: Have you seen the "php die" one that's followed by as many "A" as they can send? That's my favorite.
: I had a bunch of that last week.
: 220.127.116.11 "GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> -" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
: i expect these are ~all self-propagating wormisms (erry successful infection proceeds to port scan for 80 and try ad infinitum)
asciilifeform vaguely suspects that php bot probe liquishit may have replaced trad spam as 'large % of all ip traffic'
: ... with probes for known-diddlable konsoomer routers as close runner-up.
: asciilifeform: time since my last reconnect : 7d 22h 43m
: mike_c last seen in #asciilifeform on 2020-01-20 21:15:10
: multi-project wafers seem to bring the cost down a lot. more reading to do..
: asciilifeform: answered; also, ty for notification about sha1 setting in gpg.