Summary: 2 incidents discovered from one client

	192.168.21.127 | 2 incidents | impact ∑: 28	attacks only
	Description: A targeted scan and human attacker yesterday. A total of 2 incidents where discovered by phpids detection modules.
Impact Tags Remote-City Remote-Host Remote-Logname Remote-User Date Request Final-Status Bytes-Sent Referer User-Agent 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 00:08:15 +0100 GET / HTTP/1.1 200 5954 - python-requests/2.28.1 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 00:38:20 +0100 CONNECT cloudflare.com:443 HTTP/1.1 400 - - Go-http-client/1.1 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 00:40:37 +0100 GET /favicon.ico HTTP/1.1 404 457 - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 00:43:08 +0100 GET / HTTP/1.1 200 5954 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 00:43:18 +0100 HEAD /icons/../../apache2/icons/sphere1.png HTTP/1.1 400 161 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 00:43:19 +0100 HEAD /icons/.%2e/.%2e/apache2/icons/non-existant-image.png HTTP/1.1 400 161 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 01:13:29 +0100 GET /script/ HTTP/1.1 404 456 - Mozilla/5.0 (Windows; U; Windows NT 6.1) AppleWebKit/534.24.1 (KHTML, like Gecko) Version/4.0.4 Safari/534.24.1 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 01:42:00 +0100 GET / HTTP/1.1 200 5954 - Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 02:02:27 +0100 POST /boaform/admin/formLogin HTTP/1.1 404 456 http://91.223.222.117:80/admin/login.asp Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 02:58:03 +0100 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1 200 5954 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 03:05:51 +0100 GET /favicon.ico HTTP/1.1 404 456 - Mozilla/5.0 (X11; Linux x86_64; rv:104.0) Gecko/20100101 Firefox/104.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 03:11:19 +0100 GET /explore HTTP/1.1 404 456 - Mozilla/5.0 (Linux; Android 8.1.0; LM-X210CMR) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 04:00:00 +0100 GET / HTTP/1.1 200 5954 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 04:23:03 +0100 GET /2022_01_16_vipex_access.log.1.html HTTP/1.1 200 63052 - Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 04:24:24 +0100 GET / HTTP/1.1 200 5954 - Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 04:32:08 +0100 GET /actuator/gateway/routes HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 05:20:55 +0100 GET / HTTP/1.1 200 5954 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 05:30:05 +0100 GET / HTTP/1.1 200 5954 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 05:39:01 +0100 GET /robots.txt HTTP/1.1 404 462 - Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 05:52:38 +0100 POST /boaform/admin/formLogin HTTP/1.1 404 456 http://91.223.222.117:80/admin/login.asp Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 06:02:38 +0100 GET /2022_01_16_vipex_access.log.1.html HTTP/1.1 200 31520 https://www.google.com/ Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 06:10:53 +0100 GET /id1^ HTTP/1.1 400 - - - 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 07:18:14 +0100 GET / HTTP/1.1 200 5974 - Linux Gnu (cow) 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 07:45:30 +0100 GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1 400 - - - 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 08:01:11 +0100 GET / HTTP/1.1 200 5974 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6 Safari/605.1.15 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 08:14:02 +0100 GET / HTTP/1.0 200 116294 - masscan/1.3 (https://github.com/robertdavidgraham/masscan) 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 08:28:49 +0100 POST /boaform/admin/formLogin HTTP/1.1 404 456 http://91.223.222.117:80/admin/login.asp Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 08:50:59 +0100 POST /boaform/admin/formLogin HTTP/1.1 404 456 http://91.223.222.117:80/admin/login.asp Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 09:11:49 +0100 CONNECT cloudflare.com:443 HTTP/1.1 400 - - Go-http-client/1.1 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 09:19:26 +0100 GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 09:30:12 +0100 GET /login/ HTTP/1.1 404 457 - Mozilla/5.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 09:52:27 +0100 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1 200 5975 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 10:20:12 +0100 GET / HTTP/1.1 200 116441 - curl/7.29.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 10:41:54 +0100 POST /boaform/admin/formLogin HTTP/1.1 404 456 http://91.223.222.117:80/admin/login.asp Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 10:45:15 +0100 GET /.env HTTP/1.1 404 462 - libwww-perl/5.833 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 10:45:17 +0100 GET /.env HTTP/1.1 404 462 - libwww-perl/5.833 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 10:45:20 +0100 GET /.env HTTP/1.1 404 462 - libwww-perl/5.833 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 10:45:22 +0100 GET /.env HTTP/1.1 404 462 - libwww-perl/5.833 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 10:45:38 +0100 POST /uploadscript.php HTTP/1.1 503 575 - Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 11:04:10 +0100 GET /remote/login HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 11:23:47 +0100 GET /login HTTP/1.1 404 457 - Mozilla/5.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 11:58:05 +0100 GET /Electron/download/windows/\Program Files\3CX Phone System\Data\DB\base\16384\16393 HTTP/1.1 404 456 - xfa1 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 12:03:52 +0100 GET /manager/text/list HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 12:31:21 +0100 GET /manager/html HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 13:12:17 +0100 GET / HTTP/1.1 200 5974 - Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 13:48:32 +0100 GET / HTTP/1.1 200 5974 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 14:10:39 +0100 GET / HTTP/1.1 200 5974 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 14:38:57 +0100 POST /boaform/admin/formLogin HTTP/1.1 404 456 http://91.223.222.117:80/admin/login.asp Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 14:42:55 +0100 GET / HTTP/1.1 200 116442 - Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 15:30:15 +0100 POST /boaform/admin/formLogin HTTP/1.1 404 456 http://91.223.222.117:80/admin/login.asp Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 15:39:43 +0100 GET /favicon.ico HTTP/1.1 404 462 http://webproxy1.opennet.hu/2022_01_25_report_access.log.1.html Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:04:24 +0100 GET / HTTP/1.1 200 116441 - Hello World 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:33 +0100 OPTIONS / HTTP/1.0 200 192 - - 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:33 +0100 GET /nice ports,/Trinity.txt.bak HTTP/1.0 404 461 - - 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:39 +0100 OPTIONS / HTTP/1.0 200 192 - - 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 OPTIONS / RTSP/1.0 400 - - - 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 GET /rest/applinks/1.0/manifest HTTP/1.1 404 462 - curl/7.54.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 PUT /api/v2/cmdb/system/admin/admin HTTP/1.1 405 525 - Report Runner - Internet Research 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 POST /casa/nodes/thumbprints HTTP/1.1 404 448 - Guayoyo - Mozilla/5.0 (compatible; vCenter) 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 GET /dana-na/../dana/html5acc/guacamole/../../../../../../etc/passwd?/dana/html5acc/guacamole/ HTTP/1.1 400 494 - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 15 xss csrf id rfe dt lfi - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 GET / CSCOT /translation-table?type=mst&textdomain=/+CSCOE+/portal_inc.lua&default-language&lang=../ HTTP/1.1 404 463 - curl/7.54.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 GET /aspnet-ajax/Telerik.Web.UI.WebResource.axd?type=rau HTTP/1.1 404 462 - curl/7.54.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 GET /logon/LogonPoint/tmindex.html HTTP/1.1 404 462 - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 13 dt id lfi xss csrf - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 GET /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession HTTP/1.1 404 463 - curl/7.54.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 PUT /api/v2/cmdb/system/admin/admin HTTP/1.1 405 525 - Report Runner - Internet Research 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 GET /dana-na/../dana/html5acc/guacamole/../../../../../../etc/passwd?/dana/html5acc/guacamole/ HTTP/1.1 400 494 - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 GET /ui/login.action HTTP/1.1 404 448 - Guayoyo - Mozilla/5.0 (compatible; vCenter) 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 GET /ui/login.action HTTP/1.1 404 448 - Guayoyo - Mozilla/5.0 (compatible; vCenter) 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 GET /jira/rest/applinks/1.0/manifest HTTP/1.1 404 462 - curl/7.54.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 GET /confluence/rest/applinks/1.0/manifest HTTP/1.1 404 462 - curl/7.54.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 GET /bitbucket/rest/applinks/1.0/manifest HTTP/1.1 404 462 - curl/7.54.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 GET /bamboo/rest/applinks/1.0/manifest HTTP/1.1 404 462 - curl/7.54.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:18:45 +0100 GET /crowd/rest/applinks/1.0/manifest HTTP/1.1 404 462 - curl/7.54.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 16:44:12 +0100 POST /_profiler/phpinfo HTTP/1.1 404 456 - curl/7.64.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 17:42:38 +0100 POST /HNAP1/ HTTP/1.0 408 487 - - 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 17:45:45 +0100 GET /explore HTTP/1.1 404 456 - everyfeed-spider/2.0 (http://www.everyfeed.com) 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 19:02:16 +0100 GET / HTTP/1.1 200 116441 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 19:09:05 +0100 GET /HNAP1/ HTTP/1.1 404 456 http://91.223.222.117/ Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 19:57:21 +0100 GET / HTTP/1.1 200 116441 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 20:05:11 +0100 GET / HTTP/1.1 200 5974 - Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 20:14:22 +0100 GET /robots.txt HTTP/1.1 404 462 - Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 20:17:05 +0100 GET /2022_01_29_report_access.log.1.html HTTP/1.1 200 33651 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 20:22:04 +0100 GET / HTTP/1.1 200 116441 - Hello World 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 20:58:26 +0100 GET /dns-query?dns=DUIBAAABAAAAAAAABWJhaWR1A2NvbQAAAQAB HTTP/1.1 404 456 - python-httpx/0.23.1 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 20:58:27 +0100 GET /dns-query?name=baidu.com&type=A HTTP/1.1 404 456 - python-httpx/0.23.1 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 21:24:10 +0100 GET / HTTP/1.1 200 116441 - Hello World 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 22:30:58 +0100 GET /0bef HTTP/1.0 404 461 - - 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 22:39:06 +0100 GET / HTTP/1.1 200 116442 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 22:44:52 +0100 GET / HTTP/1.1 200 5975 - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 22:44:56 +0100 GET /robots.txt HTTP/1.1 404 457 - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 23:16:13 +0100 GET / HTTP/1.1 200 5974 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 23:16:57 +0100 GET / HTTP/1.1 200 5974 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Tue, 29 Nov 2022 23:43:13 +0100 GET / HTTP/1.1 200 5974 - python-requests/2.28.1