PNG  IHDR;IDATxܻn0K )(pA 7LeG{ §㻢|ذaÆ 6lذaÆ 6lذaÆ 6lom$^yذag5bÆ 6lذaÆ 6lذa{ 6lذaÆ `}HFkm,mӪôô! x|'ܢ˟;E:9&ᶒ}{v]n&6 h_tڠ͵-ҫZ;Z$.Pkž)!o>}leQfJTu іچ\X=8Rن4`Vwl>nG^is"ms$ui?wbs[m6K4O.4%/bC%t Mז -lG6mrz2s%9s@-k9=)kB5\+͂Zsٲ Rn~GRC wIcIn7jJhۛNCS|j08yiHKֶۛkɈ+;SzL/F*\Ԕ#"5m2[S=gnaPeғL lذaÆ 6l^ḵaÆ 6lذaÆ 6lذa; _ذaÆ 6lذaÆ 6lذaÆ RIENDB` #!/bin/bash DDATE1=$(tail -n1 /var/log/exim_mainlog | awk '{print $1}') ## #find wp-content/uploads related spam grep cwd /var/log/exim_mainlog | grep wp-content| grep uploads | egrep -w "($DDATE1)" | awk '{print $3}' | sort -n | uniq -c | sort -n | awk -F "uploads" '{print $1}' | awk -F"=" '{print "cd",$2"uploads"}' ## # find wp-include css/js related spam grep cwd /var/log/exim_mainlog | egrep -w "($DDATE1)" | grep wp-include | egrep -w "(css|js)" | awk '{print $3}' | awk -F"=" '{print "cd",$2}' |sort -n | uniq | sort -n #find joomla grep cwd /var/log/exim_mainlog | egrep -w "($DDATE1)" | egrep "(components/com_*|libraries/joomla|wp-content/themes|wp-content/plugins|/administrator/templates)" | awk '{print $3}' | awk -F"=" '{print "cd",$2}' |sort -n | uniq | sort -n #grep cwd /var/log/exim_mainlog | egrep -w "($DDATE1)" | egrep "(components/com_*|libraries/joomla|wp-content/themes|wp-content/plugins|/administrator/templates|public_html/cgi-bin|wp-content/plugins|wp-includes/css|wp-admin/css|wp-admin/network|wp-includes/SimplePie|wp-content/themes|templates/|components/com_|modules/mod_|)" | awk '{print $3}' | awk -F"=" '{print "cd",$2}' |sort -n | uniq | sort -n