Summary: one incident discovered from one client

	192.168.21.127 | 1 incident | impact ∑: 12	attacks only
	Description: A targeted scan yesterday. A total of one incident was discovered by phpids detection modules.
Impact Tags Remote-City Remote-Host Remote-Logname Remote-User Date Request Final-Status Bytes-Sent Referer User-Agent 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 06:26:00 +0200 GET / HTTP/1.1 200 5022 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 06:29:52 +0200 GET /.git/config HTTP/1.1 404 456 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 06:37:55 +0200 GET / HTTP/1.1 200 5042 - Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 06:58:18 +0200 GET /robots.txt HTTP/1.1 404 462 - Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 06:59:24 +0200 GET / HTTP/1.1 200 5042 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 07:43:18 +0200 GET /2021_01_21_vipex_access.log.1.html HTTP/1.1 200 41614 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 08:09:37 +0200 GET / HTTP/1.1 200 5042 - python-requests/2.28.1 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 08:09:50 +0200 GET / HTTP/1.1 200 94682 - - 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 08:16:08 +0200 GET / HTTP/1.0 200 94553 - - 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 08:47:10 +0200 GET /2019_12_14_vipex_access.log.1.html HTTP/1.1 200 244 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 09:21:49 +0200 HEAD / HTTP/1.1 200 146 - Go-http-client/1.1 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 09:21:54 +0200 GET / HTTP/1.1 200 5051 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 09:21:54 +0200 GET /icons/text.gif HTTP/1.1 200 476 http://webproxy1.opennet.hu/ Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 09:40:44 +0200 GET /2022_01_05_report_access.log.1.html HTTP/1.1 200 32913 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 10:07:31 +0200 GET /2020_01_29_vipex_access.log.1.html HTTP/1.1 200 38909 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 10:39:02 +0200 GET / HTTP/1.1 200 5042 - Mozilla/5.0 (compatible, MSIE 10.0, Windows NT, DigExt) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 11:20:32 +0200 GET / HTTP/1.1 200 94682 - - 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 11:46:09 +0200 GET / HTTP/1.1 200 5042 - Mozilla/5.0 (compatible, MSIE 10.0, Windows NT, DigExt) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 11:50:06 +0200 GET /2021_12_08_report_access.log.1.html HTTP/1.1 404 456 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 12:26:06 +0200 GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 12:32:13 +0200 GET /owa/auth/logon.aspx HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 12:35:17 +0200 GET / HTTP/1.1 200 94682 - - 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 12:52:52 +0200 GET / HTTP/1.1 200 94682 - Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 13:37:15 +0200 GET /2020_11_29_vipex_access.log.1.html HTTP/1.1 200 31633 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 14:16:12 +0200 GET / HTTP/1.1 200 94682 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 14:16:12 +0200 GET /mftp/ HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 14:30:49 +0200 GET /2022_01_06_vipex_access.log.1.html HTTP/1.1 200 31549 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:10:28 +0200 GET /favicon.ico HTTP/1.1 404 462 http://webproxy1.opennet.hu/2020_08_31_vipex_access.log.1.html Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:11:01 +0200 GET /icons/blank.gif HTTP/1.1 200 395 http://webproxy1.opennet.hu/ Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:11:07 +0200 GET /2022_08_15_vipex_access.log.1.html HTTP/1.1 200 48043 http://webproxy1.opennet.hu/ Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:11:27 +0200 GET / HTTP/1.1 206 5098 - Slackbot-LinkExpanding 1.0 (+https://api.slack.com/robots) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:11:40 +0200 GET / HTTP/1.1 200 5051 - Mozilla/5.0 (iPhone; CPU iPhone OS 15_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Mobile/15E148 Safari/604.1 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:11:40 +0200 GET /icons/text.gif HTTP/1.1 200 476 http://webproxy1.opennet.hu/ Mozilla/5.0 (iPhone; CPU iPhone OS 15_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Mobile/15E148 Safari/604.1 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:12:12 +0200 GET / HTTP/1.1 200 5051 - Mozilla/5.0 (iPhone; CPU iPhone OS 15_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Mobile/15E148 Safari/604.1 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:14:14 +0200 GET /2022_08_14_report_access.log.1.html HTTP/1.1 200 244 http://webproxy1.opennet.hu/ Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:15:05 +0200 GET /2019_12_05_vipex_access.log.1.html HTTP/1.1 200 244 https://www.google.com/ Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:15:14 +0200 GET /2020_11_07_vipex_access.log.1.html HTTP/1.1 200 31090 http://webproxy1.opennet.hu/ Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:15:53 +0200 GET / HTTP/1.1 200 5051 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:16:05 +0200 GET /i.php HTTP/1.1 404 209 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:24:23 +0200 GET /2020_01_23_vipex_access.log.1.html HTTP/1.1 200 62153 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:24:27 +0200 GET /robots.txt HTTP/1.1 404 456 - - 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:24:30 +0200 GET /.well-known/security.txt HTTP/1.1 404 456 - - 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:28:48 +0200 POST / HTTP/1.1 404 456 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:28:49 +0200 GET /vendor/.env HTTP/1.1 404 456 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 15:28:51 +0200 GET /91.223.222.117/.env HTTP/1.1 404 456 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 16:07:16 +0200 GET /.env HTTP/1.1 404 456 - Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 16:17:58 +0200 GET /2021_01_07_vipex_access.log.1.html HTTP/1.1 200 31561 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 16:30:57 +0200 GET / HTTP/1.1 200 94682 - Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 17:11:32 +0200 GET /2022_01_20_report_access.log.1.html HTTP/1.1 200 34535 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 17:32:00 +0200 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 17:58:26 +0200 POST /10283841 HTTP/1.1 404 456 - Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 18:24:05 +0200 GET /actuator/health HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 18:53:55 +0200 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1 404 209 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 12 xss csrf id rfe lfi - 192.168.21.127 - - Tue, 16 Aug 2022 19:20:09 +0200 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1 200 5042 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 19:52:15 +0200 GET /robots.txt HTTP/1.1 404 462 - Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 20:01:19 +0200 GET / HTTP/1.1 200 94683 - - 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 20:02:30 +0200 GET http://www.example.com HTTP/1.1 400 - - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36A 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 20:15:00 +0200 GET / HTTP/1.1 200 94682 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 20:19:23 +0200 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1 200 5042 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 20:45:49 +0200 GET /2021_08_01_vipex_access.log.1.html HTTP/1.1 200 31562 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 21:16:48 +0200 GET / HTTP/1.1 200 5042 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 21:21:01 +0200 GET /console/ HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 21:48:42 +0200 POST /Autodiscover/Autodiscover.xml HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 22:32:58 +0200 GET /2021_11_22_vipex_access.log.1.html HTTP/1.1 200 33970 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 22:56:05 +0200 GET / HTTP/1.1 200 5042 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 23:11:24 +0200 GET / HTTP/1.1 200 5042 - Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 23:29:25 +0200 GET / HTTP/1.1 200 5042 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Tue, 16 Aug 2022 23:57:27 +0200 POST /cgi-bin/../../../../bin/sh HTTP/1.1 400 488 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36