HEX
Server: Microsoft-IIS/10.0
System: Windows NT ITPWINWEBSVR22 10.0 build 20348 (Windows Server 2022) AMD64
User: www.conferencesearch.co.uk (0)
PHP: 8.3.30
Disabled: NONE
$ pwd: D:/IISLogFiles/W3SVC13/
Upload Files
File: D:/IISLogFiles/W3SVC13/u_ex260801.log
#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2026-08-01 05:25:15
#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /wp-content/plugins/hellopress/wp_filemanager.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 102 84
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /this_is_a_new_hello_world.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 83 25
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /err.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 61 25
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /img.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 61 37
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /aa.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 61 40
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /av.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 61 36
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /xa.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 60 25
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /media.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 63 24
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /images.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 64 44
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /gecko.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 63 25
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /82.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 60 36
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /xstelth.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 65 46
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /xp.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 60 38
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /admin.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 65 27
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /adminner.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 66 42
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /a.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 60 38
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /k.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 59 44
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /222.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 61 46
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /mac.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 61 25
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /wp-content/uploads/ - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 73 41
2026-08-01 05:25:15 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /wp-includes/Text/ - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 71 26
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /ops.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 61 34
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /8.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 59 30
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /FWAZ.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 62 53
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /biufile.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 65 38
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /coffexium.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 67 38
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /simple.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 64 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /fpwch.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 63 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /dex.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 61 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /1.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 59 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /wp-admin/css/colors/modern/ - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 81 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /config.json.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 69 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /k2.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 60 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /raw.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 61 42
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /wp.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 62 40
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /fffm.php p= 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 65 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /111.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 61 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /wp-includes/Requests/ - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 76 33
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /ws.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 60 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /coffee.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 66 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /goods.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 63 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /about.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 64 46
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /about.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 63 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /admin.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 63 42
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /inputs.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 65 60
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /inputs.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 64 38
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /adminfuns.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 68 44
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /404.php p= 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 64 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /xxx.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 61 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /classwithtostring.php p= 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 78 56
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /234ff.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 63 25
2026-08-01 05:25:16 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /133.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 63 26
2026-08-01 05:25:17 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /wp-ws68.php p= 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 68 25
2026-08-01 05:25:17 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /mgrr.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 62 24
2026-08-01 05:25:17 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /55.php p= 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 63 25
2026-08-01 05:25:17 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /asd.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 61 35
2026-08-01 05:25:17 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /ajax.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 62 25
2026-08-01 05:25:17 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /yj09.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 62 25
2026-08-01 05:25:17 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /ora.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 61 71
2026-08-01 05:25:17 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /scxy.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 62 25
2026-08-01 05:25:17 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /ws13.php p= 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 65 34
2026-08-01 05:25:17 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /btx25.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 63 25
2026-08-01 05:25:17 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /xpohywjo.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 67 25
2026-08-01 05:25:17 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /ecvvhlei.php - 80 - 20.203.142.71 HTTP/1.1 - - - phpmyadmin.itpartnership.com 403 503 5 1372 66 68
#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2026-08-01 11:35:09
#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2026-08-01 11:35:09 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /.env - 443 - 94.154.43.184 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/147.0.0.0+Safari/537.36 - - phpmyadmin.itpartnership.com 403 503 5 1413 242 55
#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2026-08-01 12:23:07
#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2026-08-01 12:23:07 W3SVC13 itpwinwebsvr22 5.101.172.196 GET / - 80 - 205.210.31.6 HTTP/1.1 Hello+from+Palo+Alto+Networks,+find+out+more+about+our+scans+in+https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity - - phpmyadmin.itpartnership.com 403 503 5 1372 208 102
#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2026-08-01 15:21:00
#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2026-08-01 15:20:59 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /.env.dev - 443 - 34.92.93.198 HTTP/1.1 crusader-worker/1.0 - - phpmyadmin.itpartnership.com 403 503 5 1394 108 202
2026-08-01 15:20:59 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /.env.local - 443 - 34.92.93.198 HTTP/1.1 crusader-worker/1.0 - - phpmyadmin.itpartnership.com 403 503 5 1394 110 202
2026-08-01 15:20:59 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /.env.production - 443 - 34.92.93.198 HTTP/1.1 crusader-worker/1.0 - - phpmyadmin.itpartnership.com 403 503 5 1394 115 202
2026-08-01 15:20:59 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /.env.save - 443 - 34.92.93.198 HTTP/1.1 crusader-worker/1.0 - - phpmyadmin.itpartnership.com 403 503 5 1394 109 204
2026-08-01 15:20:59 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /.env.prod - 443 - 34.92.93.198 HTTP/1.1 crusader-worker/1.0 - - phpmyadmin.itpartnership.com 403 503 5 1394 109 203
2026-08-01 15:20:59 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /.env.old - 443 - 34.92.93.198 HTTP/1.1 crusader-worker/1.0 - - phpmyadmin.itpartnership.com 403 503 5 1394 108 204
2026-08-01 15:20:59 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /.env.bak - 443 - 34.92.93.198 HTTP/1.1 crusader-worker/1.0 - - phpmyadmin.itpartnership.com 403 503 5 1394 108 205
2026-08-01 15:20:59 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /.env.backup - 443 - 34.92.93.198 HTTP/1.1 crusader-worker/1.0 - - phpmyadmin.itpartnership.com 403 503 5 1394 111 205
2026-08-01 15:20:59 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /.env - 443 - 34.92.93.198 HTTP/1.1 crusader-worker/1.0 - - phpmyadmin.itpartnership.com 403 503 5 1394 104 215
2026-08-01 15:20:59 W3SVC13 itpwinwebsvr22 5.101.172.196 GET /.env.example - 443 - 34.92.93.198 HTTP/1.1 crusader-worker/1.0 - - phpmyadmin.itpartnership.com 403 503 5 1394 112 214
#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2026-08-01 16:31:24
#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2026-08-01 16:31:24 W3SVC13 itpwinwebsvr22 5.101.172.196 GET / - 443 - 205.210.31.3 HTTP/1.1 Hello+from+Palo+Alto+Networks,+find+out+more+about+our+scans+in+https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity - - phpmyadmin.itpartnership.com 403 503 5 1394 208 99
#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2026-08-01 18:03:56
#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2026-08-01 18:03:56 W3SVC13 itpwinwebsvr22 5.101.172.196 GET / - 443 - 104.168.115.241 HTTP/1.1 Mozilla/5.0+(compatible;+Applebot/0.1;++http://www.apple.com/go/applebot) - - phpmyadmin.itpartnership.com 403 503 5 1394 188 92
#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2026-08-01 20:37:28
#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2026-08-01 20:37:28 W3SVC13 itpwinwebsvr22 5.101.172.196 GET / - 443 - 94.154.43.185 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/147.0.0.0+Safari/537.36 - - phpmyadmin.itpartnership.com 403 503 5 1413 238 12
@ Telegram