35.203.211.58 - - [14/Sep/2025:05:21:33 -0700] "GET /.well-known/security.txt HTTP/1.1" 200 2572 "-" "Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity" 12 **0/12334**
45.9.168.192 - - [14/Sep/2025:05:38:12 -0700] "POST /ajax HTTP/1.1" 200 2572 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" 11 **0/11158**
20.169.85.114 - - [14/Sep/2025:06:27:09 -0700] "GET /owa/auth/x.js HTTP/1.1" 200 1250 "-" "Mozilla/5.0 zgrab/0.x" 515 **0/515227**
3.132.23.201 - - [14/Sep/2025:07:03:14 -0700] "GET / HTTP/1.0" 400 2572 "-" "-" 511 **0/511860**
3.132.23.201 - - [14/Sep/2025:07:04:51 -0700] "GET / HTTP/1.0" 400 2572 "-" "-" 7 **0/7069**
3.132.23.201 - - [14/Sep/2025:07:07:44 -0700] "GET / HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36" 4 **0/4041**
172.202.118.19 - - [14/Sep/2025:07:24:26 -0700] "GET /developmentserver/metadatauploader HTTP/1.1" 200 1250 "-" "Mozilla/5.0 zgrab/0.x" 9 **0/9570**
115.231.78.10 - - [14/Sep/2025:08:10:59 -0700] "GET / HTTP/1.1" 200 2572 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.2623.112 Safari/537.36" 515 **0/515393**
115.231.78.10 - - [14/Sep/2025:08:11:00 -0700] "GET / HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE" 5 **0/5608**
115.231.78.10 - - [14/Sep/2025:08:11:00 -0700] "GET /favicon.ico HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE" 4 **0/4667**
115.231.78.10 - - [14/Sep/2025:08:11:01 -0700] "GET /robots.txt HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE" 12 **0/12803**
167.94.138.185 - - [14/Sep/2025:10:30:47 -0700] "GET / HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 513 **0/513746**
167.94.138.185 - - [14/Sep/2025:10:30:47 -0700] "GET /favicon.ico HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 5 **0/5024**
167.94.138.185 - - [14/Sep/2025:10:31:00 -0700] "GET /favicon.ico HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 4 **0/4793**
167.94.138.185 - - [14/Sep/2025:10:31:00 -0700] "GET /security.txt HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 9 **0/9869**
206.168.34.49 - - [14/Sep/2025:11:44:51 -0700] "GET / HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 513 **0/513187**
206.168.34.49 - - [14/Sep/2025:11:44:52 -0700] "GET /favicon.ico HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 10 **0/10145**
206.168.34.49 - - [14/Sep/2025:11:45:19 -0700] "GET /favicon.ico HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 10 **0/10179**
206.168.34.49 - - [14/Sep/2025:11:45:23 -0700] "GET /login HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 7 **0/7956**
150.255.251.173 - - [14/Sep/2025:12:11:14 -0700] "GET / HTTP/1.1" 200 2572 "-" "Go-http-client/1.1" 514 **0/514405**
159.138.239.156 - - [14/Sep/2025:12:47:08 -0700] "GET / HTTP/1.1\n" 400 2572 "-" "-" 511 **0/511909**
176.32.195.85 - - [14/Sep/2025:13:06:09 -0700] "GET / HTTP/1.0" 400 2572 "-" "-" 512 **0/512137**
46.161.50.108 - - [14/Sep/2025:13:06:44 -0700] "GET / HTTP/1.0" 400 2572 "-" "-" 7 **0/7425**
176.32.195.85 - - [14/Sep/2025:13:06:44 -0700] "GET / HTTP/1.0" 400 2572 "-" "-" 7 **0/7177**
176.32.195.85 - - [14/Sep/2025:13:06:44 -0700] "GET /aaa9 HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 5 **0/5060**
176.32.195.85 - - [14/Sep/2025:13:06:45 -0700] "GET /aab9 HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 11 **0/11749**
176.32.195.85 - - [14/Sep/2025:13:07:01 -0700] "GET / HTTP/1.0" 400 2572 "-" "-" 2 **0/2772**
95.215.0.144 - - [14/Sep/2025:13:07:02 -0700] "GET /aaa9 HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 4 **0/4805**
95.215.0.144 - - [14/Sep/2025:13:07:05 -0700] "GET /aab9 HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 5 **0/5002**
123.58.200.147 - - [14/Sep/2025:13:30:26 -0700] "GET / HTTP/1.1" 200 2572 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0" 515 **0/515344**
123.58.200.147 - - [14/Sep/2025:13:30:32 -0700] "GET /favicon.ico HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11" 10 **0/10070**
123.58.200.147 - - [14/Sep/2025:13:30:33 -0700] "GET /robots.txt HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11" 4 **0/4999**
123.58.200.147 - - [14/Sep/2025:13:30:33 -0700] "GET /sitemap.xml HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11" 5 **0/5223**
123.58.200.147 - - [14/Sep/2025:13:30:37 -0700] "GET /config.json HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11" 3 **0/3827**
35.216.241.81 - - [14/Sep/2025:14:05:40 -0700] "GET / HTTP/1.1" 200 1250 "-" "Mozilla/5.0" 513 **0/513648**
40.119.24.130 - - [14/Sep/2025:15:09:28 -0700] "GET /owa/auth/logon.aspx HTTP/1.1" 200 1250 "-" "Mozilla/5.0 zgrab/0.x" 514 **0/514099**
20.65.194.38 - - [14/Sep/2025:15:31:46 -0700] "GET / HTTP/1.0" 400 2572 "-" "-" 511 **0/511606**
185.242.226.120 - - [14/Sep/2025:15:46:57 -0700] "GET / HTTP/1.1" 200 1250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36" 9 **0/9853**
195.170.172.128 - - [14/Sep/2025:16:42:24 -0700] "{\"id\": 1, \"method\": \"mining.subscribe\", \"params\": [\"cpuminer/2.5.1\"]}\n" 400 2572 "-" "-" 512 **0/512041**
195.170.172.128 - - [14/Sep/2025:16:42:32 -0700] "{\"id\": 1, \"method\": \"mining.subscribe\", \"params\": [\"MinerName/1.0.0\", \"EthereumStratum/1.0.0\"]}\n" 400 2572 "-" "-" 9 **0/9008**
195.170.172.128 - - [14/Sep/2025:16:42:37 -0700] "{\"id\":1,\"method\":\"eth_submitLogin\",\"worker\":\"igwrcvap\",\"params\":[\"0xe4633b70b4ce13c239bc4fe5ae891515a702a86f\",\"x\"],\"jsonrpc\":\"2.0\"}\n" 400 2572 "-" "-" 1 **0/1630**
195.170.172.128 - - [14/Sep/2025:16:42:43 -0700] "{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"47Pwu31smrjE6GnQtWDDhViuTRmxmdY4LQNzb11jc6uQPAQQm9T7fh9iHXx4yuXKJfBaCkebfWJxnfzyA4ubh52c5S6o7F5\",\"pass\":\"x\",\"agent\":\"XMRig/6.15.3 (Windows NT 10.0; Win64; x64) libuv/1.42.0 msvc/2019\",\"algo\":[\"cn/1\",\"cn/2\",\"cn/r\",\"cn/fast\",\"cn/half\",\"cn/xao\",\"cn/rto\",\"cn/rwz\",\"cn/zls\",\"cn/double\",\"cn/ccx\",\"cn-lite/1\",\"cn-heavy/0\",\"cn-heavy/tube\",\"cn-heavy/xhv\",\"cn-pico\",\"cn-pico/tlo\",\"cn/upx2\",\"rx/0\",\"rx/wow\",\"rx/arq\",\"rx/graft\",\"rx/sfx\",\"rx/keva\",\"argon2/chukwa\",\"argon2/chukwav2\",\"argon2/ninja\",\"astrobwt\"]}}\n" 400 2572 "-" "-" 1 **0/1937**
195.170.172.128 - - [14/Sep/2025:16:42:48 -0700] "GET / HTTP/1.1" 200 2572 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36" 9 **0/9896**
195.170.172.128 - - [14/Sep/2025:16:42:52 -0700] "POST / HTTP/1.1" 200 2572 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36" 7 **0/7338**
195.170.172.128 - - [14/Sep/2025:16:42:56 -0700] "POST / HTTP/1.1" 200 2572 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36" 6 **0/6090**
195.170.172.128 - - [14/Sep/2025:16:43:03 -0700] "GET /WuEL HTTP/1.1" 200 2572 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; ; NCLIENT50_AAPCDA5841E333)" 4 **0/4845**
195.170.172.128 - - [14/Sep/2025:16:43:08 -0700] "GET stager64 HTTP/1.1" 400 2572 "-" "-" 8 **0/8501**
195.170.172.128 - - [14/Sep/2025:16:43:14 -0700] "GET /a HTTP/1.1" 200 2572 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36" 11 **0/11667**
195.170.172.128 - - [14/Sep/2025:16:43:19 -0700] "GET /download/file.ext HTTP/1.1" 200 2572 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36" 5 **0/5186**
195.170.172.128 - - [14/Sep/2025:16:43:24 -0700] "GET /SiteLoader HTTP/1.1" 200 2572 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36" 6 **0/6459**
195.170.172.128 - - [14/Sep/2025:16:43:29 -0700] "GET /mPlayer HTTP/1.1" 200 2572 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36" 3 **0/3894**
195.170.172.128 - - [14/Sep/2025:16:43:33 -0700] "POST / HTTP/1.1" 400 2572 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36" 12466 **12/12466651**
195.170.172.128 - - [14/Sep/2025:16:43:50 -0700] "GET / HTTP/1.1" 400 2572 "-" "-" 2 **0/2431**