wp-tibtok.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:28 -0400] "GET /.well-known/acme-challenge/wso.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:28 -0400] "GET /.well-known/acme-challenge/wrapper.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /.well-known/acme-challenge/wso2.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /.well-known/acme-challenge/x.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /.well-known/acme-challenge/xx.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /wp-content/uploads/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /wp-content/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /wp-admin/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /.well-known/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /.well-known/acme-challenge/admin.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /wp-includes/IXR/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/Text/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/block-supports/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /.well-known/pki-validation/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /wp-content//wp-content/plugins/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:29 -0400] "GET /wp-includes/PHPMailer/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/SimplePie/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/Requests/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/block-bindings/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/style-engine/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/fonts/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/images/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/customize/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/assets/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/interactivity-api/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/theme-compat/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /.well-known/acme-challenge/anonsec2.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /wp-admin/includes/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /wp-admin/css/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /wp-content/upgrade/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /wp-content/languages/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /wp-content/languages/plugins/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/php-compat/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /.well-known/acme-challenge/adminer.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/html-api/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/block-patterns/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/rest-api/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /wp-includes/certificates/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /.well-known/acme-challenge/alamak.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:30 -0400] "GET /.well-known/acme-challenge/alfa.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /.well-known/acme-challenge/b374k.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /wp-admin/maint/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /.well-known/acme-challenge/backdoor.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /app/static/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /app/static/media/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /static/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /.well-known/acme-challenge/bypass.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /images/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /files/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /temp/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /cache/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /app/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /static/media/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /uploads/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /assets/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /public/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /tmp/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /.well-known/acme-challenge/c99.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /media/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /css/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /fonts/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/be-grid/about.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /vendor/composer/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/be-grid/up.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/be-grid/cmd.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/be-grid/shell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/be-grid/info.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /.well-known/acme-challenge/config.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/be-grid/tmp.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/be-grid/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/burst-statistics/about.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:31 -0400] "GET /.well-known/acme-challenge/cmd.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /js/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /vendor/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/be-grid/x.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/be-grid/wso.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/be-grid/test.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/be-grid/cache.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/burst-statistics/x.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/burst-statistics/cmd.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/burst-statistics/shell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/burst-statistics/wso.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/burst-statistics/info.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/burst-statistics/tmp.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/typehub/about.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/typehub/x.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/typehub/wso.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:34 -0400] "GET /.well-known/acme-challenge/default.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:40 -0400] "GET /.well-known/acme-challenge/filesman.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:40 -0400] "GET /.well-known/acme-challenge/fomo.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/burst-statistics/up.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:32 -0400] "GET /wp-content/plugins/burst-statistics/alfa.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/burst-statistics/admin.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/burst-statistics/test.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/burst-statistics/config.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/burst-statistics/cache.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/burst-statistics/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/typehub/cmd.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/typehub/up.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/typehub/shell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/typehub/alfa.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:33 -0400] "GET /wp-content/plugins/typehub/info.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:35 -0400] "GET /.well-known/acme-challenge/file.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:35 -0400] "GET /.well-known/acme-challenge/files.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:40 -0400] "GET /.well-known/acme-challenge/index.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:43 -0400] "GET /.well-known/acme-challenge/input.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:43 -0400] "GET /.well-known/acme-challenge/js.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:44 -0400] "GET /.well-known/acme-challenge/k.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:45 -0400] "GET /.well-known/acme-challenge/log.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:45 -0400] "GET /.well-known/acme-challenge/leafmailer.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:46 -0400] "GET /.well-known/acme-challenge/mar.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:46 -0400] "GET /.well-known/acme-challenge/mini.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:46 -0400] "GET /.well-known/acme-challenge/ok.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:47 -0400] "GET /.well-known/acme-challenge/pomo.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:50 -0400] "GET /.well-known/acme-challenge/radio.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:50 -0400] "GET /.well-known/acme-challenge/rootshell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:51 -0400] "GET /.well-known/acme-challenge/sh.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:51 -0400] "GET /.well-known/acme-challenge/shell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:53 -0400] "GET /.well-known/acme-challenge/uploader.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:53 -0400] "GET /.well-known/acme-challenge/upload.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:53 -0400] "GET /wp-includes/pomo/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:54 -0400] "GET /wp-content/languages/themes/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:55 -0400] "GET /storage/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:56 -0400] "GET /wp-content/plugins/be-grid/config.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/typehub/tmp.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/typehub/config.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/typehub/admin.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/exponent-modules/wso.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:41 -0400] "GET /.well-known/acme-challenge/indoxploit.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:43 -0400] "GET /.well-known/acme-challenge/info.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:45 -0400] "GET /.well-known/acme-challenge/mah.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:47 -0400] "GET /.well-known/acme-challenge/pas.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:48 -0400] "GET /.well-known/acme-challenge/priv8.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:49 -0400] "GET /.well-known/acme-challenge/pro.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:49 -0400] "GET /.well-known/acme-challenge/r57.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:50 -0400] "GET /.well-known/acme-challenge/session.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:52 -0400] "GET /.well-known/acme-challenge/test.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:52 -0400] "GET /.well-known/acme-challenge/up.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:55 -0400] "GET /wp-content/plugins/be-grid/alfa.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:56 -0400] "GET /wp-content/plugins/be-grid/admin.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/typehub/test.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/exponent-modules/x.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/exponent-modules/cmd.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/typehub/cache.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/exponent-modules/shell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/exponent-modules/up.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/typehub/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/exponent-modules/about.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/tatsu/shell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/tatsu/wso.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/tatsu/info.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/plugins/tatsu/admin.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/plugins/tatsu/config.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/plugins/tatsu/test.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/plugins/tatsu/tmp.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/plugins/tatsu/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/themes/exponent/shell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/themes/exponent/admin.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/themes/exponent/config.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/themes/exponent/test.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/plugins/exponent-modules/info.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:59 -0400] "GET /wp-content/plugins/exponent-modules/admin.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:59 -0400] "GET /wp-content/themes/exponent/cache.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:59 -0400] "GET /wp-content/themes/exponent/cmd.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:59 -0400] "GET /wp-content/themes/exponent/wso.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/exponent-modules/alfa.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/tatsu/cmd.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/tatsu/up.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:57 -0400] "GET /wp-content/plugins/tatsu/alfa.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/plugins/tatsu/cache.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/themes/exponent/about.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/themes/exponent/x.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/themes/exponent/up.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/themes/exponent/alfa.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/themes/exponent/info.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/themes/exponent/tmp.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/themes/exponent/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/uploads/tmp.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/uploads/cache.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:58 -0400] "GET /wp-content/cache/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:59 -0400] "GET /wp-content/plugins/exponent-modules/config.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:03:59 -0400] "GET /wp-content/plugins/exponent-modules/test.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:04:02 -0400] "GET /wp-content/plugins/caldera-forms/x.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:04:02 -0400] "GET /wp-content/plugins/caldera-forms/cmd.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:03:59 -0400] "GET /wp-content/plugins/exponent-modules/tmp.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:04:00 -0400] "GET /wp-content/plugins/exponent-modules/cache.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:04:02 -0400] "GET /wp-content/plugins/exponent-modules/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:04:02 -0400] "GET /wp-content/plugins/caldera-forms/about.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:04:03 -0400] "GET /wp-content/plugins/caldera-forms/up.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:04:03 -0400] "GET /wp-content/plugins/caldera-forms/shell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:04:03 -0400] "GET /wp-content/plugins/caldera-forms/alfa.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:04:04 -0400] "GET /wp-content/plugins/caldera-forms/info.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:04:05 -0400] "GET /wp-content/plugins/caldera-forms/admin.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:04:06 -0400] "GET /wp-content/plugins/caldera-forms/config.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:04:06 -0400] "GET /wp-content/plugins/caldera-forms/test.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:04:07 -0400] "GET /wp-content/plugins/caldera-forms/tmp.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:04:08 -0400] "GET /wp-content/plugins/complianz-gdpr/about.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:04:08 -0400] "GET /wp-content/plugins/complianz-gdpr/cmd.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:04:09 -0400] "GET /wp-content/plugins/complianz-gdpr/shell.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:04:11 -0400] "GET /wp-content/plugins/complianz-gdpr/config.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:04:11 -0400] "GET /wp-content/plugins/complianz-gdpr/tmp.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:04:12 -0400] "GET /wp-content/plugins/complianz-gdpr/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:04:03 -0400] "GET /wp-content/plugins/caldera-forms/wso.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:04:07 -0400] "GET /wp-content/plugins/caldera-forms/cache.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:04:07 -0400] "GET /wp-content/plugins/caldera-forms/ HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:04:08 -0400] "GET /wp-content/plugins/complianz-gdpr/x.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:04:09 -0400] "GET /wp-content/plugins/complianz-gdpr/up.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:04:10 -0400] "GET /wp-content/plugins/complianz-gdpr/wso.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:04:10 -0400] "GET /wp-content/plugins/complianz-gdpr/alfa.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:04:10 -0400] "GET /wp-content/plugins/complianz-gdpr/info.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:04:10 -0400] "GET /wp-content/plugins/complianz-gdpr/admin.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 206.189.43.116 - - [13/May/2026:01:04:11 -0400] "GET /wp-content/plugins/complianz-gdpr/test.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:04:11 -0400] "GET /wp-content/plugins/complianz-gdpr/cache.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 206.189.43.116 - - [13/May/2026:01:04:13 -0400] "GET /wp-content/plugins/tatsu/about.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 206.189.43.116 - - [13/May/2026:01:04:13 -0400] "GET /wp-content/plugins/tatsu/x.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 129.226.210.142 - - [13/May/2026:01:31:56 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" 216.244.66.249 - - [13/May/2026:01:42:38 -0400] "GET /robots.txt HTTP/1.1" 301 795 "-" "Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; [email protected])" 2.58.56.244 - - [13/May/2026:01:52:41 -0400] "GET /wp-login.php HTTP/1.1" 301 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0" 216.244.66.249 - - [13/May/2026:02:28:23 -0400] "GET /robots.txt HTTP/1.1" 301 795 "-" "Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; [email protected])" 43.166.132.142 - - [13/May/2026:02:34:19 -0400] "GET / HTTP/1.1" 301 795 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1"