The actual Ezooms bot seems fairly legit: http://user-agent-string.info/list-of-ua/bot-detail?bot=Ezooms
However, this is most-likely the result of some kind of hack attempt. But here are a few observations:
- The last few coherent log entries show Ezooms requesting robots.txt, and then making the "questionable" request almost an hour later. So, why does a malicious bot need robot.txt? And why wait so long if this is just a hack attempt? And why use such an obscure user agent string? Why not blend in with all the regular desktop clients or the Google bot?
- The Ezooms bot requests come from Wowrack.com's net block. Which suggests this is likely the real Ezooms bot.
- The binary data looks like it could be a gzip file (maybe a phpshell-type backdoor), as
1F 8B 08 08 F9 is the gzip header.
- Shortly after the zip header, you have the original filename, which seems to be "tigertutorialscom". Tigertutorials.com just so happens to be another site hosted off of the same IP as your website, and it seems to have a pretty severe security flaw.
Most probably, the other site got compromised due to bad server-side coding, and then your account was compromised due to poor web server configurations. Ezooms probably has nothing to do with it.
If your logs continue to be corrupted like this, try to make quarter-hourly backups to a separate location or email them to yourself, so you can see what the logs looked like before it was overwritten.
I'm too lazy to do this (I don't think pastebin is binary-safe, and the line breaks seem to have been stripped from the log data anyway), but you should be able to extract the binary data from the log file and see if it's a valid gzip file, and, if it is, see what its contents are.
In any case, you should probably treat your site/web hosting account as if it's compromised at least until your web host can explain how your log file ended up like that. If they can't, you might consider switching web hosts.
