105.156.39.223 - - [26/Dec/2025:16:13:57 +0330] "GET /c.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:34 +0330] "GET //wso.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:34 +0330] "GET //x.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:51 +0330] "GET //shell-script.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:23 +0330] "GET //copy.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:26 +0330] "GET //fw.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:36 +0330] "GET //wso.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:12 +0330] "GET //shell.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:13:35 +0330] "GET //chosen.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:21 +0330] "GET //contents.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:13:47 +0330] "GET /y.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:13:52 +0330] "GET /b.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:25 +0330] "GET //zossipei.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
104.28.250.135 - - [26/Dec/2025:15:49:59 +0330] "GET /admin.php HTTP/1.1" 200 4273 "-" "python-httpx/0.28.1"
105.156.39.223 - - [26/Dec/2025:16:14:17 +0330] "GET //core.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:16:01 +0330] "GET //lf.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:16:33 +0330] "GET //wikindex.php HTTP/1.1" 200 203 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:03 +0330] "GET //m.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:13:32 +0330] "GET //about.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:00 +0330] "GET /e.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
178.128.167.120 - - [26/Dec/2025:15:42:42 +0330] "GET /simple.php HTTP/1.1" 200 4273 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36Team Anon Force"
105.156.39.223 - - [26/Dec/2025:16:14:42 +0330] "GET //utchiha_offer.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:16:05 +0330] "GET //alex.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:16:10 +0330] "GET //mailer.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:16:37 +0330] "GET //alfa.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:14 +0330] "GET /wordpress.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:19 +0330] "GET //wso112233.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:19 +0330] "GET //dnvokikk.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:43 +0330] "GET //ups.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:17 +0330] "GET //send.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:53 +0330] "GET //rdpl.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:38 +0330] "GET //srx.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:16:21 +0330] "GET //1index.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:31 +0330] "GET //ninjasec.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:36 +0330] "GET //alfanew.php7 HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:04 +0330] "GET //xleet.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:39 +0330] "GET //user.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:32 +0330] "GET //glppziux.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:15 +0330] "GET //osx.php HTTP/1.1" 200 204 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:13:42 +0330] "GET /r.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:01 +0330] "GET //wso112233.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:57 +0330] "GET //leafmailer2.8.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:13:37 +0330] "GET //content.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:02 +0330] "GET /zz.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:13:50 +0330] "GET /a.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:14 +0330] "GET //rain.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:16 +0330] "GET //rdpl.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:16:15 +0330] "GET //gaza.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:08 +0330] "GET //haxor.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:56 +0330] "GET //simple.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:16:23 +0330] "GET //3index.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:16:35 +0330] "GET //wso1.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:13:39 +0330] "GET /shop.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:00 +0330] "GET //bb.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
36.82.37.94 - - [26/Dec/2025:15:56:28 +0330] "GET /BDKR28WP.php?d=2f686f6d652f69796d646a777a6c2f7075626c69635f68746d6c HTTP/1.1" 200 4273 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
36.82.37.94 - - [26/Dec/2025:15:56:30 +0330] "GET /favicon.ico HTTP/1.1" 404 796 "http://mail.fallenmobile.ir/BDKR28WP.php?d=2f686f6d652f69796d646a777a6c2f7075626c69635f68746d6c" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
105.156.39.223 - - [26/Dec/2025:16:14:08 +0330] "GET /aa.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:46 +0330] "GET //xmlrpc.php HTTP/1.1" 200 4302 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:48 +0330] "GET //doc.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:06 +0330] "GET //Lux.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:51 +0330] "GET //xx.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:59 +0330] "GET //atomlib.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:16:08 +0330] "GET //new.php HTTP/1.1" 200 210 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
104.28.250.135 - - [26/Dec/2025:15:50:00 +0330] "GET /admin.php HTTP/1.1" 200 4273 "-" "python-httpx/0.28.1"
105.156.39.223 - - [26/Dec/2025:16:14:44 +0330] "GET //style.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:29 +0330] "GET //lf_utchiha.php HTTP/1.1" 200 203 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:28 +0330] "GET //ae.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:55 +0330] "GET //leaf.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:16:13 +0330] "GET //marijuana.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:16:19 +0330] "GET //wp-admin.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:14:11 +0330] "GET /upload.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:15:41 +0330] "GET //1337.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:59 +0330] "GET //cpn.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:18:21 +0330] "GET //r99.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:21 +0330] "GET //dam.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:50 +0330] "GET //c22.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:00 +0330] "GET //cp.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:32 +0330] "GET /xd.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:50 +0330] "GET /priv8.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:18:14 +0330] "GET //cpbt.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:11 +0330] "GET //changeall.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:18 +0330] "GET //dz0.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:36 +0330] "GET //c99.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:14 +0330] "GET /tmp/L3b.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:09 +0330] "GET /tmp/sql.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:39 +0330] "GET /5.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:36 +0330] "GET /uuhoxcyb.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:06 +0330] "GET /nf_tracking.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:40 +0330] "GET /wp-atom.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:57 +0330] "GET //cpanel.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:18:40 +0330] "GET //d0main.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:21:20 +0330] "GET //admin.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:21:34 +0330] "GET /gaza.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:21:40 +0330] "GET //upload.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:48 +0330] "GET /balance.php HTTP/1.1" 200 203 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:17 +0330] "GET /admin1.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:21:37 +0330] "GET /up.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:28 +0330] "GET /1.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:31 +0330] "GET /2.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:16 +0330] "GET /todo.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:20 +0330] "GET /ttcecnmc.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:18:05 +0330] "GET //mysql.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:18:25 +0330] "GET //lol.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:18:27 +0330] "GET //jo.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:43 +0330] "GET /admin1/ HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:23 +0330] "GET /up.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:21:43 +0330] "GET /uploads.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:17 +0330] "GET /Symlink.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:35 +0330] "GET /c100.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:41 +0330] "GET /6.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:43 +0330] "GET /wp-pano.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:18:19 +0330] "GET //x.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:33 +0330] "GET /admin2.asp HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:21:55 +0330] "GET /dz.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:04 +0330] "GET /inputs.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:30 +0330] "GET //wp-content.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:18:42 +0330] "GET //d0mains.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:42 +0330] "GET //wp.zip HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:42 +0330] "GET /Server.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:10 +0330] "GET /admins.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:53 +0330] "GET /zvpqaqfb.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:32 +0330] "GET //wp-upload.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:39 +0330] "GET //asad.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:47 +0330] "GET //azerty.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:49 +0330] "GET //dell.php HTTP/1.1" 200 204 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:18:10 +0330] "GET //cp.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:08 +0330] "GET //killer.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:29 +0330] "GET //whmcs.php HTTP/1.1" 200 210 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:40 +0330] "GET //1.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:38 +0330] "GET /sa.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:21:16 +0330] "GET //sa.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:44 +0330] "GET /wp-admin/c99.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:46 +0330] "GET /amhlzdhk.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:14 +0330] "GET /tesTlme.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:21 +0330] "GET //uplo.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:41 +0330] "GET //wp-admin.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:13 +0330] "GET //2.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:27 +0330] "GET //dom.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:20 +0330] "GET /upload.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:31 +0330] "GET /vb.rar HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:43 +0330] "GET /3x.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:22 +0330] "GET /txfpcuhw.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:25:01 +0330] "GET //plugin.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:26 +0330] "GET //osx.php HTTP/1.1" 200 204 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:18:35 +0330] "GET //shellz.php HTTP/1.1" 200 205 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:21:48 +0330] "GET /amad.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:55 +0330] "GET //xl2023.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:24 +0330] "GET //upload.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:45 +0330] "GET //smtp.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:23 +0330] "GET //user.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:49 +0330] "GET /images/Sym.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:51 +0330] "GET //r57.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:47 +0330] "GET /tmp/priv8.php HTTP/1.1" 200 205 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:26 +0330] "GET /w.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:09 +0330] "GET /d.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:12 +0330] "GET /tmp/d.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:25 +0330] "GET /vb.zip HTTP/1.1" 200 203 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:28 +0330] "GET /unZIPpeRqyr.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
162.128.153.97 - - [26/Dec/2025:16:24:36 +0330] "GET /a.php HTTP/1.1" 200 4273 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.36"
105.156.39.223 - - [26/Dec/2025:16:24:38 +0330] "GET /webhook.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:48 +0330] "GET /wso112233.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:18:16 +0330] "GET //sYm.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:56 +0330] "GET //c100.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:21:29 +0330] "GET //sa2.php HTTP/1.1" 200 203 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:21:32 +0330] "GET //2.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:28 +0330] "GET /images/c99.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:58 +0330] "GET //Cpanel.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:21:58 +0330] "GET /Black.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:51 +0330] "GET /curl.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:58 +0330] "GET //shadow.php HTTP/1.1" 200 202 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:04 +0330] "GET //madspotshell.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:06 +0330] "GET /L3b.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:15 +0330] "GET /dz1.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:57 +0330] "GET /hyivatpf.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:45 +0330] "GET /wqjtejxi.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:38 +0330] "GET //gaza.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:45 +0330] "GET /madspotshell.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:21:45 +0330] "GET /shell.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:06 +0330] "GET /d0maine.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:33 +0330] "GET /3.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:36 +0330] "GET //404.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:54 +0330] "GET //dz.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:40 +0330] "GET /sysadmins/ HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:03 +0330] "GET /whmcs.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:12 +0330] "GET /tmp/dz1.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:20 +0330] "GET /wp.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:19 +0330] "GET /admins.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:11 +0330] "GET /slax.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
5.24.58.76 - - [26/Dec/2025:16:29:34 +0330] "GET / HTTP/1.1" 200 4273 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15"
5.24.58.76 - - [26/Dec/2025:16:29:35 +0330] "GET /favicon.ico HTTP/1.1" 404 796 "http://fallenmobile.ir/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15"
105.156.39.223 - - [26/Dec/2025:16:18:32 +0330] "GET //whmcs.php HTTP/1.1" 200 210 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:57 +0330] "GET /tmp/cgi.pl HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:13 +0330] "GET /admins.asp HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:37 +0330] "GET /4.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:00 +0330] "GET /index.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:32 +0330] "GET /utchiha2023.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:52 +0330] "GET //WSO.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:33 +0330] "GET //r00t.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:47 +0330] "GET /administration/Sym.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:26 +0330] "GET /sysadmin.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:05 +0330] "GET /webadmin.html HTTP/1.1" 200 204 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:30 +0330] "GET /ut.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:18:02 +0330] "GET //sql.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:18:07 +0330] "GET //madspot.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:00 +0330] "GET /downloads/dom.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:21 +0330] "GET /wp.zip HTTP/1.1" 200 204 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:08 +0330] "GET /qkyplyur.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:18:30 +0330] "GET //wp.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:16 +0330] "GET //Sh3ll.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:20:35 +0330] "GET /uploads.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:01 +0330] "GET /asp.php HTTP/1.1" 200 208 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:24:24 +0330] "GET /unzipper.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:17:35 +0330] "GET //wp-mail.php HTTP/1.1" 200 4302 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:05 +0330] "GET //Cgishell.pl HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:19:47 +0330] "GET //Sym.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:21:50 +0330] "GET /t00.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:38 +0330] "GET /spy.aspx HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:40 +0330] "GET /xd.php HTTP/1.1" 200 207 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:22:54 +0330] "GET /cgi.pl HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:23 +0330] "GET /a.php HTTP/1.1" 200 209 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
105.156.39.223 - - [26/Dec/2025:16:23:55 +0330] "GET /database.php HTTP/1.1" 200 206 "https://www.google.com" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
43.154.127.188 - - [26/Dec/2025:17:04:30 +0330] "GET /?path=/ HTTP/1.1" 200 3324 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1"
49.51.183.220 - - [26/Dec/2025:16:51:26 +0330] "GET / HTTP/1.1" 200 4273 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1"
43.157.191.20 - - [26/Dec/2025:17:13:43 +0330] "GET /?fileloc=/home/iymdjwzl/public_html/index.php0&path=/home/iymdjwzl/public_html HTTP/1.1" 200 4374 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1"