509318396 ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ 172.105.42.26 - - [17/Oct/2026:12:42:13 +0000] "GET /.well-known/acme-challenge/-AD8ONDKZC4U5G7QUJT_GR4E29SW4H18 HTTP/1.1" 200 64 "-" "Cpanel-HTTP-Client/1.0" 66.132.195.184 - - [17/Oct/2026:15:20:17 +0000] "GET / HTTP/1.1" 200 20 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 2602:80d:1008::c8 - - [17/Oct/2026:15:20:19 +0000] "GET /favicon.ico HTTP/1.1" 200 20 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 172.105.42.26 - - [17/Oct/2026:15:42:13 +0000] "GET /.well-known/acme-challenge/2OKEUNS8DJTSR5EYD66-880ZEJV50VFL HTTP/1.1" 200 64 "-" "Cpanel-HTTP-Client/1.0" 34.75.235.196 - - [17/Oct/2026:16:42:09 +0000] "GET /getcmd HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 34.75.235.196 - - [17/Oct/2026:16:42:09 +0000] "GET / HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 34.75.235.196 - - [17/Oct/2026:16:42:09 +0000] "GET / HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 34.75.235.196 - - [17/Oct/2026:16:42:09 +0000] "GET /aaa9 HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 34.75.235.196 - - [17/Oct/2026:16:42:09 +0000] "GET / HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 34.75.235.196 - - [17/Oct/2026:16:42:10 +0000] "GET /aab9 HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 34.75.235.196 - - [17/Oct/2026:16:43:40 +0000] "GET /getcmd HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 34.75.235.196 - - [17/Oct/2026:16:43:40 +0000] "GET /aab9 HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 34.75.235.196 - - [17/Oct/2026:16:43:40 +0000] "GET /aaa9 HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 34.75.235.196 - - [17/Oct/2026:16:43:40 +0000] "GET / HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 34.75.235.196 - - [17/Oct/2026:16:43:40 +0000] "GET / HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 34.75.235.196 - - [17/Oct/2026:16:43:41 +0000] "GET / HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 172.105.42.26 - - [17/Oct/2026:18:42:13 +0000] "GET /.well-known/acme-challenge/MUSXI0-4-D53CJ9BERDCTUVFK-K_KI-A HTTP/1.1" 200 64 "-" "Cpanel-HTTP-Client/1.0" 2a03:2880:15ff:5f:: - - [17/Oct/2026:20:28:30 +0000] "GET /lead-form-ar/1?sourcee=facebook HTTP/1.1" 200 8157 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 2a03:2880:15ff:5b:: - - [17/Oct/2026:21:17:20 +0000] "GET / HTTP/1.1" 200 20 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 172.105.42.26 - - [17/Oct/2026:21:42:13 +0000] "GET /.well-known/acme-challenge/WIRUTQRDMCR-UYW-KB9UQYN0A-AM_X8_ HTTP/1.1" 200 64 "-" "Cpanel-HTTP-Client/1.0" 31.56.58.165 - - [18/Oct/2026:00:21:07 +0000] "GET /api/session/properties HTTP/1.1" 404 20 "-" "metabase-cve-2026-72898-detect/1.0 (benign detection probes only)" 169.40.142.27 - - [18/Oct/2026:00:24:58 +0000] "GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1" 404 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 169.40.142.27 - - [18/Oct/2026:00:24:59 +0000] "GET /?rest_route=/gravitysmtp/v1/tests/mock-data&page=gravitysmtp-settings HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 169.40.142.27 - - [18/Oct/2026:00:24:59 +0000] "GET /index.php?rest_route=/gravitysmtp/v1/tests/mock-data&page=gravitysmtp-settings HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 169.40.142.27 - - [18/Oct/2026:00:24:59 +0000] "GET /wp-json/gravitysmtp/v1/tests/mock-data HTTP/1.1" 404 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 169.40.142.93 - - [18/Oct/2026:00:37:39 +0000] "GET /?rest_route=/gravitysmtp/v1/tests/mock-data&page=gravitysmtp-settings HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 169.40.142.93 - - [18/Oct/2026:00:37:39 +0000] "GET /index.php?rest_route=/gravitysmtp/v1/tests/mock-data&page=gravitysmtp-settings HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 169.40.142.93 - - [18/Oct/2026:00:37:39 +0000] "GET /wp-json/gravitysmtp/v1/tests/mock-data HTTP/1.1" 404 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 172.105.42.26 - - [18/Oct/2026:00:42:14 +0000] "GET /.well-known/acme-challenge/U7QJ15YSMF-KOD3LPI9JHGUV2KGZ7AJH HTTP/1.1" 200 64 "-" "Cpanel-HTTP-Client/1.0" 169.40.142.247 - - [18/Oct/2026:00:59:50 +0000] "GET /index.php?rest_route=/gravitysmtp/v1/tests/mock-data&page=gravitysmtp-settings HTTP/1.1" 200 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 169.40.142.247 - - [18/Oct/2026:00:59:50 +0000] "GET /wp-json/gravitysmtp/v1/tests/mock-data HTTP/1.1" 404 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2a03:2880:15ff:52:: - - [18/Oct/2026:02:43:59 +0000] "GET /lead-form-ar/1?sourcee=facebook HTTP/1.1" 200 8157 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 172.105.42.26 - - [18/Oct/2026:03:42:14 +0000] "GET /.well-known/acme-challenge/-M_P1CFBIP1J7PP9QSBI5SO9V92RBMHV HTTP/1.1" 200 64 "-" "Cpanel-HTTP-Client/1.0" 2a03:2880:16ff:56:: - - [18/Oct/2026:05:39:15 +0000] "GET /robots.txt HTTP/1.1" 200 20 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 172.105.42.26 - - [18/Oct/2026:06:42:14 +0000] "GET /.well-known/acme-challenge/VS_IJUD0EYWTIY2GWM9O6DERJCHM_X74 HTTP/1.1" 200 64 "-" "Cpanel-HTTP-Client/1.0" 199.16.157.181 - - [18/Oct/2026:08:46:33 +0000] "GET /robots.txt HTTP/1.1" 200 20 "-" "Twitterbot/1.0" 199.16.157.181 - - [18/Oct/2026:08:46:34 +0000] "GET /lead-form-ar/1 HTTP/1.1" 200 8148 "-" "Twitterbot/1.0" 20.196.193.222 - - [18/Oct/2026:09:00:54 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 403 9422 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:55 +0000] "GET /this_is_a_new_hello_world.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:55 +0000] "GET /app.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:55 +0000] "GET /bootstrap.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:55 +0000] "GET /core.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:56 +0000] "GET /footer.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:56 +0000] "GET /global.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:56 +0000] "GET /header.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:56 +0000] "GET /functions.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:56 +0000] "GET /main.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:57 +0000] "GET /lib.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:57 +0000] "GET /ws.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:57 +0000] "GET /bnmtp.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:57 +0000] "GET /date1.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:58 +0000] "GET /opsh.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:58 +0000] "GET /ebkid.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:58 +0000] "GET /MacKenzie.php?p= HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:58 +0000] "GET /np.php?p= HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:58 +0000] "GET /samll.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:59 +0000] "GET /config.php? HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:59 +0000] "GET /lock.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:59 +0000] "GET /b.php?p= HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:59 +0000] "GET /wp-content/themes/index.php HTTP/1.1" 404 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:00:59 +0000] "GET /adminfuns.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:00 +0000] "GET /alfa.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:00 +0000] "GET /222.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:00 +0000] "GET /3PJcpMFsD8B.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:00 +0000] "GET /media.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:01 +0000] "GET /1.php HTTP/1.1" 403 9422 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:01 +0000] "GET /aaa.php?p= HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:01 +0000] "GET /chosen.php HTTP/1.1" 403 9422 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:01 +0000] "GET /2P.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:01 +0000] "GET /ant.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:02 +0000] "GET /sitemap.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:02 +0000] "GET /zwso.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:02 +0000] "GET /simple.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:02 +0000] "GET //buy.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:03 +0000] "GET /ioxi-o.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:03 +0000] "GET /ans.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:03 +0000] "GET /gf.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:03 +0000] "GET /man.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:03 +0000] "GET /dev.php?p= HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:04 +0000] "GET /ms-edit.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:04 +0000] "GET /txets.php HTTP/1.1" 403 9422 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:04 +0000] "GET /hao.php?p= HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:04 +0000] "GET /33.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:05 +0000] "GET /adminner.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:05 +0000] "GET /thoms.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:05 +0000] "GET /a.php HTTP/1.1" 403 9422 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:05 +0000] "GET /sid.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:05 +0000] "GET /bro.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:06 +0000] "GET /xwpg.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:06 +0000] "GET /radio.php HTTP/1.1" 403 9422 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:06 +0000] "GET /Components.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:06 +0000] "GET /gelay.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:06 +0000] "GET /readme.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:07 +0000] "GET /max.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:07 +0000] "GET /post.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:07 +0000] "GET /themes.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:07 +0000] "GET /termps.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:07 +0000] "GET /brand.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:08 +0000] "GET /9.php HTTP/1.1" 403 9422 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:08 +0000] "GET /class.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:08 +0000] "GET /file.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:08 +0000] "GET /gulu.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:08 +0000] "GET /1a.php?p= HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:09 +0000] "GET /abcd.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:09 +0000] "GET /gfile.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:09 +0000] "GET /amdin.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:09 +0000] "GET /sallu.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:10 +0000] "GET /blog/wp-login.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:10 +0000] "GET /replace.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:10 +0000] "GET /magento/index.php/admin/ HTTP/1.1" 404 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:10 +0000] "GET /wp-content/admin.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:10 +0000] "GET /config/cache.php HTTP/1.1" 403 9422 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:11 +0000] "GET /lowfile.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:11 +0000] "GET /hinfofuns.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:11 +0000] "GET /wp-admin/css/ HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:11 +0000] "GET /BDKR28WP.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:11 +0000] "GET /wp-content/plugins/simple/simple.php HTTP/1.1" 404 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:12 +0000] "GET /sm.php HTTP/1.1" 200 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:12 +0000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 404 20 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:12 +0000] "GET /wp-includes/SimplePie/about.php HTTP/1.1" 403 9422 "-" "-" 20.196.193.222 - - [18/Oct/2026:09:01:12 +0000] "GET /f6.php HTTP/1.1" 200 20 "-" "-" 172.105.42.26 - - [18/Oct/2026:09:42:14 +0000] "GET /.well-known/acme-challenge/_1MIM65QIDT_ZRS32A_LJMLRNM-I64_Z HTTP/1.1" 200 64 "-" "Cpanel-HTTP-Client/1.0" 205.210.31.167 - - [18/Oct/2026:10:01:30 +0000] "GET / HTTP/1.1" 200 20 "-" "Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity"