Summary: one incident discovered from one client

	192.168.21.127 | 1 incident | impact ∑: 12	attacks only
	Description: A targeted scan and human attacker 23 hours ago. A total of one incident was discovered by phpids detection modules.
Impact Tags Remote-City Remote-Host Remote-Logname Remote-User Date Request Final-Status Bytes-Sent Referer User-Agent 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 06:56:08 +0100 GET / HTTP/1.1 200 4445 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 07:21:09 +0100 GET / HTTP/1.1 200 4445 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 07:30:11 +0100 GET / HTTP/1.0 200 80721 - - 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 07:42:44 +0100 GET /.env HTTP/1.1 404 456 - Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 07:51:19 +0100 GET / HTTP/1.1 200 80841 - - 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 08:34:11 +0100 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 404 457 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 08:55:07 +0100 GET /aaa9 HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 09:38:57 +0100 GET / HTTP/1.1 200 80841 - - 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 09:40:16 +0100 GET / HTTP/1.0 200 80721 - - 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 10:23:09 +0100 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1 200 4446 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 10:48:31 +0100 POST /HNAP1/ HTTP/1.1 404 456 - Mozila/5.0 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 11:14:45 +0100 GET / HTTP/1.1 200 4445 - Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 11:59:41 +0100 POST /mifs/.;/services/LogService HTTP/1.1 404 457 https://91.223.222.117:443 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 12:21:20 +0100 GET /owa/auth/logon.aspx?url=https://1/ecp/ HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 12:36:39 +0100 GET / HTTP/1.1 200 80841 - Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 13:33:14 +0100 POST /Autodiscover/Autodiscover.xml HTTP/1.1 404 457 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 14:18:29 +0100 GET /_ignition/execute-solution HTTP/1.1 404 457 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 15:05:40 +0100 GET / HTTP/1.1 200 4446 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 15:40:11 +0100 GET / HTTP/1.1 200 4445 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 16:59:24 +0100 POST /admin HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 17:31:02 +0100 GET / HTTP/1.1 200 4445 - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 17:55:46 +0100 GET / HTTP/1.1 200 4445 - Linux Gnu (cow) 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 19:05:05 +0100 GET http://www.example.com HTTP/1.1 400 - - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36A 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 19:51:21 +0100 GET /portal/redlion HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 20:18:15 +0100 GET / HTTP/1.1 200 80842 - - 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 20:18:42 +0100 GET /sendgrid.env HTTP/1.1 404 456 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 20:18:42 +0100 GET /.sendgrid HTTP/1.1 404 456 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 21:00:05 +0100 GET / HTTP/1.1 200 80842 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 21:34:32 +0100 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 22:12:12 +0100 GET / HTTP/1.1 200 80842 - libwww-perl/6.45 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 22:47:45 +0100 GET / HTTP/1.1 200 4445 - Mozilla/5.0 zgrab/0.x 12 xss csrf id rfe lfi - 192.168.21.127 - - Wed, 19 Jan 2022 23:30:09 +0100 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1 200 4445 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 19 Jan 2022 23:47:27 +0100 GET /users/sign_in HTTP/1.0 404 461 - -