The recordevery page load on this domain · reads only

when↕what↕site↕to what↕by↕from↕detail↕
10-01 18:23:31opened /record/—admin216.73.216.254
10-01 18:22:15opened /money/—admin216.73.216.254
10-01 18:21:50opened /record/—admin216.73.216.254
10-01 17:47:50opened /money/—admin216.73.216.254
10-01 17:47:32opened /record/—admin216.73.216.254
10-01 17:47:32opened /record/—admin216.73.216.254
10-01 17:47:10opened /record/—admin216.73.216.254
10-01 17:47:10opened /home/—admin216.73.216.254
10-01 17:47:02opened /money/—admin216.73.216.254
10-01 17:47:02opened /money/—admin216.73.216.254
10-01 17:46:50opened /funnel/—admin216.73.216.254
10-01 17:46:50opened /funnel/—admin216.73.216.254
10-01 17:46:18opened /money/—admin216.73.216.254
10-01 17:46:18opened /costs/—admin216.73.216.254
10-01 17:46:14opened /money/—admin216.73.216.254
10-01 17:46:14opened /funnel/—admin216.73.216.254
10-01 17:46:11opened /costs/—admin216.73.216.254
10-01 17:46:11opened /costs/—admin216.73.216.254
10-01 17:45:50opened /money/—admin216.73.216.254
10-01 17:45:50opened /credit/—admin216.73.216.254
10-01 17:45:18opened /mpesa/—admin216.73.216.254
10-01 17:45:18opened /clientlog/—admin216.73.216.254
10-01 17:45:15opened /engine/—admin216.73.216.254
10-01 17:35:37opened /costs/—admin74.7.227.27
10-01 17:35:37opened /costs/—admin74.7.227.27
10-01 17:35:36opened /costs/—admin74.7.227.27
10-01 17:35:35opened /money/—admin74.7.227.27
10-01 17:35:35opened /money/—admin74.7.227.27
10-01 17:35:33opened /costs/—admin74.7.227.27
10-01 17:35:32opened /engine/—admin74.7.227.27
10-01 17:35:32opened /people/—admin74.7.227.27
10-01 17:35:30opened /money/—admin74.7.227.27
10-01 17:35:30opened /money/—admin74.7.227.27
10-01 17:35:29opened /record/—admin74.7.227.27
10-01 17:35:28opened /record/—admin74.7.227.27
10-01 17:35:23opened /fair/—admin74.7.227.27
10-01 17:35:23opened /record/—admin74.7.227.27
10-01 17:35:22opened /fair/—admin74.7.227.27
10-01 17:35:22opened /fair/—admin74.7.227.27
10-01 17:35:21opened /record/—admin74.7.227.27
10-01 17:35:17opened /record/—admin74.7.227.27
10-01 17:35:16opened /record/—admin74.7.227.27
10-01 17:35:16opened /record/—admin74.7.227.27
10-01 17:35:12opened /money/—admin74.7.227.27
10-01 17:35:12opened /money/—admin74.7.227.27
10-01 17:35:11opened /money/—admin74.7.227.27
10-01 17:35:11opened /record/—admin74.7.227.27
10-01 17:35:10opened /record/—admin74.7.227.27
10-01 17:35:10opened /money/—admin74.7.227.27
10-01 17:35:09opened /money/—admin74.7.227.27
10-01 17:35:08opened /record/—admin74.7.227.27
10-01 17:35:07opened /funnel/—admin74.7.227.27
10-01 17:35:07opened /funnel/—admin74.7.227.27
10-01 17:35:05opened /record/—admin74.7.227.27
10-01 17:35:04opened /record/—admin74.7.227.27
10-01 17:35:04opened /funnel/—admin74.7.227.27
10-01 17:35:03opened /money/—admin74.7.227.27
10-01 17:35:03opened /money/—admin74.7.227.27
10-01 17:35:01opened /money/—admin74.7.227.27
10-01 17:35:00opened /money/—admin74.7.227.27
60 of 424 matching
Showing 60 of 424 lines. Show more

The fileswhere all of this lives

file↕what it holds↕size↕↕↕
actions.logevery player, money, account and access action—
mpesa-changes.logevery key written, with the values masked—
admin-access.logevery page load on this domain25.4 KB
The lines worth looking for. worth a look marks anything that moved money, changed a person, or showed a password. A password revealed you did not do means someone with admin access opened Access — change those site passwords, then read this page from the top. login failed in a run means someone is guessing; five in fifteen minutes and that name is already locked out.