Tekil Mesaj gösterimi - Wordpress Sitem 2 Günde 2 Kere Hack Yedi.

Konu Wordpress Sitem 2 Günde 2 Kere Hack Yedi.
07-03-2019, 13:54:36
#21
access.log dosyasında şu ibareler var. Sanırım post ile bir şekilde dosyayı yüklemeyi başarmışlar. Tusi diye arattığımda işlemleri görebiliyorum.
94.73.191.218 - - [07/Mar/2019:04:06:13 +0300] "GET /wp-json HTTP/1.0" 302 304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36"
94.73.191.218 - - [07/Mar/2019:04:06:15 +0300] "GET /wp-admin HTTP/1.0" 301 515 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36"
94.73.191.218 - - [07/Mar/2019:04:06:23 +0300] "GET /administrator/ HTTP/1.0" 302 304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36"
94.73.191.218 - - [07/Mar/2019:04:06:25 +0300] "GET /customer/account/login HTTP/1.0" 302 304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36"
94.73.191.218 - - [07/Mar/2019:04:06:26 +0300] "GET /user/login HTTP/1.0" 302 304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36"
94.130.140.243 - - [07/Mar/2019:04:37:05 +0300] "GET / HTTP/1.0" 302 304 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.15 (KHTML, like Gecko) Chrome/24.0.1295.0 Safari/537.15"
52.32.119.38 - - [07/Mar/2019:06:30:16 +0300] "GET / HTTP/1.0" 500 195 "-" "Go-http-client/1.1"
78.138.117.101 - - [07/Mar/2019:09:02:38 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (compatible; XoviBot/2.0; +http://www.xovibot.net/)"
103.59.156.16 - - [07/Mar/2019:10:11:21 +0300] "GET / HTTP/1.0" 302 304 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; InfoPath.2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"
136.0.2.156 - - [07/Mar/2019:10:34:43 +0300] "GET /test HTTP/1.0" 302 304 "-" "Mozilla/5.0 (Windows NT 6.1; rv:34.0) Gecko/20142421 Firefox/34.0"
136.0.2.156 - - [07/Mar/2019:10:34:44 +0300] "POST /wp-content/themes/tusi/default-EDD_SL_Plugin_Updater.php%7C274113-wso-sell HTTP/1.0" 302 304 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36"
136.0.2.156 - - [07/Mar/2019:10:34:45 +0300] "POST /wp-content/themes/tusi/default-EDD_SL_Plugin_Updater.php%7C274113-wso-sell HTTP/1.0" 302 304 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:32 +0300] "GET / HTTP/1.0" 302 304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:33 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:36 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:37 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:37 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:38 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:38 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:38 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:39 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:39 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:39 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:40 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:40 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:40 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:41 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:41 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:41 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:42 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:42 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:43 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:43 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:43 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
81.214.57.186 - - [07/Mar/2019:11:38:44 +0300] "GET / HTTP/1.0" 500 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"