163.172.4.153 - - [17/Oct/2017:05:51:37 +0000] "GET / HTTP/1.1" 200 57264 "https://www.mywebsite.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0" "-“
‹�³IäY�ìmsÛ¶–Çßï§ÐäU3]Rø¬N§ÓöÞm»·Ùf6ÙÍîììd( ’ó©$eG}±Ÿ}AJ¶i ´p QvÒ4N"Ëâï� Ï$°Lß3‰k†ƒÿúâNÿXÔSjfy3Ì\òÅÿûßÉ«þþ~2½ÊSVDk6Çùä×÷ïßN‰I^Ml‹LHàN^¯&¯ÞäÅIM]Óš|³ÈÓ"ªãy¾›üÅËMUÄKVN©i}7ùöª®‹Ùtz{{kΛošüíÓŠEåâjº{£yU§ÉëWÍ'ÿ¹ç¥Þ p |>\BqÃǸœrÚÁ¤–5!! ïÞ,°¦é¶ú3™FË4Îú]À:¤þ×¼\3†Ç±œ ÿF7%…À´/§¸*Ò-bÉc¼¹Œñ0l@£\FÛ(ôB8ìápp89Š=h%9ZŒ± Š4ÂApeã9bCH2TWy±œŠ€6%Š2—Q:*ÃÛ7?Žz}Ô|K¶F’XCÁ“» —2ÆçhæB0.À;ì(…A $ ˜j[]Š_.¢ßî°Ä-C¢@½+–¤Ø¥Bh)ˆ«[€ Æîû¹[´<ªcf 0Ü,èÔLÀ‚¶Œ åPÛÀÁîe€ðßhAæKè+®ÃÚäb:fì� ß½€±ìsvÇRa…ÌÈ À@
There’s plenty more, enough to cross the char limit on ServerFault so I had to host the whole blob elsewhere.
The site is running WordPress 4.8 behind Nginx 1.13.6
UPDATE
I opened up the whole blob inside Sublime Text with the proper encoding...
If I’m not mistaken those are ASCII control characters and my suspicion is that nginx is logging an SSH session?
Am I getting hacked?
Or is my own SSH login somehow being entered into the logs?
Or is my suspicion completely off-base and there’s a better explanation?
log_format
directive in any of yournginx
configuration files?$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for”