LOG file showing unknow IP

[oavs]

[Note: remember to include site URL, ZC version, list of plugins, PHP version, etc ... read the Posting Tips shown above for information to include in your post here. And, remove this comment before actually posting!]
Zen versuion 1.5.6c
PHP: 7.2

I have been very suspicious since in my logs on the first line I keep getting an IP address not from my country (AU). Although I can block this IP, next time around this same first line of the log changes the IP to totrally fifferent prefix.

[06-Apr-2020 09:08:00 Australia/Sydney] Request URI: /index.php?main_page=product_info&products_id=214, IP address: 66.249.75.51
#1  require(/home/qbr49655/public_html/includes/init_includes/init_sessions.php) called at [/home/qbr49655/public_html/includes/autoload_func.php:48]
#2  require(/home/qbr49655/public_html/includes/autoload_func.php) called at [/home/qbr49655/public_html/includes/application_top.php:170]
#3  require(/home/qbr49655/public_html/includes/application_top.php) called at [/home/qbr49655/public_html/index.php:26]
--> PHP Warning: Use of undefined constant OFFICE_IP_TO_HOST_ADDRESS - assumed 'OFFICE_IP_TO_HOST_ADDRESS' (this will throw an Error in a future version of PHP) in /home/qbr49655/public_html/includes/init_includes/init_sessions.php on line 112.

and

[06-Apr-2020 09:09:09 Australia/Sydney] Request URI: /index.php?main_page=product_info&products_id=383, IP address: 66.249.75.53
etc

and

[06-Apr-2020 09:10:27 Australia/Sydney] Request URI: /index.php?main_page=product_info&cPath=58&products_id=174, IP address: 17.58.101.145
etc

and

[06-Apr-2020 09:11:43 Australia/Sydney] Request URI: /index.php?main_page=product_info&cPath=54&products_id=58, IP address: 17.58.101.145
etc

and

[06-Apr-2020 09:14:52 Australia/Sydney] Request URI: /index.php?main_page=index&cPath=68, IP address: 66.249.75.53
etc

etc

What is it?
How can I find the file causing this?
Am I been hacked?

[oavs]

Additionally, I have some files in includes/templates/myTemplate as per picture highlighted . What are they? would they be the files causing my issue as they look suspicious?

Here is some of the contents here

PIE.htc

<!--
PIE: CSS3 rendering for IE
Version 1.0beta3
http://css3pie.com
Dual-licensed for use under the Apache License Version 2.0 or the General Public License (GPL) Version 2.
-->
<PUBLIC:COMPONENT lightWeight="true">
<PUBLIC:ATTACH EVENT="oncontentready" FOR="element" ONEVENT="init()" />
<PUBLIC:ATTACH EVENT="ondocumentready" FOR="element" ONEVENT="init()" />
<PUBLIC:ATTACH EVENT="ondetach" FOR="element" ONEVENT="cleanup()" />

<script type="text/javascript">
var doc = element.document;var h=window.PIE;
if(!h){h=window.PIE={I:"-pie-",Na:"Pie",Ja:"pie_",Bb:{TD:1,TH:1}};try{doc.execCommand("BackgroundImageCache",false,true)}catch(J){}h.D=function(){for(var a=4,b=doc.createElement("div"),c=b.getElementsByTagName("i");b.innerHTML="<!--[if gt IE "+ ++a+"]><i></i><![endif]--\>",c[0];);return a}();if(h.D===6)h.I=h.I.replace(/^-/,"");h.Wa=h.D===8&&doc.documentMode;h.n={Aa:function(a){var b=h.ec;if(!b){b=h.ec=doc.createDocumentFragment();b.namespaces.add("css3vml","urn:schemas-microsoft-com:vml")}return b.createElement("css3vml:"+a)},
oa:function(a){return a&&a._pieId||(a._pieId=+new Date+Math.random())},$a:function(a){var b,c,g,e,d=arguments;b=1;for(c=d.length;b<c;b++){e=d[b];for(g in e)if(e.hasOwnProperty(g))a[g]=e[g]}return a},Hb:function(a,b,c){var g=h.Yb||(h.Yb={}),e=g[a],d;if(e)b.call(c,e);else{d=new Image;d.onload=function(){e=g[a]={g:d.width,e:d.height};b.call(c,e);d.onload=null};d.src=a}}};h.ea=function(){this.ab=[];this.vb={}};h.ea.prototype={W:function(a){var b=h.n.oa(a),c=this.vb,g=this.ab;if(!(b in c)){c[b]=g.length;
g.push(a)}},Ga:function(a){a=h.n.oa(a);var b=this.vb;if(a&&a in b){delete this.ab[b[a]];delete b[a]}},Ca:function(){for(var a=this.ab,b=a.length;b--;)a[b]&&a[b]()}};if(h.Wa===8){h.La=new h.ea;setInterval(function(){h.La.Ca()},250)}h.F=new h.ea;window.attachEvent("onbeforeunload",function(){h.F.Ca()});h.F.ya=function(a,b,c){a.attachEvent(b,c);this.W(function(){a.detachEvent(b,c)})};(function(){function a(){h.ta.Ca()}h.ta=new h.ea;h.F.ya(window,"onresize",a)})();(function(){function a(){h.Ma.Ca()}h.Ma=
new h.ea;h.F.ya(window,"onscroll",a);h.ta.W(a)})();(function(){function a(){c=h.Ka.rc()}function b(){if(c){for(var g=0,e=c.length;g<e;g++)h.attach(c[g]);c=0}}var c;h.F.ya(window,"onbeforeprint",a);h.F.ya(window,"onafterprint",b)

etc etc;

PIE.php

<?php
/*
This file is a wrapper, for use in PHP environments, which serves PIE.htc using the
correct content-type, so that IE will recognize it as a behavior.  Simply specify the
behavior property to fetch this .php file instead of the .htc directly:

.myElement {
    [ ...css3 properties... ]
    behavior: url(PIE.php);
}

This is only necessary when the web server is not configured to serve .htc files with
the text/x-component content-type, and cannot easily be configured to do so (as is the
case with some shared hosting providers).
*/

header( 'Content-type: text/x-component' );
include( 'PIE.htc' );
?>

prepros.cfg

 {
    "About This File": "This is Prepros config file, https://prepros.io . Please do not edit this file, doing so can crash Prepros."
  },
  {
    "data": {
      "id": "",
      "cfgVersion": 2,
      "name": "theme840",
      "path": "",
      "files": {
        "32025362": {
          "id": "32025362",
          "path": "templates/tpl_create_account_success_default.php",
          "output": "templates/tpl_create_account_success_default.php",
          "name": "tpl_create_account_success_default.php",
          "category": "JUST_WATCH",
          "customOutput": false,
          "imported": false,
          "parents": [],
          "type": "php"
        },
        "42953822": {
          "id": "42953822",
          "path": "jscript/jscript_top.js",
          "output": "jscript/jscript_top-dist.js",
          "name": "jscript_top.js",
          "category": "JS",
          "autoCompile": false,
          "uglify": true,
          "mangle": true,
          "sourceMaps": false,
          "customOutput": false,
          "imported": false,
          "parents": [],
          "type": "javascript"
        },
        "53268462": {
          "id": "53268462",
          "path": "templates/tpl_product_music_info_display.php",
          "output": "templates/tpl_product_music_info_display.php",
          "name": "tpl_product_music_info_display.php",
          "category": "JUST_WATCH",
          "customOutput": false,
          "imported": false,

etc etc;

[mc12345678]

At least one of the ip addresses is google doing a routine search. It seems that the issue is more with the undefined constant than anything else. I thought I saw a "fix" for this in Zen Cart 1.5.7 code where it provides a more "favorable" response or at least doesn't generate a debug log file.

As for the other HTC type code? Thought that would be part of the template and/or something about the host/server. If the source of the file/code is unknown and/or completely unexpected, then yes it should be investigated but from what has been seen it seems unrelated to the first post of this thread.

[mc12345678]

Sorry, bad connection caused same post to get reposted. Deleted and replaced with what you see.

[Design75]

Pie is/was used to make older ie versions compatible with CSS3

[oavs]

At least one of the ip addresses is google doing a routine search. It seems that the issue is more with the undefined constant than anything else. I thought I saw a "fix" for this in Zen Cart 1.5.7 code where it provides a more "favorable" response or at least doesn't generate a debug log file.

As for the other HTC type code? Thought that would be part of the template and/or something about the host/server. If the source of the file/code is unknown and/or completely unexpected, then yes it should be investigated but from what has been seen it seems unrelated to the first post of this thread.

Thanks you are correct with HTC type code I found out.

I'll wait for someone let me know the fix for the "undefined constant"

[mc12345678]

Thanks you are correct with HTC type code I found out.

I'll wait for someone let me know the fix for the "undefined constant"

See this PR for the associated fix to what seems to have been described: https://github.com/zencart/zencart/c...90ff11aabec48a

[oavs]

See this PR for the associated fix to what seems to have been described: https://github.com/zencart/zencart/c...90ff11aabec48a

Ok this fix got rid of the error log completely.

My problem of logging in as the customer:
1. Customer Login page "Sign In" button looks dimmed but "Forgot your password" is bold. Just reporting this in the case gives any clues.
2. Entering correct email and password does not even reload the page. Only the Chrome status spinner shows at the browser tab then spinner stops.


Adding products to cart:
1. Adding any product has the same effect as in the #2 above. During the adding status says "Successfully added Product to the cart ..." but no products are added.

Where should I look? Would they be related issues?

No error logs !!