Heh, seems like background radiation of the web kept being the same for PHP scanners (Note: I don't have PHP stuff, so it's purely scanners).

0 w5T09:21:10 root@NightmareMoon /var/log/syslog/NightmareMoon/local7_nginx/2026/10 > grep -cF .php * | column -c80

01.log:112      06.log:41       11.log:56       16.log:98       21.log:116
02.log:101      07.log:84       12.log:158      17.log:102      22.log:129
03.log:99       08.log:83       13.log:141      18.log:39       23.log:61
04.log:88       09.log:33       14.log:100      19.log:101
05.log:63       10.log:156      15.log:209      20.log:55